Skip to content

Commit a9fdaa3

Browse files
texastonytexastony
authored
chore: allow ToolsDevelopment to Assume CI Role (#179)
1 parent 60c377b commit a9fdaa3

File tree

2 files changed

+112
-105
lines changed

2 files changed

+112
-105
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,9 @@ Integration tests are included. To test them, certain environment variables need
1313
* `AWS_REGION` - The region the AWS resources (KMS key, S3 bucket) resides e.g. "us-east-1"
1414

1515
To create these resources, refer to the included CloudFormation template (cfn/S3EC-GitHub-CF-Template).
16+
The IAM Role `S3ECGithubTestRole` SHOULD BE manually customized by you.
1617
Make sure that the repo in the trust policy of the IAM role refers to your fork instead of the `aws` organization.
18+
Also, remove the `ToolsDevelopment` clause of the `S3ECGithubTestRole`'s `AssumeRolePolicyDocument`.
1719
**NOTE**: Your account may incur charges based on the usage of any resources beyond the AWS Free Tier.
1820

1921
If you have forked this repo, there are additional steps required.

‎cfn/S3EC-GitHub-CF-Template renamed to ‎cfn/S3EC-GitHub-CF-Template.yml

Lines changed: 110 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -1,105 +1,110 @@
1-
AWSTemplateFormatVersion: 2010-09-09
2-
Resources:
3-
S3ECGitHubKMSKeyID:
4-
Type: 'AWS::KMS::Key'
5-
Properties:
6-
Description: KMS Key for GitHub Action Workflow
7-
Enabled: true
8-
KeyPolicy:
9-
Version: 2012-10-17
10-
Statement:
11-
- Effect: Allow
12-
Principal:
13-
AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
14-
Action: 'kms:*'
15-
Resource: '*'
16-
17-
S3ECGitHubKMSKeyAlias:
18-
Type: 'AWS::KMS::Alias'
19-
Properties:
20-
AliasName: alias/S3EC-Github-KMS-Key
21-
TargetKeyId: !Ref S3ECGitHubKMSKeyID
22-
23-
S3ECGitHubTestS3Bucket:
24-
Type: 'AWS::S3::Bucket'
25-
Properties:
26-
BucketName: s3ec-github-test-bucket
27-
LifecycleConfiguration:
28-
Rules:
29-
- Id: Expire in 14 days
30-
Status: Enabled
31-
ExpirationInDays: 14
32-
PublicAccessBlockConfiguration:
33-
BlockPublicAcls: false
34-
BlockPublicPolicy: false
35-
IgnorePublicAcls: false
36-
RestrictPublicBuckets: false
37-
38-
S3ECGitHubS3BucketPolicy:
39-
Type: 'AWS::IAM::ManagedPolicy'
40-
Properties:
41-
ManagedPolicyName: S3EC-GitHub-S3-Bucket-Policy
42-
PolicyDocument:
43-
Version: 2012-10-17
44-
Statement:
45-
- Effect: Allow
46-
Action:
47-
- 's3:PutObject'
48-
- 's3:GetObject'
49-
- 's3:DeleteObject'
50-
Resource:
51-
- !Join [ "", [ !GetAtt S3ECGitHubTestS3Bucket.Arn, '/*'] ]
52-
53-
S3ECGitHubKMSKeyPolicy:
54-
Type: 'AWS::IAM::ManagedPolicy'
55-
Properties:
56-
PolicyDocument: !Sub |
57-
{
58-
"Version": "2012-10-17",
59-
"Statement": [
60-
{
61-
"Effect": "Allow",
62-
"Resource": [
63-
"arn:aws:kms:*:${AWS::AccountId}:key/${S3ECGitHubKMSKeyID}",
64-
"arn:aws:kms:*:${AWS::AccountId}:${S3ECGitHubKMSKeyAlias}"
65-
],
66-
"Action": [
67-
"kms:Decrypt",
68-
"kms:GenerateDataKey",
69-
"kms:GenerateDataKeyPair"
70-
]
71-
}
72-
]
73-
}
74-
ManagedPolicyName: S3EC-GitHub-KMS-Key-Policy
75-
76-
S3ECGithubTestRole:
77-
Type: 'AWS::IAM::Role'
78-
Properties:
79-
Path: /service-role/
80-
RoleName: S3EC-GitHub-test-role
81-
AssumeRolePolicyDocument: !Sub |
82-
{
83-
"Version": "2012-10-17",
84-
"Statement": [
85-
{
86-
"Effect": "Allow",
87-
"Principal": { "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com" },
88-
"Action": "sts:AssumeRoleWithWebIdentity",
89-
"Condition": {
90-
"StringEquals": {
91-
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
92-
},
93-
"StringLike": {
94-
"token.actions.githubusercontent.com:sub": "repo:aws/amazon-s3-encryption-client-java:*"
95-
}
96-
}
97-
}
98-
]
99-
}
100-
Description: >-
101-
Grant GitHub S3 put and get and KMS encrypt, decrypt, and generate access
102-
for testing
103-
ManagedPolicyArns:
104-
- !Ref S3ECGitHubKMSKeyPolicy
105-
- !Ref S3ECGitHubS3BucketPolicy
1+
AWSTemplateFormatVersion: 2010-09-09
2+
Resources:
3+
S3ECGitHubKMSKeyID:
4+
Type: 'AWS::KMS::Key'
5+
Properties:
6+
Description: KMS Key for GitHub Action Workflow
7+
Enabled: true
8+
KeyPolicy:
9+
Version: 2012-10-17
10+
Statement:
11+
- Effect: Allow
12+
Principal:
13+
AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
14+
Action: 'kms:*'
15+
Resource: '*'
16+
17+
S3ECGitHubKMSKeyAlias:
18+
Type: 'AWS::KMS::Alias'
19+
Properties:
20+
AliasName: alias/S3EC-Github-KMS-Key
21+
TargetKeyId: !Ref S3ECGitHubKMSKeyID
22+
23+
S3ECGitHubTestS3Bucket:
24+
Type: 'AWS::S3::Bucket'
25+
Properties:
26+
BucketName: s3ec-github-test-bucket
27+
LifecycleConfiguration:
28+
Rules:
29+
- Id: Expire in 14 days
30+
Status: Enabled
31+
ExpirationInDays: 14
32+
PublicAccessBlockConfiguration:
33+
BlockPublicAcls: false
34+
BlockPublicPolicy: false
35+
IgnorePublicAcls: false
36+
RestrictPublicBuckets: false
37+
38+
S3ECGitHubS3BucketPolicy:
39+
Type: 'AWS::IAM::ManagedPolicy'
40+
Properties:
41+
ManagedPolicyName: S3EC-GitHub-S3-Bucket-Policy
42+
PolicyDocument:
43+
Version: 2012-10-17
44+
Statement:
45+
- Effect: Allow
46+
Action:
47+
- 's3:PutObject'
48+
- 's3:GetObject'
49+
- 's3:DeleteObject'
50+
Resource:
51+
- !Join [ "", [ !GetAtt S3ECGitHubTestS3Bucket.Arn, '/*'] ]
52+
53+
S3ECGitHubKMSKeyPolicy:
54+
Type: 'AWS::IAM::ManagedPolicy'
55+
Properties:
56+
PolicyDocument: !Sub |
57+
{
58+
"Version": "2012-10-17",
59+
"Statement": [
60+
{
61+
"Effect": "Allow",
62+
"Resource": [
63+
"arn:aws:kms:*:${AWS::AccountId}:key/${S3ECGitHubKMSKeyID}",
64+
"arn:aws:kms:*:${AWS::AccountId}:${S3ECGitHubKMSKeyAlias}"
65+
],
66+
"Action": [
67+
"kms:Decrypt",
68+
"kms:GenerateDataKey",
69+
"kms:GenerateDataKeyPair"
70+
]
71+
}
72+
]
73+
}
74+
ManagedPolicyName: S3EC-GitHub-KMS-Key-Policy
75+
76+
S3ECGithubTestRole:
77+
Type: 'AWS::IAM::Role'
78+
Properties:
79+
Path: /service-role/
80+
RoleName: S3EC-GitHub-test-role
81+
AssumeRolePolicyDocument: !Sub |
82+
{
83+
"Version": "2012-10-17",
84+
"Statement": [
85+
{
86+
"Effect": "Allow",
87+
"Principal": { "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com" },
88+
"Action": "sts:AssumeRoleWithWebIdentity",
89+
"Condition": {
90+
"StringEquals": {
91+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
92+
},
93+
"StringLike": {
94+
"token.actions.githubusercontent.com:sub": "repo:aws/amazon-s3-encryption-client-java:*"
95+
}
96+
}
97+
},
98+
{
99+
"Effect": "Allow",
100+
"Principal": { "AWS": "arn:aws:iam::${AWS::AccountId}:role/ToolsDevelopment" },
101+
"Action": "sts:AssumeRole"
102+
}
103+
]
104+
}
105+
Description: >-
106+
Grant GitHub S3 put and get and KMS encrypt, decrypt, and generate access
107+
for testing
108+
ManagedPolicyArns:
109+
- !Ref S3ECGitHubKMSKeyPolicy
110+
- !Ref S3ECGitHubS3BucketPolicy

0 commit comments

Comments
 (0)