使用GitHub操作将repo同步到S3-OIDC

Question

我正在将我的GitHub repo与S3 bucket同步，我不想将我的AWS凭据作为GitHub机密传递。我已经尝试过通过GitHub secret传递我的凭据，代码有效。然而，当我试图让GitHub承担起执行操作的角色时，我总是会出错。请参阅下面的代码和图片。

GitHub main.yml

name: Upload Website
on:
push:
branches:
- main
jobs:
deploy:
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- name: Git checkout
uses: actions/checkout@v3

- name: Configure AWS credentials from AWS account
uses: aws-actions/configure-aws-credentials@v1
with:
role-to-assume: ${{ secrets.AWS_ROLE }}[
aws-region: ${{ secrets.AWS_REGION }}
role-session-name: GitHub-OIDC-frontend

- uses: actions/checkout@master
- uses: jakejarvis/s3-sync-action@master
with:
args: --follow-symlinks --exclude '.git/*' --exclude '.github/*' 
env:
AWS_REGION: ${{ secrets.AWS_REGION }}
AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
- name: Invalidate CloudFront
uses: chetan/invalidate-cloudfront-action@v2
env:
DISTRIBUTION: ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
PATHS: "/index.html"

AWS角色策略

{
"Version": "2008-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::************:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:sub": [
"repo:ACCOUNT_ID/REPO_NAME:*",
"repo:ACCOUNT_ID/REPO_NAME:*"
],
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
}
}
}
]
}

GITHUB错误

Run aws-actions/configure-aws-credentials@v1
with:
role-to-assume: ***
aws-region: ***
role-session-name: GitHub-OIDC-frontend
audience: sts.amazonaws.com

Error: Not authorized to perform sts:AssumeRoleWithWebIdentity

Answer 1

您是否通过Github REST API设置了claim_key？

如果你使用的是githubcli，它看起来像这个

gh api /repos/ACCOUNT_ID/REPO_NAME/actions/oidc/customization/sub --method PUT --input ./body.txt

其中body.txt看起来像

{"use_default":false,"include_claim_keys":["repo"]}

我也很好奇你的token.actions.githubusercontent.com:sub值是否有问题。那个明星只是明确地允许任何其他声明吗？您可能想要(或需要(将其降低为仅repo:ACCOUNT_ID/REPO_NAME。

Answer 2

为什么不创建一个用户？这里有一个类似于所描述问题的解决方案。

# Workflow name
name: S3 Deploy
on:
workflow_dispatch:
push:
paths:
- 'app/**'
- '.github/workflows/deploy.yml'

jobs:
build-and-deploy:
runs-on: ubuntu-latest
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: sa-east-1
BUCKET_NAME: caiogomes.me
steps:
- name: Install hugo
run: sudo apt install hugo
- name: Install aws cli
id: install-aws-cli
uses: unfor19/install-aws-cli-action@v1
with:
version: 2
verbose: false
arch: amd64
rootdir: ""
workdir: "" 
- name: Set AWS credentials
run: export AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }} && export AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }}
- name: Checkout repository
uses: actions/checkout@v3
with:
submodules: 'true'
- name: Build
run: cd app/ && hugo
- name: Upload files to S3
run: aws s3 sync app/public/ s3://${{ env.BUCKET_NAME }}/ --exact-timestamps --delete
create-cloudfront-invalidation:
needs: build-and-deploy
runs-on: ubuntu-latest
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: sa-east-1
CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
steps:
- name: Install aws cli
id: install-aws-cli
uses: unfor19/install-aws-cli-action@v1
with:
version: 2
verbose: false
arch: amd64
rootdir: ""
workdir: "" 
- name: Set AWS credentials
run: export AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }} && export AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }}
- name: Invalidate clodufront distribution
run: aws cloudfront create-invalidation --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} --paths "/*"

以下是回购：https://github.com/caiocsgomes/caiogomes.me