Skip to content

Commit bc966e4

Browse files
InesNiInesNi
authored
feat(ci): provide a separate CloudFormation stack for GitHub OIDC setup (#3226)
1 parent 56dbfe8 commit bc966e4

File tree

3 files changed

+398
-1
lines changed

3 files changed

+398
-1
lines changed

‎.github/workflows/s3-publish-cf-templates.yml

+4-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ on:
2222
env:
2323
CF_LAMBDA_TEMPLATE: ${{ inputs.canary && 'aws-iam-lambda-cf-template-canary.yml' || 'aws-iam-lambda-cf-template.yml' }}
2424
CF_FARGATE_TEMPLATE: ${{ inputs.canary && 'aws-iam-fargate-cf-template-canary.yml' || 'aws-iam-fargate-cf-template.yml' }}
25-
25+
GH_OIDC_LAMBDA_TEMPLATE: ${{ inputs.canary && 'gh-oidc-lambda-canary.yml' || 'gh-oidc-lambda.yml' }}
26+
GH_OIDC_FARGATE_TEMPLATE: ${{ inputs.canary && 'gh-oidc-fargate-canary.yml' || 'gh-oidc-fargate.yml' }}
2627
jobs:
2728
put-cloudformation-templates:
2829
runs-on: ubuntu-latest
@@ -49,3 +50,5 @@ jobs:
4950
run: |
5051
aws s3 cp --acl public-read ./packages/artillery/lib/platform/aws/iam-cf-templates/aws-iam-fargate-cf-template.yml s3://artilleryio-cf-templates/${{ env.CF_FARGATE_TEMPLATE }}
5152
aws s3 cp --acl public-read ./packages/artillery/lib/platform/aws/iam-cf-templates/aws-iam-lambda-cf-template.yml s3://artilleryio-cf-templates/${{ env.CF_LAMBDA_TEMPLATE }}
53+
aws s3 cp --acl public-read ./packages/artillery/lib/platform/aws/iam-cf-templates/gh-oidc-lambda.yml s3://artilleryio-cf-templates/${{ env.GH_OIDC_LAMBDA_TEMPLATE }}
54+
aws s3 cp --acl public-read ./packages/artillery/lib/platform/aws/iam-cf-templates/gh-oidc-fargate.yml s3://artilleryio-cf-templates/${{ env.GH_OIDC_FARGATE_TEMPLATE }}

‎packages/artillery/lib/platform/aws/iam-cf-templates/gh-oidc-fargate.yml

+241
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,241 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: Creates an ArtilleryGitHubOIDCForFargateRole IAM role with permissions needed to run Artillery Fargate tests from a specified GitHub repository. An OIDC identity provider for Github will also be created if it is not already present in the account.
3+
Metadata:
4+
AWS::CloudFormation::Interface:
5+
ParameterGroups:
6+
- Label:
7+
default: "GitHub"
8+
Parameters:
9+
- GitHubRepository
10+
- GitHubBranch
11+
- Label:
12+
default: "AWS IAM"
13+
Parameters:
14+
- GitHubOIDCProviderExists
15+
16+
ParameterLabels:
17+
GitHubRepository:
18+
default: "GitHub repository"
19+
GitHubBranch:
20+
default: "GitHub branch"
21+
GitHubOIDCProviderExists:
22+
default: "GitHub OIDC identity provider already created for the account?"
23+
24+
Parameters:
25+
GitHubRepository:
26+
Type: String
27+
Default: ""
28+
Description: The GitHub repository (orgname/reponame) to be allowed to assume the created IAM role using OIDC (e.g. "artilleryio/artillery").
29+
30+
GitHubBranch:
31+
Type: String
32+
Default: "*"
33+
Description: (Optional) Use when you want to allow only a specific branch within the specified Github repository to assume this IAM role using OIDC (e.g. "main"). If not set, defaults to "*" (all branches).
34+
35+
GitHubOIDCProviderExists:
36+
Type: String
37+
Default: 'No'
38+
AllowedValues:
39+
- 'Yes'
40+
- 'No'
41+
Description: This will let CloudFormation know whether it needs to create the provider. (If it exists, can be found at Services -> IAM -> Identity providers as 'token.actions.githubusercontent.com').
42+
43+
Conditions:
44+
IsGHRepoSet:
45+
!Not [!Equals [!Ref GitHubRepository, ""]]
46+
47+
CreateOIDCProvider:
48+
!Equals [!Ref GitHubOIDCProviderExists, "No"]
49+
50+
Resources:
51+
GitHubOIDCProvider:
52+
Type: AWS::IAM::OIDCProvider
53+
Condition: CreateOIDCProvider
54+
Properties:
55+
Url: "https://token.actions.githubusercontent.com"
56+
ClientIdList:
57+
- "sts.amazonaws.com"
58+
ThumbprintList:
59+
- "6938fd4d98bab03faadb97b34396831e3780ee11"
60+
61+
ArtilleryGitHubOIDCForFargateRole:
62+
Type: "AWS::IAM::Role"
63+
Properties:
64+
RoleName: "ArtilleryGitHubOIDCForFargateRole"
65+
AssumeRolePolicyDocument:
66+
Version: "2012-10-17"
67+
Statement:
68+
- Effect: "Allow"
69+
Principal:
70+
Federated:
71+
Fn::If:
72+
- CreateOIDCProvider
73+
- !Ref GitHubOIDCProvider
74+
- !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
75+
Action: "sts:AssumeRoleWithWebIdentity"
76+
Condition: {
77+
StringEquals:
78+
{
79+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
80+
},
81+
StringLike:
82+
{
83+
"token.actions.githubusercontent.com:sub": !Sub "repo:${GitHubRepository}:${GitHubBranch}"
84+
}
85+
}
86+
Path: "/"
87+
Policies:
88+
- PolicyName: "ArtilleryGitHubOIDCForFargatePolicy"
89+
PolicyDocument:
90+
Version: "2012-10-17"
91+
Statement:
92+
- Sid: "CreateOrGetECSRole"
93+
Effect: "Allow"
94+
Action:
95+
- "iam:CreateRole"
96+
- "iam:GetRole"
97+
- "iam:AttachRolePolicy"
98+
- "iam:PassRole"
99+
Resource:
100+
Fn::Sub: "arn:aws:iam::${AWS::AccountId}:role/artilleryio-ecs-worker-role"
101+
- Sid: "CreateECSPolicy"
102+
Effect: "Allow"
103+
Action:
104+
- "iam:CreatePolicy"
105+
Resource:
106+
Fn::Sub: "arn:aws:iam::${AWS::AccountId}:policy/artilleryio-ecs-worker-policy"
107+
- Effect: "Allow"
108+
Action:
109+
- "iam:CreateServiceLinkedRole"
110+
Resource:
111+
- "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS*"
112+
Condition:
113+
StringLike:
114+
iam:AWSServiceName: "ecs.amazonaws.com"
115+
- Effect: "Allow"
116+
Action:
117+
- "iam:PassRole"
118+
Resource:
119+
- Fn::Sub: "arn:aws:iam::${AWS::AccountId}:role/artilleryio-ecs-worker-role"
120+
- Sid: "SQSPermissions"
121+
Effect: "Allow"
122+
Action:
123+
- "sqs:*"
124+
Resource:
125+
Fn::Sub: "arn:aws:sqs:*:${AWS::AccountId}:artilleryio*"
126+
- Sid: "SQSListQueues"
127+
Effect: "Allow"
128+
Action:
129+
- "sqs:ListQueues"
130+
Resource: "*"
131+
- Sid: "ECSPermissionsGeneral"
132+
Effect: "Allow"
133+
Action:
134+
- "ecs:ListClusters"
135+
- "ecs:CreateCluster"
136+
- "ecs:RegisterTaskDefinition"
137+
- "ecs:DeregisterTaskDefinition"
138+
Resource: "*"
139+
- Sid: "ECSPermissionsScopedToCluster"
140+
Effect: "Allow"
141+
Action:
142+
- "ecs:DescribeClusters"
143+
- "ecs:ListContainerInstances"
144+
Resource:
145+
Fn::Sub: "arn:aws:ecs:*:${AWS::AccountId}:cluster/*"
146+
- Sid: "ECSPermissionsScopedWithCondition"
147+
Effect: "Allow"
148+
Action:
149+
- "ecs:SubmitTaskStateChange"
150+
- "ecs:DescribeTasks"
151+
- "ecs:ListTasks"
152+
- "ecs:ListTaskDefinitions"
153+
- "ecs:DescribeTaskDefinition"
154+
- "ecs:StartTask"
155+
- "ecs:StopTask"
156+
- "ecs:RunTask"
157+
Condition:
158+
ArnEquals:
159+
ecs:cluster:
160+
Fn::Sub: "arn:aws:ecs:*:${AWS::AccountId}:cluster/*"
161+
Resource: "*"
162+
- Sid: "S3Permissions"
163+
Effect: "Allow"
164+
Action:
165+
- "s3:CreateBucket"
166+
- "s3:DeleteObject"
167+
- "s3:GetObject"
168+
- "s3:GetObjectAcl"
169+
- "s3:GetObjectTagging"
170+
- "s3:GetObjectVersion"
171+
- "s3:PutObject"
172+
- "s3:PutObjectAcl"
173+
- "s3:ListBucket"
174+
- "s3:GetBucketLocation"
175+
- "s3:GetBucketLogging"
176+
- "s3:GetBucketPolicy"
177+
- "s3:GetBucketTagging"
178+
- "s3:PutBucketPolicy"
179+
- "s3:PutBucketTagging"
180+
- "s3:PutMetricsConfiguration"
181+
- "s3:GetLifecycleConfiguration"
182+
- "s3:PutLifecycleConfiguration"
183+
Resource:
184+
- "arn:aws:s3:::artilleryio-test-data-*"
185+
- "arn:aws:s3:::artilleryio-test-data-*/*"
186+
- Sid: "LogsPermissions"
187+
Effect: "Allow"
188+
Action:
189+
- "logs:PutRetentionPolicy"
190+
Resource:
191+
- Fn::Sub: "arn:aws:logs:*:${AWS::AccountId}:log-group:artilleryio-log-group/*"
192+
- Effect: "Allow"
193+
Action:
194+
- "secretsmanager:GetSecretValue"
195+
Resource:
196+
- Fn::Sub: "arn:aws:secretsmanager:*:${AWS::AccountId}:secret:artilleryio/*"
197+
- Effect: "Allow"
198+
Action:
199+
- "ssm:PutParameter"
200+
- "ssm:GetParameter"
201+
- "ssm:GetParameters"
202+
- "ssm:DeleteParameter"
203+
- "ssm:DescribeParameters"
204+
- "ssm:GetParametersByPath"
205+
Resource:
206+
- Fn::Sub: "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/artilleryio/*"
207+
- Fn::Sub: "arn:aws:ssm:us-east-2:${AWS::AccountId}:parameter/artilleryio/*"
208+
- Fn::Sub: "arn:aws:ssm:us-west-1:${AWS::AccountId}:parameter/artilleryio/*"
209+
- Fn::Sub: "arn:aws:ssm:us-west-2:${AWS::AccountId}:parameter/artilleryio/*"
210+
- Fn::Sub: "arn:aws:ssm:ca-central-1:${AWS::AccountId}:parameter/artilleryio/*"
211+
- Fn::Sub: "arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/artilleryio/*"
212+
- Fn::Sub: "arn:aws:ssm:eu-west-2:${AWS::AccountId}:parameter/artilleryio/*"
213+
- Fn::Sub: "arn:aws:ssm:eu-west-3:${AWS::AccountId}:parameter/artilleryio/*"
214+
- Fn::Sub: "arn:aws:ssm:eu-central-1:${AWS::AccountId}:parameter/artilleryio/*"
215+
- Fn::Sub: "arn:aws:ssm:eu-north-1:${AWS::AccountId}:parameter/artilleryio/*"
216+
- Fn::Sub: "arn:aws:ssm:ap-south-1:${AWS::AccountId}:parameter/artilleryio/*"
217+
- Fn::Sub: "arn:aws:ssm:ap-east-1:${AWS::AccountId}:parameter/artilleryio/*"
218+
- Fn::Sub: "arn:aws:ssm:ap-northeast-1:${AWS::AccountId}:parameter/artilleryio/*"
219+
- Fn::Sub: "arn:aws:ssm:ap-northeast-2:${AWS::AccountId}:parameter/artilleryio/*"
220+
- Fn::Sub: "arn:aws:ssm:ap-southeast-1:${AWS::AccountId}:parameter/artilleryio/*"
221+
- Fn::Sub: "arn:aws:ssm:ap-southeast-2:${AWS::AccountId}:parameter/artilleryio/*"
222+
- Fn::Sub: "arn:aws:ssm:me-south-1:${AWS::AccountId}:parameter/artilleryio/*"
223+
- Fn::Sub: "arn:aws:ssm:sa-east-1:${AWS::AccountId}:parameter/artilleryio/*"
224+
- Effect: "Allow"
225+
Action:
226+
- "ec2:DescribeRouteTables"
227+
- "ec2:DescribeVpcs"
228+
- "ec2:DescribeSubnets"
229+
Resource: "*"
230+
231+
Outputs:
232+
RoleArn:
233+
Description: "ARN of the created IAM Role"
234+
Value:
235+
Fn::GetAtt:
236+
- "ArtilleryGitHubOIDCForFargateRole"
237+
- "Arn"
238+
OIDCProviderArn:
239+
Condition: CreateOIDCProvider
240+
Description: "ARN of the newly created OIDC provider"
241+
Value: !Ref GitHubOIDCProvider

0 commit comments

Comments
 (0)