From da25124488ca968dfb1c3c668ac7dc7fb0446aa6 Mon Sep 17 00:00:00 2001 From: Alessio Perugini Date: Thu, 12 Dec 2024 10:42:47 +0100 Subject: [PATCH] github: Use IAM Roles to push files on AWS S3 For security reasons long lived credentials are not considered secure. To overcome this issue we can configure Github Workflows to use AWS OpenID Connect instead: For further details: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect --- .../release-go-crosscompile-task.yml | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-go-crosscompile-task.yml b/.github/workflows/release-go-crosscompile-task.yml index ad684ad..2e45ec4 100644 --- a/.github/workflows/release-go-crosscompile-task.yml +++ b/.github/workflows/release-go-crosscompile-task.yml @@ -11,6 +11,7 @@ env: ARTIFACT_NAME: dist # See: https://github.com/actions/setup-go/tree/main#supported-version-syntax GO_VERSION: "1.17" + AWS_REGION: "us-east-1" on: push: @@ -73,7 +74,11 @@ jobs: create-release: runs-on: ubuntu-latest + environment: production needs: create-release-artifacts + permissions: + contents: write + id-token: write # This is required for requesting the JWT steps: - name: Download artifact @@ -108,12 +113,12 @@ jobs: # (all the files we need are in the DIST_DIR root) artifacts: ${{ env.DIST_DIR }}/* + - name: configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} + role-session-name: "github_${{ env.PROJECT_NAME }}" + aws-region: ${{ env.AWS_REGION }} + - name: Upload release files on Arduino downloads servers - uses: docker://plugins/s3 - env: - PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*" - PLUGIN_TARGET: ${{ env.AWS_PLUGIN_TARGET }} - PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/" - PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }} - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + run: aws s3 sync ${{ env.DIST_DIR }} s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}