Merge pull request #4954 from systeminit/chore/check-creds

Chore/check creds

.github/workflows/deploy-auth-api.yml

@@ -6,17 +6,22 @@ env:
   AUTH_API_CLUSTER: shared-cluster
   AUTH_API_SERVICE: auth-api
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 jobs:
   deploy:
     name: Deploy latest stable image
     environment: shared
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
       - name: Trigger ECS Deploy
         run: |

.github/workflows/deploy-module-index.yml

@@ -6,6 +6,11 @@ env:
   MODULE_INDEX_CLUSTER: shared-cluster
   MODULE_INDEX_SERVICE: module-index
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 jobs:
   deploy:
     name: Deploy latest stable image

.github/workflows/down-service.yml

@@ -2,6 +2,11 @@ name: Bring Down Service
 
 run-name: Bringing ${{ inputs.service }} down
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/instance-refresh.yml

@@ -2,6 +2,11 @@ name: Instance refresh
 
 run-name: Replacing instances for ${{ inputs.service }}
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/invoke-and-check-invalidations.yml

@@ -2,6 +2,11 @@ name: Instigate & Check CDN State
 
 run-name: Instigate & Check CDN State for ${{ inputs.environment }} 
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/migrate-sdf.yml

@@ -1,5 +1,10 @@
 name: Migrate SDF
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/set-maintenance-mode.yml

@@ -1,5 +1,10 @@
 name: Set maintenance mode
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/set-service-version.yml

@@ -2,6 +2,11 @@ name: Set Service Version
 
 run-name: Setting ${{ inputs.service }} to version {{ inputs.version }} for {{ inputs.environment }}
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/up-service.yml

@@ -2,6 +2,11 @@ name: Bring Up Service
 
 run-name: Bringing ${{ inputs.service }} up
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/upgrade-service.yml

@@ -2,6 +2,11 @@ name: Upgrade Service
 
 run-name: Upgrading ${{ inputs.service }}
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/upgrade-web.yml

@@ -1,5 +1,10 @@
 name: Upgrade web
 
+# Required for IDP JWT and actions/checkout
+permissions:
+      id-token: write
+      contents: read
+
 on:
   workflow_call:
     inputs: