update workflows to use new github oidc connection

aws-samples · Nov 15, 2024 · 899f777 · 899f777
1 parent 1f96918
commit 899f777
Show file tree

Hide file tree

Showing 23 changed files with 104 additions and 93 deletions.
diff --git a/.github/actions/sam-build-and-deploy-containers/action.yml b/.github/actions/sam-build-and-deploy-containers/action.yml
@@ -36,11 +36,11 @@ runs:
     - uses: aws-actions/setup-sam@v2
       with:
           use-installer: true
-    - uses: aws-actions/configure-aws-credentials@v1
+    - uses: aws-actions/configure-aws-credentials@v2
       with:
-        aws-access-key-id: ${{ inputs.aws-access-key }}
-        aws-secret-access-key: ${{ inputs.aws-secret-key }}
-        aws-region: ${{ inputs.aws-region }}
+        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: ${{ secrets.AWS_REGION }}
 
 # Build and deploy x86
     - run: sam build -t ${{ inputs.template-file-path }} --parameter-overrides LambdaArchitecture=${{ inputs.architecture }} --parallel --cached

diff --git a/.github/actions/sam-build-and-deploy-native-arm/action.yml b/.github/actions/sam-build-and-deploy-native-arm/action.yml
@@ -37,11 +37,11 @@ runs:
     - uses: aws-actions/setup-sam@v2
       with:
           use-installer: false # use-installer Currently supports Linux x86-64 runners. https://github.com/aws-actions/setup-sam?tab=readme-ov-file#inputs
-    - uses: aws-actions/configure-aws-credentials@v1
+    - uses: aws-actions/configure-aws-credentials@v2
       with:
-        aws-access-key-id: ${{ inputs.aws-access-key }}
-        aws-secret-access-key: ${{ inputs.aws-secret-key }}
-        aws-region: ${{ inputs.aws-region }}
+        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: ${{ secrets.AWS_REGION }}
 
 # Build and deploy ARM
     # Because native apps are built in a container, and SAM CLI doesn't know how to mount extra things outside the project directory to the container, move this file manually

diff --git a/.github/actions/sam-build-and-deploy-native/action.yml b/.github/actions/sam-build-and-deploy-native/action.yml
@@ -36,11 +36,11 @@ runs:
     - uses: aws-actions/setup-sam@v2
       with:
           use-installer: true
-    - uses: aws-actions/configure-aws-credentials@v1
+    - uses: aws-actions/configure-aws-credentials@v2
       with:
-        aws-access-key-id: ${{ inputs.aws-access-key }}
-        aws-secret-access-key: ${{ inputs.aws-secret-key }}
-        aws-region: ${{ inputs.aws-region }}
+        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: ${{ secrets.AWS_REGION }}
 
 # Build and deploy x86
     # Because native apps are built in a container, and SAM CLI doesn't know how to mount extra things outside the project directory to the container, move this file manually

diff --git a/.github/actions/sam-build-and-deploy/action.yml b/.github/actions/sam-build-and-deploy/action.yml
@@ -33,11 +33,11 @@ runs:
     - uses: aws-actions/setup-sam@v2
       with:
           use-installer: true
-    - uses: aws-actions/configure-aws-credentials@v1
+    - uses: aws-actions/configure-aws-credentials@v2
       with:
-        aws-access-key-id: ${{ inputs.aws-access-key }}
-        aws-secret-access-key: ${{ inputs.aws-secret-key }}
-        aws-region: ${{ inputs.aws-region }}
+        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: ${{ secrets.AWS_REGION }}
 
 # Build and deploy ARM
     - run: sam build -t ${{ inputs.template-file-path }} --parameter-overrides LambdaArchitecture=arm64

diff --git a/.github/workflows/metrics-lambda-pipeline.yaml b/.github/workflows/metrics-lambda-pipeline.yaml
@@ -1,5 +1,9 @@
 name: Metrics Lambda
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -15,10 +19,7 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:            
             dotnet-version: '8.x'
             template-file-path: ./metrics/template.yaml
             stack-name: metrics-lambda

diff --git a/.github/workflows/net-31-otel-pipelinE.yaml b/.github/workflows/net-31-otel-pipelinE.yaml
@@ -1,5 +1,9 @@
 name: NET 31 OTEL
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -16,9 +20,6 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
           with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '3.1.x'
             template-file-path: ./src/NET31-OTel/template.yaml
             stack-name: net-31-otel

diff --git a/.github/workflows/net-31-pipeline.yaml b/.github/workflows/net-31-pipeline.yaml
@@ -1,5 +1,9 @@
 name: NET 31
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -16,9 +20,6 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
           with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '3.1.x'
             template-file-path: ./src/NET31/template.yaml
             stack-name: net-31-base

diff --git a/.github/workflows/net-6-containers-pipeline.yaml b/.github/workflows/net-6-containers-pipeline.yaml
@@ -1,5 +1,9 @@
 name: NET 6 Containers
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -16,10 +20,7 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-containers
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:           
             dotnet-version: '6.x'
             template-file-path: ./src/NET6Containers/template.yaml
             stack-name: net-6-containers-x86-64

diff --git a/.github/workflows/net-6-custumRuntime-pipeline-canary.yaml b/.github/workflows/net-6-custumRuntime-pipeline-canary.yaml
@@ -1,5 +1,9 @@
 name: NET 6 Custom Runtime Canary
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   schedule:
@@ -14,10 +18,7 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:            
             dotnet-version: '6.x'
             template-file-path: ./src/NET6CustomRuntime/template.yaml
             project-directory: ./src/NET6CustomRuntime/

diff --git a/.github/workflows/net-6-minimal-api.yaml b/.github/workflows/net-6-minimal-api.yaml
@@ -1,5 +1,9 @@
 name: NET 6 Mimimal
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -15,10 +19,7 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:            
             dotnet-version: '6.x'
             template-file-path: ./src/MinimalAPI/template.yaml
             stack-name: net-6-minimal

diff --git a/.github/workflows/net-6-pipeline-canary.yaml b/.github/workflows/net-6-pipeline-canary.yaml
@@ -1,5 +1,9 @@
 name: NET 6 Canary
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   schedule:
@@ -14,10 +18,7 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:           
             dotnet-version: '6.x'
             template-file-path: ./src/NET6/template.yaml
             stack-name: net-6-base

diff --git a/.github/workflows/net-6-pipeline.yaml b/.github/workflows/net-6-pipeline.yaml
@@ -1,5 +1,9 @@
 name: NET 6
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -21,10 +25,7 @@ jobs:
           uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:            
             dotnet-version: '6.x'
             template-file-path: ./src/NET6/template.yaml
             stack-name: net-6-base
@@ -37,7 +38,7 @@ jobs:
         - name: configure aws credentials
           uses: aws-actions/configure-aws-credentials@v2
           with:
-            role-to-assume: ${{ secrets.AWS_ROLE }}
+            role-to-assume: ${{ secrets.AWS_LOAD_TEST_RUNNER_ROLE }}
             role-session-name: GitHub_to_AWS_via_FederatedOIDC
             aws-region: ${{ secrets.AWS_REGION }}
         - name: checkoutRepo
@@ -54,7 +55,7 @@ jobs:
         - name: configure aws credentials
           uses: aws-actions/configure-aws-credentials@v2
           with:
-            role-to-assume: ${{ secrets.AWS_ROLE }}
+            role-to-assume: ${{ secrets.AWS_LOAD_TEST_RUNNER_ROLE }}
             role-session-name: GitHub_to_AWS_via_FederatedOIDC
             aws-region: ${{ secrets.AWS_REGION }}
         - name: checkoutRepo
@@ -71,7 +72,7 @@ jobs:
         - name: configure aws credentials
           uses: aws-actions/configure-aws-credentials@v2
           with:
-            role-to-assume: ${{ secrets.AWS_ROLE }}
+            role-to-assume: ${{ secrets.AWS_LOAD_TEST_RUNNER_ROLE }}
             role-session-name: GitHub_to_AWS_via_FederatedOIDC
             aws-region: ${{ secrets.AWS_REGION }}
         - name: checkoutRepo
@@ -89,7 +90,7 @@ jobs:
         - name: configure aws credentials
           uses: aws-actions/configure-aws-credentials@v2
           with:
-            role-to-assume: ${{ secrets.AWS_ROLE }}
+            role-to-assume: ${{ secrets.AWS_LOAD_TEST_RUNNER_ROLE }}
             role-session-name: GitHub_to_AWS_via_FederatedOIDC
             aws-region: ${{ secrets.AWS_REGION }}
         - name: checkoutRepo

diff --git a/.github/workflows/net-6-top-level-statements.yaml b/.github/workflows/net-6-top-level-statements.yaml
@@ -15,10 +15,7 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:            
             dotnet-version: '6.x'
             template-file-path: ./src/NET6TopLevelStatements/template.yaml
             stack-name: net-6-top-level

diff --git a/.github/workflows/net-6-with-power-tools.yaml b/.github/workflows/net-6-with-power-tools.yaml
@@ -1,5 +1,9 @@
 name: NET 6 with PowerTools
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -15,10 +19,7 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
+          with:            
             dotnet-version: '6.x'
             template-file-path: ./src/NET6WithPowerTools/template.yaml
             stack-name: net-6-power-tools

diff --git a/.github/workflows/net-7-native-aot-canary.yaml b/.github/workflows/net-7-native-aot-canary.yaml
@@ -1,5 +1,9 @@
 name: NET 7 NativeAOT Canary
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   schedule:
@@ -15,9 +19,6 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7Native/template.yaml
             project-directory: ./src/NET7Native/

diff --git a/.github/workflows/net-7-native-aot-pipeline.yaml b/.github/workflows/net-7-native-aot-pipeline.yaml
@@ -1,5 +1,9 @@
 name: NET 7 NativeAOT
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -16,9 +20,6 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7Native/template.yaml
             project-directory: ./src/NET7Native/

diff --git a/.github/workflows/net-7-pipeline-canary.yaml b/.github/workflows/net-7-pipeline-canary.yaml
@@ -1,5 +1,9 @@
 name: NET 7 Canary
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   schedule:
@@ -15,9 +19,6 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7/template.yaml
             project-directory: ./src/NET7/

diff --git a/.github/workflows/net-7-pipeline.yaml b/.github/workflows/net-7-pipeline.yaml
@@ -1,5 +1,9 @@
 name: NET 7
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -16,9 +20,6 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7/template.yaml
             project-directory: ./src/NET7/