Merge 3edbb04 into a6c6d9c

awslabs · Apr 12, 2023 · c7c7184 · c7c7184
2 parents a6c6d9c + 3edbb04
commit c7c7184
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 17 deletions.
diff --git a/.github/workflows/deploy-integ-appstream-egress.yml b/.github/workflows/deploy-integ-appstream-egress.yml
@@ -40,11 +40,16 @@ jobs:
         run: ./scripts/install.sh
       - name: Build all packages
         run: ./scripts/build-all-packages.sh
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
+          role-session-name: OIDCSessionName
+          role-duration-seconds: 10800
+          aws-region: ${{ secrets.AWS_DEV_REGION }}
       - name: Deploy
         env:
           STAGE_NAME: tre
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID_APPSTREAM_EGRESS}}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY_APPSTREAM_EGRESS }}
           AWS_CERTIFICATE_ARN: ${{ secrets.AWS_CERTIFICATE_ARN_APPSTREAM_EGRESS }}
           AWS_DOMAIN_NAME: ${{ secrets.AWS_DOMAIN_NAME_APPSTREAM_EGRESS }}
           AWS_HOSTED_ZONE_ID: ${{ secrets.AWS_HOSTED_ZONE_ID_APPSTREAM_EGRESS }}
@@ -68,12 +73,17 @@ jobs:
       - name: Install dependencies
         run: pnpm install
         working-directory: main/infrastructure-tests
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
+          role-session-name: OIDCSessionName
+          role-duration-seconds: 10800
+          aws-region: ${{ secrets.AWS_DEV_REGION }}
       - name: Run infrastructure tests
         run: pnpm run testAppStreamEgressEnabled -- --stage=github
         working-directory: ./main/infrastructure-tests
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID_APPSTREAM_EGRESS }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY_APPSTREAM_EGRESS }}
           INFRA_TESTS_HOSTING_ACCOUNT_ID: ${{ secrets.INFRA_TESTS_HOSTING_ACCOUNT_ID }}
           INFRA_TESTS_HOSTING_ACCOUNT_STACK_NAME: ${{ secrets.INFRA_TESTS_HOSTING_ACCOUNT_STACK_NAME }}
   integration-test:
@@ -94,15 +104,20 @@ jobs:
       - name: Install dependencies
         run: pnpm install
         working-directory: main/integration-tests
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
+          role-session-name: OIDCSessionName
+          role-duration-seconds: 10800
+          aws-region: ${{ secrets.AWS_DEV_REGION }}
       - name: Run integration tests
         run: ./scripts/run-integration-tests.sh ${STAGE_NAME} us-east-1 AppStreamEgress
         working-directory: ./
         env:
           DEPLOYMENT_BUCKET: ${{ secrets.DEPLOYMENT_BUCKET_APPSTREAM_EGRESS}}
           STAGE_NAME: tre
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID_APPSTREAM_EGRESS }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY_APPSTREAM_EGRESS }}
-          aws-region: us-east-1
+          aws-region: ${{ secrets.AWS_DEV_REGION }}
   cypress-test:
     name: Cypress test
     runs-on: ubuntu-20.04

diff --git a/.github/workflows/deploy-integ.yml b/.github/workflows/deploy-integ.yml
@@ -40,11 +40,16 @@ jobs:
         run: ./scripts/install.sh
       - name: Build all packages
         run: ./scripts/build-all-packages.sh
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
+          role-session-name: OIDCSessionName
+          role-duration-seconds: 10800
+          aws-region: ${{ secrets.AWS_DEV_REGION }}
       - name: Deploy
         env:
           STAGE_NAME: e2etest
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID}}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_CERTIFICATE_ARN: ${{ secrets.AWS_CERTIFICATE_ARN }}
           AWS_DOMAIN_NAME: ${{ secrets.AWS_DOMAIN_NAME }}
           AWS_HOSTED_ZONE_ID: ${{ secrets.AWS_HOSTED_ZONE_ID }}
@@ -55,8 +60,6 @@ jobs:
       - name: Deploy to standalone RStudio environment
         env:
           STAGE_NAME: dev
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID}}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_CERTIFICATE_ARN_RSTUDIO: ${{ secrets.AWS_CERTIFICATE_ARN_RSTUDIO }}
           AWS_DOMAIN_NAME_RSTUDIO: ${{ secrets.AWS_DOMAIN_NAME_RSTUDIO }}
           AWS_HOSTED_ZONE_ID_RSTUDIO: ${{ secrets.AWS_HOSTED_ZONE_ID_RSTUDIO }}
@@ -82,15 +85,20 @@ jobs:
       - name: Install dependencies
         run: pnpm install
         working-directory: main/integration-tests
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
+          role-session-name: OIDCSessionName
+          role-duration-seconds: 10800
+          aws-region: ${{ secrets.AWS_DEV_REGION }}
       - name: Run integration tests
         run: ./scripts/run-integration-tests.sh ${STAGE_NAME} us-east-1
         working-directory: ./
         env:
           DEPLOYMENT_BUCKET: ${{ secrets.DEPLOYMENT_BUCKET}}
           STAGE_NAME: e2etest
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
+          aws-region: ${{ secrets.AWS_DEV_REGION }}
   cypress-test:
     name: Cypress test
     runs-on: ubuntu-20.04

diff --git a/main/integration-tests/README.md b/main/integration-tests/README.md
@@ -110,7 +110,7 @@ $ pnpm intTestSpecific __test__/api-tests/<your test suite file> -- --stage=<STA
   - set `isLocal` to `false`
 - Upload the config file to the deployment S3 bucket `<namespace>-artifacts` under `integration-test` folder if it's not present
 - Create the following GitHub secrets in your target repository:
-  - AWS_ACCESS_KEY_ID
-  - AWS_SECRET_ACCESS_KEY
+  - AWS_ROLE_TO_ASSUME (the GitHubActionsRoleArn output value in your OIDC provider stack)
+  - AWS_DEV_REGION
   - DEPLOYMENT_BUCKET (set the value to `<namespace>-artifacts`)
-- Integration test will be triggered as part of a GitHub workflow
+- Integration test will be triggered as part of a GitHub workflow