Skip to content

Commit eb19e7f

Browse files
JackPGreenJackPGreen
authored
Replace explicit AWS token with tokenless-OIDC authentication [DI-706] (#1393)
See: - https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws - [ADR](https://hazelcast.atlassian.net/wiki/spaces/EN/pages/6645022721/ADR-00089-+Type+2+-Migrate+GitHub+Actions+to+use+tokenless+OIDC+authentication) - [reference `hazelcast-docker` implementation](hazelcast/hazelcast-docker#1197) Note - the PR builder fails because it's mixing the code from my branch with `master` due to `pull_request_target`, hence: > Warning: Unexpected input(s) 'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', valid inputs are ['GH_TOKEN', 'BOOST_VERSION', 'THRIFT_VERSION', 'RUN_TESTS', 'HAZELCAST_ENTERPRISE_KEY', 'AWS_ROLE_TO_ASSUME', 'HZ_TEST_AWS_INSTANCE_PRIVATE_IP'] Fixes: [DI-706](https://hazelcast.atlassian.net/browse/DI-706) [DI-706]: https://hazelcast.atlassian.net/browse/DI-706?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
1 parent 9fde6ad commit eb19e7f

File tree

10 files changed

+34
-41
lines changed

10 files changed

+34
-41
lines changed

‎.github/actions/build-test/macos-x86_64/action.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,7 @@ inputs:
1515
required: true
1616
HAZELCAST_ENTERPRISE_KEY:
1717
required: true
18-
AWS_ACCESS_KEY_ID:
19-
required: true
20-
AWS_SECRET_ACCESS_KEY:
18+
AWS_ROLE_TO_ASSUME:
2119
required: true
2220
HZ_TEST_AWS_INSTANCE_PRIVATE_IP:
2321
required: true
@@ -51,6 +49,5 @@ runs:
5149
OPENSSL_TOGGLE: ${{ inputs.OPENSSL_TOGGLE }}
5250
RUN_TESTS: ${{ inputs.RUN_TESTS }}
5351
HAZELCAST_ENTERPRISE_KEY: ${{ inputs.HAZELCAST_ENTERPRISE_KEY }}
54-
AWS_ACCESS_KEY_ID: ${{ inputs.AWS_ACCESS_KEY_ID }}
55-
AWS_SECRET_ACCESS_KEY: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
52+
AWS_ROLE_TO_ASSUME: ${{ inputs.AWS_ROLE_TO_ASSUME }}
5653
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ inputs.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}

‎.github/actions/build-test/ubuntu-x86_64/action.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,7 @@ inputs:
1717
required: true
1818
HAZELCAST_ENTERPRISE_KEY:
1919
required: true
20-
AWS_ACCESS_KEY_ID:
21-
required: true
22-
AWS_SECRET_ACCESS_KEY:
20+
AWS_ROLE_TO_ASSUME:
2321
required: true
2422
HZ_TEST_AWS_INSTANCE_PRIVATE_IP:
2523
required: true
@@ -72,6 +70,5 @@ runs:
7270
OPENSSL_TOGGLE: ${{ inputs.OPENSSL_TOGGLE }}
7371
RUN_TESTS: ${{ inputs.RUN_TESTS }}
7472
HAZELCAST_ENTERPRISE_KEY: ${{ inputs.HAZELCAST_ENTERPRISE_KEY }}
75-
AWS_ACCESS_KEY_ID: ${{ inputs.AWS_ACCESS_KEY_ID }}
76-
AWS_SECRET_ACCESS_KEY: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
73+
AWS_ROLE_TO_ASSUME: ${{ inputs.AWS_ROLE_TO_ASSUME }}
7774
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ inputs.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}

‎.github/actions/build-test/unix/action.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,7 @@ inputs:
1717
required: true
1818
HAZELCAST_ENTERPRISE_KEY:
1919
required: true
20-
AWS_ACCESS_KEY_ID:
21-
required: true
22-
AWS_SECRET_ACCESS_KEY:
20+
AWS_ROLE_TO_ASSUME:
2321
required: true
2422
HZ_TEST_AWS_INSTANCE_PRIVATE_IP:
2523
required: true
@@ -53,8 +51,7 @@ runs:
5351
env:
5452
BUILD_DIR: build
5553
HAZELCAST_ENTERPRISE_KEY: ${{ inputs.HAZELCAST_ENTERPRISE_KEY }}
56-
AWS_ACCESS_KEY_ID: ${{ inputs.AWS_ACCESS_KEY_ID }}
57-
AWS_SECRET_ACCESS_KEY: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
54+
AWS_ROLE_TO_ASSUME: ${{ inputs.AWS_ROLE_TO_ASSUME }}
5855
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ inputs.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
5956
BUILD_TYPE: ${{ inputs.BUILD_TYPE }}
6057
shell: bash

‎.github/actions/build-test/windows/action.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,7 @@ inputs:
3535
required: true
3636
HAZELCAST_ENTERPRISE_KEY:
3737
required: true
38-
AWS_ACCESS_KEY_ID:
39-
required: true
40-
AWS_SECRET_ACCESS_KEY:
38+
AWS_ROLE_TO_ASSUME:
4139
required: true
4240
HZ_TEST_AWS_INSTANCE_PRIVATE_IP:
4341
required: true
@@ -155,8 +153,7 @@ runs:
155153
BUILD_DIR: build
156154
BUILD_CONFIGURATION: ${{ inputs.BUILD_TYPE }}
157155
HAZELCAST_ENTERPRISE_KEY: ${{ inputs.HAZELCAST_ENTERPRISE_KEY }}
158-
AWS_ACCESS_KEY_ID: ${{ inputs.AWS_ACCESS_KEY_ID }}
159-
AWS_SECRET_ACCESS_KEY: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
156+
AWS_ROLE_TO_ASSUME: ${{ inputs.AWS_ROLE_TO_ASSUME }}
160157
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ inputs.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
161158
SSL_CERT_FILE: 'C:\cacert.pem'
162159
shell: pwsh

‎.github/actions/coverage-report/action.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,7 @@ inputs:
1111
required: true
1212
HAZELCAST_ENTERPRISE_KEY:
1313
required: true
14-
AWS_ACCESS_KEY_ID:
15-
required: true
16-
AWS_SECRET_ACCESS_KEY:
14+
AWS_ROLE_TO_ASSUME:
1715
required: true
1816
HZ_TEST_AWS_INSTANCE_PRIVATE_IP:
1917
required: true
@@ -76,8 +74,7 @@ runs:
7674
env:
7775
BUILD_DIR: build
7876
HAZELCAST_ENTERPRISE_KEY: ${{ inputs.HAZELCAST_ENTERPRISE_KEY }}
79-
AWS_ACCESS_KEY_ID: ${{ inputs.AWS_ACCESS_KEY_ID }}
80-
AWS_SECRET_ACCESS_KEY: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
77+
AWS_ROLE_TO_ASSUME: ${{ inputs.AWS_ROLE_TO_ASSUME }}
8178
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ inputs.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
8279
BUILD_TYPE: ${{ env.BUILD_TYPE }}
8380
shell: bash

‎.github/workflows/build-pr.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,8 @@ jobs:
9999
# run for code-coverage and upload the result as an artifact.
100100
code-coverage:
101101
runs-on: ubuntu-latest
102+
permissions:
103+
id-token: write
102104
needs: get-refs
103105

104106
name: Code Coverage
@@ -116,8 +118,7 @@ jobs:
116118
THRIFT_VERSION: ${{ env.THRIFT_VERSION }}
117119
RUN_TESTS: ${{ env.RUN_TESTS }}
118120
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
119-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
120-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
121+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
121122
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
122123

123124
shared-matrix:
@@ -135,6 +136,8 @@ jobs:
135136
with_openssl: ${{ fromJSON(needs.shared-matrix.outputs.openssl) }}
136137

137138
runs-on: ubuntu-latest
139+
permissions:
140+
id-token: write
138141

139142
name: ubuntu-x64-(${{ matrix.build_type }}, ${{ matrix.shared_libs.name }}, ${{ matrix.with_openssl.name }})
140143
steps:
@@ -154,8 +157,7 @@ jobs:
154157
OPENSSL_TOGGLE: ${{ matrix.with_openssl.toggle }}
155158
RUN_TESTS: ${{ env.RUN_TESTS }}
156159
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
157-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
158-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
160+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
159161
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
160162

161163
Windows:
@@ -171,6 +173,8 @@ jobs:
171173
with_openssl: ${{ fromJSON(needs.shared-matrix.outputs.openssl) }}
172174

173175
runs-on: 'windows-latest'
176+
permissions:
177+
id-token: write
174178
name: windows-${{ matrix.options.address_model }}-(${{ matrix.build_type }}, ${{ matrix.shared_libs.name }}, ${{ matrix.with_openssl.name }})
175179
steps:
176180
- uses: actions/checkout@v5
@@ -197,8 +201,7 @@ jobs:
197201
INSTALL_THRIFT: true
198202
RUN_TESTS: ${{ env.RUN_TESTS }}
199203
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
200-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
201-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
204+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
202205
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
203206

204207
macOS-x86_64:
@@ -213,6 +216,8 @@ jobs:
213216
with_openssl: ${{ fromJSON(needs.shared-matrix.outputs.openssl) }}
214217

215218
runs-on: macos-latest
219+
permissions:
220+
id-token: write
216221

217222
name: macOS-(${{ matrix.build_type }}, ${{ matrix.shared_libs.name }}, ${{ matrix.with_openssl.name }})
218223
env:
@@ -233,8 +238,7 @@ jobs:
233238
OPENSSL_TOGGLE: ${{ matrix.with_openssl.toggle }}
234239
RUN_TESTS: ${{ env.RUN_TESTS }}
235240
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
236-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
237-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
241+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
238242
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
239243

240244
enforce-code-formatting:

‎.github/workflows/coverage-report.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
jobs:
99
coverage:
1010
runs-on: ubuntu-latest
11+
permissions:
12+
id-token: write
1113

1214
name: Create and upload coverage
1315
steps:
@@ -21,8 +23,7 @@ jobs:
2123
THRIFT_VERSION: 0.13.0
2224
RUN_TESTS: true
2325
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
24-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
25-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
26+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
2627
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
2728

2829
- name: Publish on Codecov

‎.github/workflows/nightly-macos-x86_64.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ jobs:
2727
with_openssl: ${{ fromJSON(needs.shared-matrix.outputs.openssl) }}
2828

2929
runs-on: macos-latest
30+
permissions:
31+
id-token: write
3032

3133
name: >-
3234
macOS-x86_64
@@ -47,8 +49,7 @@ jobs:
4749
OPENSSL_TOGGLE: ${{ matrix.with_openssl.toggle }}
4850
RUN_TESTS: ${{ inputs.RUN_TESTS || github.event_name == 'schedule' }}
4951
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
50-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
51-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
52+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
5253
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
5354

5455
- name: Verify Installation

‎.github/workflows/nightly-ubuntu-x86_64.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ jobs:
4040
name: SSL
4141

4242
runs-on: ubuntu-latest
43+
permissions:
44+
id-token: write
4345

4446
name: >-
4547
Ubuntu-x86_64
@@ -58,8 +60,7 @@ jobs:
5860
OPENSSL_TOGGLE: ${{ matrix.with_openssl.toggle }}
5961
RUN_TESTS: ${{ inputs.RUN_TESTS || github.event_name == 'schedule' }}
6062
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
61-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
62-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
63+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
6364
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
6465

6566
- name: Verify Installation

‎.github/workflows/nightly-windows.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ jobs:
3838
with_openssl: ${{ fromJSON(needs.shared-matrix.outputs.openssl) }}
3939

4040
runs-on: ${{ matrix.vc_boost.image }}
41+
permissions:
42+
id-token: write
4143
env:
4244
JOB_NAME: Windows_(${{ matrix.vc_boost.name }},${{ matrix.options.address_model }},${{ matrix.build_type }},${{ matrix.shared_libs.name }}, ${{ matrix.with_openssl.name }})
4345
name: >-
@@ -84,8 +86,7 @@ jobs:
8486
INSTALL_THRIFT: ${{ steps.cache-thrift.outputs.cache-hit != 'true' }}
8587
RUN_TESTS: ${{ inputs.RUN_TESTS || github.event_name == 'schedule' }}
8688
HAZELCAST_ENTERPRISE_KEY: ${{ secrets.HAZELCAST_ENTERPRISE_KEY }}
87-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
88-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
89+
AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
8990
HZ_TEST_AWS_INSTANCE_PRIVATE_IP: ${{ secrets.HZ_TEST_AWS_INSTANCE_PRIVATE_IP }}
9091

9192
- name: Verify Installation

0 commit comments

Comments
 (0)