chore: implementing web-identity via github into aws

systeminit · Nov 11, 2024 · e490456 · e490456
1 parent b3313b5
commit e490456
Show file tree

Hide file tree

Showing 10 changed files with 40 additions and 40 deletions.
diff --git a/.github/workflows/deploy-module-index.yml b/.github/workflows/deploy-module-index.yml
@@ -12,11 +12,11 @@ jobs:
     environment: shared
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
       - name: Trigger ECS Deploy
         run: |

diff --git a/.github/workflows/down-service.yml b/.github/workflows/down-service.yml
@@ -20,11 +20,11 @@ jobs:
     name: ${{ inputs.service }} Down
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - name: Checkout code

diff --git a/.github/workflows/instance-refresh.yml b/.github/workflows/instance-refresh.yml
@@ -23,11 +23,11 @@ jobs:
     name: Instance refresh
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
       - name: Instance refresh
         run: |

diff --git a/.github/workflows/invoke-and-check-invalidations.yml b/.github/workflows/invoke-and-check-invalidations.yml
@@ -16,11 +16,11 @@ jobs:
     environment: ${{ inputs.environment }}
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - name: Invalidate web cache

diff --git a/.github/workflows/migrate-sdf.yml b/.github/workflows/migrate-sdf.yml
@@ -14,11 +14,11 @@ jobs:
     name: Migrate SDF
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - name: Checkout code

diff --git a/.github/workflows/set-maintenance-mode.yml b/.github/workflows/set-maintenance-mode.yml
@@ -14,11 +14,11 @@ jobs:
     name: Set maintenance mode
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - name: Checkout code

diff --git a/.github/workflows/set-service-version.yml b/.github/workflows/set-service-version.yml
@@ -24,11 +24,11 @@ jobs:
     environment: ${{ inputs.environment }}
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - name: Set service version

diff --git a/.github/workflows/up-service.yml b/.github/workflows/up-service.yml
@@ -20,11 +20,11 @@ jobs:
     name: ${{ inputs.service }} Up
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - name: Checkout code

diff --git a/.github/workflows/upgrade-service.yml b/.github/workflows/upgrade-service.yml
@@ -21,11 +21,11 @@ jobs:
     outputs:
       upgrade_failed: ${{ steps.check_failure.outputs.failed }}
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - name: Checkout code

diff --git a/.github/workflows/upgrade-web.yml b/.github/workflows/upgrade-web.yml
@@ -24,11 +24,11 @@ jobs:
     name: Deploy Service
     runs-on: ubuntu-latest
     steps:
-      - name: Configure AWS credentials for ${{ inputs.environment }}
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1.7.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ARN }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
 
       - uses: actions/checkout@v4