From 9f52880b107849822493ca730db327ba3bfa5754 Mon Sep 17 00:00:00 2001 From: Alex English Date: Sat, 5 Sep 2026 20:19:47 -0700 Subject: [PATCH] Authenticate the Terraform workflows with OIDC --- .github/workflows/terraform-apply.yaml | 7 ++++--- .github/workflows/terraform-plan.yaml | 7 ++++--- terraform/aws-gha-oidc-providers.tf | 15 +++++++++++++++ 3 files changed, 23 insertions(+), 6 deletions(-) diff --git a/.github/workflows/terraform-apply.yaml b/.github/workflows/terraform-apply.yaml index 2ae4288..5ff1e1f 100644 --- a/.github/workflows/terraform-apply.yaml +++ b/.github/workflows/terraform-apply.yaml @@ -15,6 +15,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} permissions: + id-token: write contents: read pull-requests: write @@ -24,9 +25,9 @@ jobs: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-region: us-west-2 + role-to-assume: arn:aws:iam::035866691871:role/devops-security-tf-apply + role-session-name: devopssecuritytfapply + aws-region: us-west-2 - name: Terraform Apply uses: dflook/terraform-apply@v1 diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index 46fd5d8..6217ed2 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -15,6 +15,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} permissions: + id-token: write contents: read pull-requests: write @@ -24,9 +25,9 @@ jobs: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-region: us-west-2 + role-to-assume: arn:aws:iam::035866691871:role/devops-security-tf-plan + role-session-name: devopssecuritytfplan + aws-region: us-west-2 - name: Terraform Plan uses: dflook/terraform-plan@v1 diff --git a/terraform/aws-gha-oidc-providers.tf b/terraform/aws-gha-oidc-providers.tf index ab561de..6275d59 100644 --- a/terraform/aws-gha-oidc-providers.tf +++ b/terraform/aws-gha-oidc-providers.tf @@ -1,3 +1,18 @@ +// This file declares the OIDC roles used by hackforla/incubator CI. The two +// roles used by THIS repo's CI -- devops-security-tf-plan and +// devops-security-tf-apply -- are deliberately NOT here. They were created by +// hand in account 035866691871 on 2026-09-05 and are tagged managed-by=exempt, +// which is what keeps them out of the AWS/Terraform coverage report rather than +// showing up as unmanaged. +// +// The reason is a bootstrap problem, not an oversight. The workflow that would +// run the Terraform creating these roles is the same workflow that has to assume +// them to authenticate, so they cannot exist before the first run that needs +// them. Declaring them here would reintroduce that circularity. See +// hackforla/devops-security#182. +// +// Do not "fix" their absence by adding them below. + module "iam_oidc_gha_incubator" { source = "./modules/aws-gha-oidc-providers"