Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 2914e73

Browse files
committed
Use IAM Roles to push files on AWS S3.
For security reasons long lived credentials are not considered secure. To overcome this issue we can configure Github Workflows to use AWS OpenID Connect instead: For further details: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect 
1 parent a84441d commit 2914e73

File tree

5 files changed

+49
-29
lines changed

5 files changed

+49
-29
lines changed

‎workflow-templates/publish-go-nightly-task.yml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ env:
88
DIST_DIR: dist
99
# The project's folder on Arduino's download server for uploading builds
1010
AWS_PLUGIN_TARGET: TODO_AWS_PLUGIN_TARGET
11+
AWS_REGION: "us-east-1"
1112
ARTIFACT_NAME: dist
1213

1314
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
@@ -172,8 +173,10 @@ jobs:
172173

173174
publish-nightly:
174175
runs-on: ubuntu-latest
176+
environment: production
175177
needs: notarize-macos
176-
permissions: {}
178+
permissions:
179+
id-token: write # This is required for requesting the JWT
177180

178181
steps:
179182
- name: Download artifact
@@ -188,15 +191,15 @@ jobs:
188191
TAG="nightly-$(date -u +"%Y%m%d")"
189192
sha256sum ${{ env.PROJECT_NAME }}_${TAG}* > ${TAG}-checksums.txt
190193
194+
- name: configure aws credentials
195+
uses: aws-actions/configure-aws-credentials@v4
196+
with:
197+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
198+
role-session-name: "github_${{ env.PROJECT_NAME }}"
199+
aws-region: ${{ env.AWS_REGION }}
200+
191201
- name: Upload release files on Arduino downloads servers
192-
uses: docker://plugins/s3
193-
env:
194-
PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*"
195-
PLUGIN_TARGET: "${{ env.AWS_PLUGIN_TARGET }}nightly"
196-
PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/"
197-
PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
198-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
199-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
202+
run: aws s3 sync ${{ env.DIST_DIR }} s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}nightly
200203

201204
report:
202205
runs-on: ubuntu-latest

‎workflow-templates/release-go-crosscompile-task.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ The following project-specific variables must be set/configured in `release-go-c
3737
- `AWS_PLUGIN_TARGET`
3838
- `GO_VERSION`: version of Go used for development of the project, use at least [GO 1.16 to be able to use 64-bit ARM architecture on macOS](https://tip.golang.org/doc/go1.16#ports)
3939

40+
#### AWS IAM Role
41+
42+
We need a special [IAM Role](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html#access) to upload files on the S3 bucket. This IAM Role is able to generate short lived credentials with push access to specific S3 subpaths. To generate a new role for a new repository kindly ask DevOps (prividing the repository link and path you need files on S3).
43+
4044
#### Repository secrets
4145

4246
The following [repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository) must be defined:
@@ -47,8 +51,9 @@ The following [repository secrets](https://docs.github.com/actions/security-guid
4751
- `AC_PROVIDER` - the App Store Connect provider via. You can use the ID of the certificate identity (e.g., `7KT7ZWMCJT`) for this.
4852
- `AC_PASSWORD` - [App-specific password](https://support.apple.com/en-us/HT204397) created for the Apple ID.
4953
- `DOWNLOADS_BUCKET` - [AWS bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) on the downloads server.
50-
- `AWS_ACCESS_KEY_ID` - [AWS access key ID](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) for the downloads server.
51-
- `AWS_SECRET_ACCESS_KEY` - [AWS secret access key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) for the downloads server.
54+
55+
The following [environment secrets](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets) must be defined under `production` environment:
56+
- `AWS_ROLE_TO_ASSUME` - [AWS role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) to generate temporary security credentials.
5257

5358
### Readme badge
5459

‎workflow-templates/release-go-crosscompile-task.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ env:
88
DIST_DIR: dist
99
# The project's folder on Arduino's download server for uploading builds
1010
AWS_PLUGIN_TARGET: TODO_AWS_PLUGIN_TARGET
11+
AWS_REGION: "us-east-1"
1112
ARTIFACT_NAME: dist
1213
# See: https://github.com/actions/setup-go/tree/main#supported-version-syntax
1314
GO_VERSION: "1.17"
@@ -181,9 +182,11 @@ jobs:
181182

182183
create-release:
183184
runs-on: ubuntu-latest
185+
environment: production
184186
needs: notarize-macos
185187
permissions:
186188
contents: write
189+
id-token: write # This is required for requesting the JWT
187190

188191
steps:
189192
- name: Download artifact
@@ -217,13 +220,14 @@ jobs:
217220
# NOTE: "Artifact is a directory" warnings are expected and don't indicate a problem
218221
# (all the files we need are in the DIST_DIR root)
219222
artifacts: ${{ env.DIST_DIR }}/*
223+
224+
- name: configure aws credentials
225+
uses: aws-actions/configure-aws-credentials@v4
226+
with:
227+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
228+
role-session-name: "github_${{ env.PROJECT_NAME }}"
229+
aws-region: ${{ env.AWS_REGION }}
220230

221231
- name: Upload release files on Arduino downloads servers
222-
uses: docker://plugins/s3
223-
env:
224-
PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*"
225-
PLUGIN_TARGET: ${{ env.AWS_PLUGIN_TARGET }}
226-
PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/"
227-
PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
228-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
229-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
232+
run: aws s3 sync ${{ env.DIST_DIR }} s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}
233+

‎workflow-templates/release-go-task.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ The following project-specific variables must be set in `release-go-task.yml`:
3636
- `PROJECT_NAME`
3737
- `AWS_PLUGIN_TARGET`
3838

39+
#### AWS IAM Role
40+
41+
We need a special [IAM Role](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html#access) to upload files on the S3 bucket. This IAM Role is able to generate short lived credentials with push access to specific S3 subpaths. To generate a new role for a new repository kindly ask DevOps (prividing the repository link and path you need files on S3).
42+
3943
#### Repository secrets
4044

4145
The following [repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository) must be defined:
@@ -46,8 +50,9 @@ The following [repository secrets](https://docs.github.com/actions/security-guid
4650
- `AC_PROVIDER` - the App Store Connect provider via. You can use the ID of the certificate identity (e.g., `7KT7ZWMCJT`) for this.
4751
- `AC_PASSWORD` - [App-specific password](https://support.apple.com/en-us/HT204397) created for the Apple ID.
4852
- `DOWNLOADS_BUCKET` - [AWS bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) on the downloads server.
49-
- `AWS_ACCESS_KEY_ID` - [AWS access key ID](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) for the downloads server.
50-
- `AWS_SECRET_ACCESS_KEY` - [AWS secret access key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) for the downloads server.
53+
54+
The following [environment secrets](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets) must be defined under `production` environment:
55+
- `AWS_ROLE_TO_ASSUME` - [AWS role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) to generate temporary security credentials.
5156

5257
### Readme badge
5358

‎workflow-templates/release-go-task.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ env:
88
DIST_DIR: dist
99
# The project's folder on Arduino's download server for uploading builds
1010
AWS_PLUGIN_TARGET: TODO_AWS_PLUGIN_TARGET
11+
AWS_REGION: "us-east-1"
1112
ARTIFACT_NAME: dist
1213

1314
on:
@@ -177,9 +178,11 @@ jobs:
177178

178179
create-release:
179180
runs-on: ubuntu-latest
181+
environment: production
180182
needs: notarize-macos
181183
permissions:
182184
contents: write
185+
id-token: write # This is required for requesting the JWT
183186

184187
steps:
185188
- name: Download artifact
@@ -222,12 +225,12 @@ jobs:
222225
# (all the files we need are in the DIST_DIR root)
223226
artifacts: ${{ env.DIST_DIR }}/*
224227

228+
- name: configure aws credentials
229+
uses: aws-actions/configure-aws-credentials@v4
230+
with:
231+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
232+
role-session-name: "github_${{ env.PROJECT_NAME }}"
233+
aws-region: ${{ env.AWS_REGION }}
234+
225235
- name: Upload release files on Arduino downloads servers
226-
uses: docker://plugins/s3
227-
env:
228-
PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*"
229-
PLUGIN_TARGET: ${{ env.AWS_PLUGIN_TARGET }}
230-
PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/"
231-
PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
232-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
233-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
236+
run: aws s3 sync ${{ env.DIST_DIR }} s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /