Skip to content

Commit a75098a

Browse files
author
Anuraag Agrawal
authored
Revert "Use aws-credentials action to configure creds bc it uses OIDC by default (#110)" (#111)
This reverts commit 16bd8a4.
1 parent 16bd8a4 commit a75098a

File tree

8 files changed

+56
-45
lines changed

8 files changed

+56
-45
lines changed

‎.github/collector/docker-compose.yml‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,8 @@ services:
44
image: amazon/aws-otel-collector:latest
55
command: --config /config/collector-config.yml
66
environment:
7-
- AWS_ACCESS_KEY_ID
8-
- AWS_SECRET_ACCESS_KEY
9-
- AWS_SESSION_TOKEN
107
- AWS_ROLE_ARN
8+
- AWS_WEB_IDENTITY_TOKEN_FILE
119
volumes:
1210
- .:/config
1311
- /tmp/awscreds:/tmp/awscreds
@@ -19,10 +17,8 @@ services:
1917
environment:
2018
- INSTANCE_ID
2119
- LISTEN_ADDRESS
22-
- AWS_ACCESS_KEY_ID
23-
- AWS_SECRET_ACCESS_KEY
24-
- AWS_SESSION_TOKEN
2520
- AWS_ROLE_ARN
21+
- AWS_WEB_IDENTITY_TOKEN_FILE
2622
- OTEL_RESOURCE_ATTRIBUTES=service.name=aws-otel-integ-test
2723
- OTEL_EXPORTER_OTLP_ENDPOINT=http://otel:4317
2824
- AWS_REGION=us-west-2
@@ -41,10 +37,8 @@ services:
4137
- otel
4238
- app
4339
environment:
44-
- AWS_ACCESS_KEY_ID
45-
- AWS_SECRET_ACCESS_KEY
46-
- AWS_SESSION_TOKEN
4740
- AWS_ROLE_ARN
41+
- AWS_WEB_IDENTITY_TOKEN_FILE
4842
- AWS_REGION=us-west-2
4943
volumes:
5044
- /tmp/awscreds:/tmp/awscreds

‎.github/workflows/docker-build-corretto-slim.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88

99
env:
1010
AWS_DEFAULT_REGION: us-east-1
11+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1112

1213
permissions:
1314
id-token: write
@@ -22,10 +23,11 @@ jobs:
2223

2324
- run: sleep 5 # there's still a race condition for now
2425
- name: Configure AWS Credentials
25-
uses: aws-actions/configure-aws-credentials@v1
26-
with:
27-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
28-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
26+
run: |
27+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
28+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
29+
30+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
2931
- name: Login to ECR
3032
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3133

‎.github/workflows/docker-build-smoke-tests-fake-backend.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010

1111
env:
1212
AWS_DEFAULT_REGION: us-east-1
13+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1314

1415
permissions:
1516
id-token: write
@@ -27,10 +28,11 @@ jobs:
2728

2829
- run: sleep 5 # there's still a race condition for now
2930
- name: Configure AWS Credentials
30-
uses: aws-actions/configure-aws-credentials@v1
31-
with:
32-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
33-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
31+
run: |
32+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
33+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
34+
35+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
3436
- name: Login to ECR
3537
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3638

‎.github/workflows/main-build.yml‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55

66
env:
77
AWS_DEFAULT_REGION: us-east-1
8+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
89

910
permissions:
1011
id-token: write
@@ -24,10 +25,11 @@ jobs:
2425

2526
- run: sleep 5 # there's still a race condition for now
2627
- name: Configure AWS Credentials
27-
uses: aws-actions/configure-aws-credentials@v1
28-
with:
29-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
30-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
28+
run: |
29+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
30+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
31+
32+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
3133
- name: Login to ECR
3234
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3335

@@ -67,10 +69,11 @@ jobs:
6769

6870
- run: sleep 5 # there's still a race condition for now
6971
- name: Configure AWS Credentials
70-
uses: aws-actions/configure-aws-credentials@v1
71-
with:
72-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
73-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
72+
run: |
73+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
74+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
75+
76+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
7477
- name: Login to ECR
7578
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
7679

@@ -97,10 +100,11 @@ jobs:
97100

98101
- run: sleep 5 # there's still a race condition for now
99102
- name: Configure AWS Credentials
100-
uses: aws-actions/configure-aws-credentials@v1
101-
with:
102-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
103-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
103+
run: |
104+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
105+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
106+
107+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
104108
- name: Login to ECR
105109
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
106110

@@ -127,10 +131,11 @@ jobs:
127131

128132
- run: sleep 5 # there's still a race condition for now
129133
- name: Configure AWS Credentials
130-
uses: aws-actions/configure-aws-credentials@v1
131-
with:
132-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
133-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
134+
run: |
135+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
136+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
137+
138+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
134139
- name: Login to ECR
135140
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
136141

‎.github/workflows/nightly-upstream-snapshot-build.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55

66
env:
77
AWS_DEFAULT_REGION: us-east-1
8+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
89

910
permissions:
1011
id-token: write
@@ -24,10 +25,11 @@ jobs:
2425

2526
- run: sleep 5 # there's still a race condition for now
2627
- name: Configure AWS Credentials
27-
uses: aws-actions/configure-aws-credentials@v1
28-
with:
29-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
30-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
28+
run: |
29+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
30+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
31+
32+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
3133
- name: Login to ECR
3234
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3335

‎.github/workflows/patch-release-build.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ on:
1212

1313
env:
1414
AWS_DEFAULT_REGION: us-east-1
15+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1516

1617
permissions:
1718
id-token: write
@@ -66,10 +67,11 @@ jobs:
6667

6768
- run: sleep 5 # there's still a race condition for now
6869
- name: Configure AWS Credentials
69-
uses: aws-actions/configure-aws-credentials@v1
70-
with:
71-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
72-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
70+
run: |
71+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
72+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
73+
74+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
7375
- name: Login to ECR
7476
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
7577

‎.github/workflows/release-build.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77

88
env:
99
AWS_DEFAULT_REGION: us-east-1
10+
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1011

1112
permissions:
1213
id-token: write
@@ -24,10 +25,11 @@ jobs:
2425

2526
- run: sleep 5 # there's still a race condition for now
2627
- name: Configure AWS Credentials
27-
uses: aws-actions/configure-aws-credentials@v1
28-
with:
29-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
30-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
28+
run: |
29+
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
30+
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
31+
32+
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
3133
- name: Login to ECR1
3234
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3335

‎.github/workflows/soak-testing.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,8 @@ jobs:
9999
- name: Configure AWS Credentials
100100
uses: aws-actions/configure-aws-credentials@v1
101101
with:
102+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
103+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
102104
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
103105
role-duration-seconds: 21600 # 6 Hours
104106
aws-region: ${{ env.AWS_DEFAULT_REGION }}

0 commit comments

Comments
 (0)