Keep it secret, keep it safe

.github/workflows/regional_templates.yml

@@ -0,0 +1,170 @@
+name: Publish Regional Templates
+on:
+  push:
+    tags:
+      - v1.*
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    strategy:
+      matrix:
+        include:
+          - region: us-east-1
+            region-name: US East (N. Virginia)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: us-east-2
+            region-name: US East (Ohio)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: us-west-1
+            region-name: US West (N. California)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: us-west-2
+            region-name: US West (Oregon)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: af-south-1
+            region-name: Africa (Cape Town)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-east-1
+            region-name: Asia Pacific (Hong Kong)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-south-2
+            region-name: Asia Pacific (Hyderabad)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-southeast-3
+            region-name: Asia Pacific (Jakarta)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-southeast-4
+            region-name: Asia Pacific (Melbourne)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-south-1
+            region-name: Asia Pacific (Mumbai)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-northeast-3
+            region-name: Asia Pacific (Osaka)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-northeast-2
+            region-name: Asia Pacific (Seoul)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-southeast-1
+            region-name: Asia Pacific (Singapore)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-southeast-2
+            region-name: Asia Pacific (Sydney)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ap-northeast-1
+            region-name: Asia Pacific (Tokyo)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ca-central-1
+            region-name: Canada (Central)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: ca-west-1
+            region-name: Canada (Calgary)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-central-1
+            region-name: Europe (Frankfurt)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-west-1
+            region-name: Europe (Ireland)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-west-2
+            region-name: Europe (London)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-south-1
+            region-name: Europe (Milan)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-west-3
+            region-name: Europe (Paris)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-south-2
+            region-name: Europe (Spain)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-north-1
+            region-name: Europe (Stockholm)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: eu-central-2
+            region-name: Europe (Zurich)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: il-central-1
+            region-name: Israel (Tel Aviv)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: me-south-1
+            region-name: Middle East (Bahrain)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: me-central-1
+            region-name: Middle East (UAE)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: sa-east-1
+            region-name: South America (São Paulo)
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: us-gov-east-1
+            region-name: US East
+            aws-account-id: "282774566237"
+            aws-partition: aws-us-gov
+          - region: us-gov-west-1
+            region-name: US West
+            aws-account-id: "282774566237"
+            aws-partition: aws-us-gov
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - run: make build --always-make
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:${{ matrix.aws-partition }}:iam::${{ matrix.aws-account-id }}:role/GitHubActionsJWTIssuerStackTemplatesRole
+          aws-region: ${{ matrix.region }}
+      - uses: aws-actions/setup-sam@v2
+        with:
+          use-installer: true
+      - run: |
+          sam package \
+            --template template.yml \
+            --s3-bucket jwt-issuer-stack-templates-${{ matrix.region }} \
+            --s3-prefix jwt-issuer-${{ github.ref_name }} \
+            --output-template-file jwt-issuer-packaged.yml \
+            --region ${{ matrix.region }}
+        env:
+          SAM_CLI_TELEMETRY: "0"
+      - run: |
+          aws s3 cp \
+            jwt-issuer-packaged.yml \
+            s3://jwt-issuer-stack-templates-${{ matrix.region }}/jwt-issuer-v1.x.yml \
+            --region ${{ matrix.region }}
+          aws s3 cp \
+            jwt-issuer-packaged.yml \
+            s3://jwt-issuer-stack-templates-${{ matrix.region }}/jwt-issuer-${{ github.ref_name }}.yml \
+            --region ${{ matrix.region }}

.github/workflows/test.yml

@@ -0,0 +1,20 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - run: go version
+      - run: make test

.gitignore

@@ -0,0 +1,3 @@
+bin
+.aws-sam
+samconfig.toml

LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) JK Tech, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile

@@ -0,0 +1,26 @@
+MAKE_REL_PATH:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
+
+GOLANG ?= go
+GOARCH ?= arm64
+GO_BUILD_FLAGS ?= -ldflags="-s -w"
+GO_LAMBDA_TAGS ?= -tags "lambda.norpc"
+GO_BUILD ?= CGO_ENABLED=0 GOOS=linux GOARCH=${GOARCH} ${GOLANG} build ${GO_BUILD_FLAGS}
+GO_BUILD_FILES := $(shell find . -type f -not -path "./.git/*" -not -path "./bin/*" -not -name "*_test.go")
+
+bin/%/bootstrap: ${GO_BUILD_FILES}
+	cd cmd/$(patsubst bin/%/bootstrap,%,$@) && ${GO_BUILD} ${GO_LAMBDA_TAGS} -o ${MAKE_REL_PATH}/$@
+
+.PHONY: test
+test:
+	${GOLANG} test -count=1 ./...
+
+.PHONY: mocks
+mocks:
+	mockery --name=KMSAPI --srcpkg=./internal/issuer --output=internal/mocks
+	mockery --name=SSMAPI --srcpkg=./internal/issuer --output=internal/mocks
+
+.PHONY: build
+build: bin/key_generator/bootstrap
+build: bin/key_info_loader/bootstrap
+build: bin/jwt_issuer_kms/bootstrap
+build: bin/jwt_issuer_parameter_store/bootstrap