Discussion on "Securely Access Your AWS Resources From Github Actions"

Benoît Bouré · 2021-12-27T15:13:06.084Z

Security is a very important topic for all cloud engineers. Making sure that your infrastructure and data are kept out of reach of malicious people is one of the most serious things to get right. In AWS, we are used to dealing with IAM roles and perm...

It would be nice if you could give a full example main.yml file for deploying via github actions. I spent about half an hour trying to properly indent and organize the various permissions. This is partly because I am dumb, but I bet other dumb people will read this too and also be confused.

Thank you for your feedback. I'll try to update the articles and include a full example.

I don't have much experience with CI/CD tools. I work as a software developer and fortunately I haven't had to take care about this devops stuff. I wasn't aware about this OIDC flow and we stored everything in sectet storage. Today I'm running my startup project and I have chosen Github Actions altogether with AWS S3 to host my static web app. This instruction took a few minutes and went without problems. Thank you for explaining this topic in human-readable format. Good job!

Thanks for this article. So is it truly just the ARN of the Role and the repo name(s) on that Role in AWS that control the security/access b/w the Git Repo and Git Actions ability to generate operations in AWS as that role? I feel like I'm missing some other key or secret. The thumbprint seems like it has to be that specific value due to the 2022 certificate chain issue so thats not unique or a secret. Thanks!

Yes. From your AWS account (the "safe" side), you allow GithubActions jobs to assume the given role. For that, you add an identity provider (Github Actions is the id provider) and you allow GA "users" to assume a role.

When a job runs, it uses the ID provider to "authenticate", and assume the role.

It works like "login with Twitter", except it's with Github Actions. The job already has a GA token. It uses it to "log into AWS" and assume the role.

The key part is really token.actions.githubusercontent.com:sub. Without that, ANY repo on GitHub would be able to authenticate and assume the role.**

This is awesome! Thanks for the guide!

This is awesome! Thanks! I'm going to now look if there's an open-source terraform module that sets up the IdP, and if not I might have to write one..

If Github action workflow had an entry like aws_session_token it would meet my expectations of how to set up a Github action to deploy to our production environment. I like to open a window, using STS, to allow deployment to prod. I want it to be short term so I like to enter temporary credentials in Github settings to open a window for deployment. Using an assumed role is secure but it is an open window which does not suit our current situation.

Great post, Ben. Thanks! 🙏🏼 I think this is very relevant for a lot of people (including myself).

... and I also learned about quick-create links in CloudFormation.

Discussion

Securely Access Your AWS Resources From Github Actions

Responses(7)

Recent in Forum

Search Hashnode

Securely Access Your AWS Resources From Github Actions

Responses(7)

Recent in Forum