GitHub OIDC for AWS Creds in all workflows (#22)

aws-observability · Dec 22, 2021 · a6c4dca · a6c4dca
1 parent b0d92dc
commit a6c4dca
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 4 deletions.
diff --git a/.github/workflows/integration-testing.yml b/.github/workflows/integration-testing.yml
@@ -5,6 +5,8 @@ jobs:
   Test_Integration_App:
     name: Integration Test
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     env:
       ECR_REPO: public.ecr.aws/u0d6r4y4/aws-otel-dotnet-test
     steps:
@@ -15,8 +17,6 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
           role-duration-seconds: 1200
           aws-region: us-east-1

diff --git a/.github/workflows/soak-testing.yml b/.github/workflows/soak-testing.yml
@@ -37,6 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
       issues: write
     strategy:
       fail-fast: false
@@ -88,8 +89,6 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
           role-duration-seconds: 21600 # 6 Hours
           aws-region: ${{ env.AWS_DEFAULT_REGION }}