Skip to content

Commit d382764

Browse files
dougchdougch
committed
chore(GHA): allow OIDC aws credentials
1 parent 7752afb commit d382764

File tree

6 files changed

+59
-50
lines changed

6 files changed

+59
-50
lines changed

‎.github/actions/duvet/README.md

+12-4
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,19 @@ Path to the output report generated in `report-script`. Defaults to `report.html
1616

1717
### `aws-access-key-id: ''`
1818

19-
An AWS access key. The corresponding user must have S3 write permissions.
19+
Deprecated. This was previously used to authenticate with long lived IAM credentials. See [Configuring OpenID Connect](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers)
2020

2121
### `aws-secret-access-key: ''`
2222

23-
The AWS secret key.
23+
Deprecated. This was previously used to authenticate with long lived IAM credentials. See [Configuring OpenID Connect](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers)
24+
25+
### `role-to-assume: ''`
26+
27+
For Open ID Connect, the role attached to the IdP, in the form of an ARN. Intended for use with [AWS](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
28+
29+
### `role-session-name: ''`
30+
31+
For Open ID Connect, an arbitrary session name. Intended for use with [AWS](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
2432

2533
### `aws-s3-bucket-name: ''`
2634

@@ -52,8 +60,8 @@ jobs:
5260
with:
5361
s2n-quic-dir: ./s2n-quic
5462
report-script: compliance/generate_report.sh
55-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
56-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
63+
role-to-assume: arn:aws:iam::123456789:role/GitHubOIDCRole
64+
role-session-name: GithubActionSession
5765
aws-s3-bucket-name: s2n-tls-ci-artifacts
5866
aws-s3-region: us-west-2
5967
cdn: https://d3fqnyekunr9xg.cloudfront.net

‎.github/actions/duvet/action.yml

+7-7
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ inputs:
77
report-path:
88
description: 'Path to generated Duvet report output'
99
required: false
10-
aws-access-key-id:
11-
description: 'AWS access key ID with S3 permissions'
10+
role-to-assume:
11+
description: 'Role to assume for OpenID Connect'
1212
required: true
13-
aws-secret-access-key:
14-
description: 'AWS secret key'
13+
role-session-name:
14+
description: 'Role session name for OpenID Connect'
1515
required: true
1616
aws-s3-bucket-name:
1717
description: 'Destination S3 bucket name for duvet reports'
@@ -46,11 +46,11 @@ runs:
4646
shell: bash
4747
run: ${{ inputs.report-script }} ${{ github.sha }}
4848

49-
- uses: aws-actions/configure-aws-credentials@v1.6.1
49+
- uses: aws-actions/configure-aws-credentials@v4.0.2
5050
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
5151
with:
52-
aws-access-key-id: ${{ inputs.aws-access-key-id }}
53-
aws-secret-access-key: ${{ inputs.aws-secret-access-key}}
52+
role-to-assume: ${{ inputs.role-to-assume}}
53+
role-session-name: ${{ inputs.role-session-name}}
5454
aws-region: ${{ inputs.aws-s3-region }}
5555

5656
- name: Upload to S3

‎.github/workflows/book.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,9 @@ jobs:
4848
- uses: aws-actions/configure-aws-credentials@v4.0.2
4949
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
5050
with:
51-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
52-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
53-
aws-region: us-west-1
51+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
52+
role-session-name: S2nQuicGHABookSession
53+
aws-region: us-west-2
5454

5555
- name: Upload to S3
5656
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name

‎.github/workflows/ci.yml

+22-21
Original file line numberDiff line numberDiff line change
@@ -164,9 +164,9 @@ jobs:
164164
- uses: aws-actions/configure-aws-credentials@v4.0.2
165165
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
166166
with:
167-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
168-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
169-
aws-region: us-west-1
167+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
168+
role-session-name: S2nQuicGHADocSession
169+
aws-region: us-west-2
170170

171171
- name: Upload to S3
172172
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -350,10 +350,10 @@ jobs:
350350
with:
351351
report-script: ./scripts/compliance
352352
report-path: ./target/compliance/report.html
353-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
354-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
353+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
354+
role-session-name: S2nQuicGHAComplianceSession
355+
aws-s3-region: us-west-2
355356
aws-s3-bucket-name: s2n-quic-ci-artifacts
356-
aws-s3-region: us-west-1
357357
cdn: $CDN
358358

359359
coverage:
@@ -385,9 +385,9 @@ jobs:
385385
- uses: aws-actions/configure-aws-credentials@v4.0.2
386386
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
387387
with:
388-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
389-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
390-
aws-region: us-west-1
388+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
389+
role-session-name: S2nQuicGHACoverageSession
390+
aws-region: us-west-2
391391

392392
- name: Upload results
393393
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -497,9 +497,9 @@ jobs:
497497
- uses: aws-actions/configure-aws-credentials@v4.0.2
498498
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
499499
with:
500-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
501-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
502-
aws-region: us-west-1
500+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
501+
role-session-name: S2nQuicGHARecoverySession
502+
aws-region: us-west-2
503503

504504
- name: Upload to S3
505505
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -542,9 +542,9 @@ jobs:
542542
- uses: aws-actions/configure-aws-credentials@v4.0.2
543543
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
544544
with:
545-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
546-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
547-
aws-region: us-west-1
545+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
546+
role-session-name: S2nQuicGHASimsSession
547+
aws-region: us-west-2
548548

549549
- name: Upload to S3
550550
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -649,9 +649,10 @@ jobs:
649649
- uses: aws-actions/configure-aws-credentials@v4.0.2
650650
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
651651
with:
652-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
653-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
654-
aws-region: us-west-1
652+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
653+
role-session-name: S2nQuicGHATimingSession
654+
aws-region: us-west-2
655+
655656

656657
- name: Upload to S3
657658
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -744,9 +745,9 @@ jobs:
744745
- uses: aws-actions/configure-aws-credentials@v4.0.2
745746
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
746747
with:
747-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
748-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
749-
aws-region: us-west-1
748+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
749+
role-session-name: S2nQuicGHADhatSession
750+
aws-region: us-west-2
750751

751752
- name: Upload to S3
752753
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name

‎.github/workflows/qns.yml

+12-12
Original file line numberDiff line numberDiff line change
@@ -213,9 +213,9 @@ jobs:
213213
- uses: aws-actions/configure-aws-credentials@v4.0.2
214214
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
215215
with:
216-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
217-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
218-
aws-region: us-west-1
216+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
217+
role-session-name: S2nQuicGHAInteropSession
218+
aws-region: us-west-2
219219

220220
- name: Upload to S3
221221
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -305,9 +305,9 @@ jobs:
305305
- uses: aws-actions/configure-aws-credentials@v4.0.2
306306
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
307307
with:
308-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
309-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
310-
aws-region: us-west-1
308+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
309+
role-session-name: S2nQuicGHAInteropReportSession
310+
aws-region: us-west-2
311311

312312
- name: Upload to S3
313313
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -408,9 +408,9 @@ jobs:
408408
- uses: aws-actions/configure-aws-credentials@v4.0.2
409409
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
410410
with:
411-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
412-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
413-
aws-region: us-west-1
411+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
412+
role-session-name: S2nQuicGHABenchSession
413+
aws-region: us-west-2
414414

415415
- name: Upload results
416416
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
@@ -556,9 +556,9 @@ jobs:
556556
- uses: aws-actions/configure-aws-credentials@v4.0.2
557557
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
558558
with:
559-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
560-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
561-
aws-region: us-west-1
559+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
560+
role-session-name: S2nQuicGHAPerfReportSession
561+
aws-region: us-west-2
562562

563563
- name: Upload results
564564
if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name

‎.github/workflows/tshark.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,9 @@ jobs:
4848
- uses: aws-actions/configure-aws-credentials@v4.0.2
4949
if: github.event_name == 'schedule' || github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
5050
with:
51-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
52-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
53-
aws-region: us-west-1
51+
role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
52+
role-session-name: S2nQuicGHADocSession
53+
aws-region: us-west-2
5454

5555
- name: Upload to S3
5656
if: github.event_name == 'schedule' || github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name

0 commit comments

Comments
 (0)