AWS Deployment using Github Actions

This project demonstrates how to deploy a project that incluce this workflow file to AWS.

First in first, you have to Create an individual IAM user with an access key for use in GitHub Actions workflows, preferably one per repository. Do not use the AWS account root user access key.

After that, you have to Grant least privilege to the credentials used in GitHub Actions workflows. Grant only the permissions required to perform the actions in your GitHub Actions workflows. See the Permissions section below for the permissions required by this action.

This action requires the following minimum set of permissions for the user deploys this workflows and wants to make changes on AWS (an AWS user which requiers the following set of permissions):

{
  "Version":"2012-10-17",
  "Statement":[
     {
        "Sid":"RegisterTaskDefinition",
        "Effect":"Allow",
        "Action":[
           "ecs:RegisterTaskDefinition"
        ],
        "Resource":"*"
     },
     {
        "Sid":"PassRolesInTaskDefinition",
        "Effect":"Allow",
        "Action":[
           "iam:PassRole"
        ],
        "Resource":[
           "arn:aws:iam::<aws_account_id>:role/<task_definition_task_role_name>",
           "arn:aws:iam::<aws_account_id>:role/<task_definition_task_execution_role_name>"
        ]
     },
     {
        "Sid":"DeployService",
        "Effect":"Allow",
        "Action":[
           "ecs:UpdateService",
           "ecs:DescribeServices"
        ],
        "Resource":[
           "arn:aws:ecs:<region>:<aws_account_id>:service/<cluster_name>/<service_name>"
        ]
     }
  ]
}

In task definition file, you probably don't want to show up your AWS Account Number publicly.
The step named "Replace AWS Account ID" set the AWS Account Number from secrets with stream editor (sed) command. For more information please visit here.