-
-
Notifications
You must be signed in to change notification settings - Fork 12
github: Use IAM Roles to push files on AWS S3 #815
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
For security reasons long lived credentials are not considered secure. To overcome this issue we can configure Github Workflows to use AWS OpenID Connect instead: For further details: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect
9bb0a73 to
19f540a
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@ ## main #815 +/- ## ======================================= Coverage 89.97% 89.97% ======================================= Files 44 44 Lines 6772 6772 ======================================= Hits 6093 6093 Misses 555 555 Partials 124 124
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
This reverts commit fa85b31.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we check if env.DIST_DIR, secrets.DOWNLOADS_BUCKET, and env.AWS_PLUGIN_TARGET are defined?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
They are defined at the top of the workflow. I've also checked that the files are present in our s3 bucket.
https://github.com/arduino/arduino-lint/blob/iam-roles/.github/workflows/release-go-task.yml#L6-L12
The download_bucket is a secret that you can find defined in the settings of this repo.
Uh oh!
There was an error while loading. Please reload this page.
For security reasons long lived credentials are not considered secure.
To overcome this issue we can configure Github Workflows to use AWS OpenID Connect instead:
For further details: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect
Tested:
AWS_ACCESS_KEY,AWS_SECRET_KEY