GitHubActionsRoleNextstrainBatchJobs: allow zika repo to assume role

We will still have to maintain a list of repos that are allowed to assume the role.
nextstrain · Apr 9, 2024 · cb1d709 · cb1d709
1 parent 6231d2e
commit cb1d709
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/env/production/aws-iam-role-GitHubActionsRoleNextstrainBatchJobs.tf b/env/production/aws-iam-role-GitHubActionsRoleNextstrainBatchJobs.tf
@@ -21,7 +21,10 @@ resource "aws_iam_role" "GitHubActionsRoleNextstrainBatchJobs" {
         "Condition": {
           "StringLike": {
             "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-            "token.actions.githubusercontent.com:sub": "repo:nextstrain/.github:*"
+            "token.actions.githubusercontent.com:sub": [
+              "repo:nextstrain/.github:*",
+              "repo:nextstrain/zika:*",
+            ]
           }
         },
       }