Only Use Assume Role Creds

.github/workflows/clean_ami.yml

@@ -11,6 +11,9 @@ on:
 jobs:
   clean-ami:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v3

.github/workflows/clean_dedicated_host.yml

@@ -11,6 +11,9 @@ on:
 jobs:
   clean-dedicated-hosts:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v3

.github/workflows/integrationTest.yml

@@ -224,7 +224,9 @@ jobs:
         if: steps.cached_win_zip.outputs.cache-hit != 'true'
         run: |
           sudo apt install zip
-          zip -r buildMSI.zip msi_dep
+          mkdir buildMSI
+          cp -r msi_dep buildMSI
+          zip -r buildMSI.zip buildMSI
 
       - name: Upload zip
         if: steps.cached_win_zip.outputs.cache-hit != 'true'

.github/workflows/internal-pipeline-dedicated-host-cleaner.yml

@@ -12,15 +12,17 @@ on:
 jobs:
   clean-dedicated-hosts:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v3
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.INTERNAL_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.INTERNAL_AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.INTERNAL_AWS_ASSUME_ROLE }}
           aws-region: us-west-2
 
       - name: Clean old dedicated host

.github/workflows/nightly-build.yml

@@ -10,6 +10,9 @@ jobs:
   build:
     name: Upload Nightly Binaries
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
 
       - name: Set up Go 1.x
@@ -18,6 +21,12 @@ jobs:
           go-version: ~1.18.3
         id: go
 
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          role-to-assume: ${{ secrets.S3_AWS_ASSUME_ROLE }}
+          aws-region: us-east-1
+
       #Need to install rpm so ubuntu can make rpm by default ubuntu can make deb
       - name: Install rpm
         run: sudo apt install rpm
@@ -31,14 +40,5 @@ jobs:
       - name: Release
         run: make nightly-release
 
-      - name: Upload binaries to latest
-        uses: jakejarvis/s3-sync-action@master
-        with:
-          args: --acl public-read
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY}}
-          AWS_REGION: 'us-east-1'
-          AWS_S3_BUCKET: 'amazoncloudwatch-agent'
-          SOURCE_DIR: 'build/bin'
-          DEST_DIR: 'nightly-build/latest'
+      - name: Upload to S3
+        run: aws s3 cp build/bin s3://amazoncloudwatch-agent/nightly-build/latest/ --recursive --acl public-read --source-region us-east-1

.github/workflows/releaseTest.yml

@@ -28,6 +28,9 @@ jobs:
   UpdatePerformanceMetrics:
     name: "UpdatePerformanceMetrics"
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v2
 

integration/terraform/ec2/README.md

@@ -10,13 +10,65 @@ Running integration tests
 This all assumes that you are creating resources in the `us-west-2` region, as that is currently the only region that
 supports the integration test AMIs.
 
-#### Terraform IAM user permissions
+#### Terraform IAM assume role permission
 
 For ease of use, here's a generated IAM policy based on resource usage that you can attach to your IAM user that
 Terraform will assume, with the required permissions. See docs
 on [Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html)
 for how to easily generate a new policy.
 
+#### Creating assume role
+[reference of how to create role](https://github.com/aws-actions/configure-aws-credentials)
+
+Cloud formation template. You only need to enter org and repo (ex aws amazon-cloudwatch-agent)
+```
+Parameters:
+  GitHubOrg:
+    Type: String
+  RepositoryName:
+    Type: String
+  OIDCProviderArn:
+    Description: Arn for the GitHub OIDC Provider.
+    Default: ""
+    Type: String
+
+Conditions:
+  CreateOIDCProvider: !Equals 
+    - !Ref OIDCProviderArn
+    - ""
+
+Resources:
+  Role:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Statement:
+          - Effect: Allow
+            Action: sts:AssumeRoleWithWebIdentity
+            Principal:
+              Federated: !If 
+                - CreateOIDCProvider
+                - !Ref GithubOidc
+                - !Ref OIDCProviderArn
+            Condition:
+              StringLike:
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/${RepositoryName}:*
+
+  GithubOidc:
+    Type: AWS::IAM::OIDCProvider
+    Condition: CreateOIDCProvider
+    Properties:
+      Url: https://token.actions.githubusercontent.com
+      ClientIdList: 
+        - sts.amazonaws.com
+      ThumbprintList:
+        - 6938fd4d98bab03faadb97b34396831e3780aea1
+
+Outputs:
+  Role:
+    Value: !GetAtt Role.Arn 
+```
+
 ```json
 {
   "Version": "2012-10-17",