Skip to content

Commit bca368c

Browse files
committed
Use shared arc role for S3 upload instead of a dedicated role
Assume arn:aws:iam::308535385114:role/arc (already trusts repo:pytorch/test-infra:* and can write gha-artifacts, same role _linux-build.yml uses) rather than a new gha_workflow_runner_fleet_metrics role. Drops the need for the IAM role in the companion gha-infra PR.
1 parent 4ba3b0a commit bca368c

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

.github/workflows/runner-fleet-metrics.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
collect:
3131
runs-on: ubuntu-latest
3232
# Protected environment restricted to the main branch; holds the runner-list
33-
# token. The S3 writer IAM role is gated to this environment's OIDC sub.
33+
# token.
3434
environment: runner-fleet-metrics
3535
env:
3636
RUNNER_ORG: pytorch
@@ -58,9 +58,11 @@ jobs:
5858

5959
- name: Configure AWS credentials
6060
if: ${{ !inputs.dry_run }}
61+
# Shared ARC role: trusts repo:pytorch/test-infra:* and can write
62+
# gha-artifacts (same role _linux-build.yml uses for artifact upload).
6163
uses: aws-actions/configure-aws-credentials@v4
6264
with:
63-
role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_runner_fleet_metrics
65+
role-to-assume: arn:aws:iam::308535385114:role/arc
6466
aws-region: ${{ env.AWS_REGION }}
6567

6668
- name: Upload to S3 for ClickHouse ingestion

0 commit comments

Comments
 (0)