Skip to content

Commit 50f240e

Browse files
anuraagaanuraaga
authored
Use GitHub OpenID to authenticate to AWS. (#80)
1 parent b645fdf commit 50f240e

File tree

8 files changed

+121
-252
lines changed

8 files changed

+121
-252
lines changed

‎.github/collector/docker-compose.yml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@ services:
44
image: amazon/aws-otel-collector:latest
55
command: --config /config/collector-config.yml --log-level debug
66
environment:
7-
- AWS_ACCESS_KEY_ID
8-
- AWS_SECRET_ACCESS_KEY
9-
- AWS_SESSION_TOKEN
107
- AWS_ROLE_ARN
118
- AWS_WEB_IDENTITY_TOKEN_FILE
129
volumes:
@@ -20,9 +17,6 @@ services:
2017
environment:
2118
- INSTANCE_ID
2219
- LISTEN_ADDRESS
23-
- AWS_ACCESS_KEY_ID
24-
- AWS_SECRET_ACCESS_KEY
25-
- AWS_SESSION_TOKEN
2620
- AWS_ROLE_ARN
2721
- AWS_WEB_IDENTITY_TOKEN_FILE
2822
- OTEL_RESOURCE_ATTRIBUTES=service.name=aws-otel-integ-test
@@ -42,9 +36,6 @@ services:
4236
- otel
4337
- app
4438
environment:
45-
- AWS_ACCESS_KEY_ID
46-
- AWS_SECRET_ACCESS_KEY
47-
- AWS_SESSION_TOKEN
4839
- AWS_ROLE_ARN
4940
- AWS_WEB_IDENTITY_TOKEN_FILE
5041
- AWS_REGION=us-west-2

‎.github/workflows/docker-build-corretto-slim.yml‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,31 @@ on:
66
- scripts/docker/corretto-slim/**
77
- .github/workflows/docker-build-corretto-slim.yml
88

9+
env:
10+
AWS_DEFAULT_REGION: us-east-1
11+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
12+
13+
permissions:
14+
id-token: write
15+
contents: read
16+
917
jobs:
1018
build-corretto:
1119
runs-on: ubuntu-latest
1220
steps:
1321
- uses: actions/checkout@v2
1422
- uses: gradle/wrapper-validation-action@v1
23+
24+
- run: sleep 5 # there's still a race condition for now
1525
- name: Configure AWS Credentials
16-
uses: aws-actions/configure-aws-credentials@v1
17-
with:
18-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
19-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
20-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
21-
role-duration-seconds: 1200
22-
aws-region: us-east-1
26+
run: |
27+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
28+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
29+
30+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
2331
- name: Login to ECR
24-
uses: docker/login-action@v1
25-
with:
26-
registry: public.ecr.aws
32+
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
33+
2734
- name: Set up Docker Buildx
2835
uses: docker/setup-buildx-action@v1
2936
- name: Cache Docker layers

‎.github/workflows/docker-build-smoke-tests-fake-backend.yml‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,14 @@ on:
88
- gradle/**
99
- .github/workflows/docker-build-smoke-tests-fake-backend.yml
1010

11+
env:
12+
AWS_DEFAULT_REGION: us-east-1
13+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
14+
15+
permissions:
16+
id-token: write
17+
contents: read
18+
1119
jobs:
1220
build-docker:
1321
runs-on: ubuntu-latest
@@ -17,18 +25,17 @@ jobs:
1725
with:
1826
java-version: 14
1927
- uses: gradle/wrapper-validation-action@v1
28+
29+
- run: sleep 5 # there's still a race condition for now
2030
- name: Configure AWS Credentials
21-
uses: aws-actions/configure-aws-credentials@v1
22-
with:
23-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
24-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
25-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
26-
role-duration-seconds: 1200
27-
aws-region: us-east-1
31+
run: |
32+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
33+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
34+
35+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
2836
- name: Login to ECR
29-
uses: docker/login-action@v1
30-
with:
31-
registry: public.ecr.aws
37+
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
38+
3239
- name: Build and push docker image
3340
uses: burrunan/gradle-cache-action@v1
3441
with:

‎.github/workflows/main-build-test.yml‎

Lines changed: 0 additions & 149 deletions
This file was deleted.

‎.github/workflows/main-build.yml‎

Lines changed: 38 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ on:
33
branches:
44
- main
55

6+
env:
7+
AWS_DEFAULT_REGION: us-east-1
8+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
9+
10+
permissions:
11+
id-token: write
12+
contents: read
13+
614
jobs:
715
build:
816
runs-on: ubuntu-latest
@@ -14,18 +22,17 @@ jobs:
1422
with:
1523
java-version: 14
1624
- uses: gradle/wrapper-validation-action@v1
25+
26+
- run: sleep 5 # there's still a race condition for now
1727
- name: Configure AWS Credentials
18-
uses: aws-actions/configure-aws-credentials@v1
19-
with:
20-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
21-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
22-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
23-
role-duration-seconds: 1200
24-
aws-region: us-east-1
28+
run: |
29+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
30+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
31+
32+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
2533
- name: Login to ECR
26-
uses: docker/login-action@v1
27-
with:
28-
registry: public.ecr.aws
34+
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
35+
2936
- name: Build snapshot with Gradle
3037
uses: burrunan/gradle-cache-action@v1
3138
with:
@@ -60,19 +67,15 @@ jobs:
6067
with:
6168
java-version: 14
6269

63-
- name: Configure AWS credentials
64-
uses: aws-actions/configure-aws-credentials@v1
65-
with:
66-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
67-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
68-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
69-
role-duration-seconds: 1200
70-
aws-region: us-east-1
70+
- run: sleep 5 # there's still a race condition for now
71+
- name: Configure AWS Credentials
72+
run: |
73+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
74+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
7175
76+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
7277
- name: Login to ECR
73-
uses: docker/login-action@v1
74-
with:
75-
registry: public.ecr.aws
78+
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
7679

7780
- name: Run test containers
7881
run: docker-compose up --abort-on-container-exit
@@ -95,19 +98,15 @@ jobs:
9598
with:
9699
java-version: 14
97100

98-
- name: Configure AWS credentials
99-
uses: aws-actions/configure-aws-credentials@v1
100-
with:
101-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
102-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
103-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
104-
role-duration-seconds: 1200
105-
aws-region: us-east-1
101+
- run: sleep 5 # there's still a race condition for now
102+
- name: Configure AWS Credentials
103+
run: |
104+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
105+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
106106
107+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
107108
- name: Login to ECR
108-
uses: docker/login-action@v1
109-
with:
110-
registry: public.ecr.aws
109+
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
111110

112111
- name: Run test containers
113112
run: docker-compose up --abort-on-container-exit
@@ -130,19 +129,15 @@ jobs:
130129
with:
131130
java-version: 14
132131

133-
- name: Configure AWS credentials
134-
uses: aws-actions/configure-aws-credentials@v1
135-
with:
136-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
137-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
138-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
139-
role-duration-seconds: 1200
140-
aws-region: us-east-1
132+
- run: sleep 5 # there's still a race condition for now
133+
- name: Configure AWS Credentials
134+
run: |
135+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
136+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
141137
138+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
142139
- name: Login to ECR
143-
uses: docker/login-action@v1
144-
with:
145-
registry: public.ecr.aws
140+
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
146141

147142
- name: Run test containers
148143
run: docker-compose up --abort-on-container-exit

0 commit comments

Comments
 (0)