[rush] Build cache in Github actions using S3 bucket

[ivanmjartan]

Hi guys I have problem to set up s3 rush build cache.

A Im using it in github actions. And I my company we have set private runners that use IAM role.

So in may case I am not able tell rush that authorisation to defined s3 bucket is done via role.

But rush is still expecting AWS env variable.

Is there way how to make it work?

thanks very much

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	5.122.0
rushVersion from rush.json?	5.122.0
useWorkspaces from rush.json?	yes
Operating system?
Would you consider contributing a PR?
Node.js version (node -v)?

[UberMouse]

What problem are you having? This sounds like the same setup I have at work.
Rush S3 build cache
Github Actions
IAM Roles for auth

The Github action workflows use aws-actions/configure-aws-credentials@v4 to assume the role which sets up the AWS_* env vars which the s3 build cache plugin reads.

[ivanmjartan]

@UberMouse Hi there Pls can you give me snippet of your code ? I was playing with this action
aws-actions/configure-aws-credentials@v4 too, but not successful.

This is my code:

After run it aws-actions/configure-aws-credentials@v4 the variables where empty steps.aws-credentials.outputs.aws-access-key-id,teps.aws-credentials.outputs.aws-secret-access-key,steps.aws-credentials.outputs.aws-session-token and also AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY

thanks very much for help

      id: aws-credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
         ws-region: us-east-1
         output-credentials	: true
         managed-session-policies: arn:aws:iam::020413372491:policy/infra1-policy-github-runner-arc
    - name: Set up RUSH_BUILD_CACHE_CREDENTIAL
      run: |
          echo "test"
          echo ${{ steps.aws-credentials.outputs.aws-access-key-id }}<-- is empty 
          echo "RUSH_BUILD_CACHE_CREDENTIAL=${{ steps.aws-credentials.outputs.aws-access-key-id }}:${{ steps.aws-credentials.outputs.aws-secret-access-key }}:${{ steps.aws-credentials.outputs.aws-session-token }}" >> $GITHUB_ENV
      shell: bash

[iclanton]

This issue: #4115, and this related PR: #4153 may be of use.

Perhaps try eval $(aws configure export-credentials --format env)?

[UberMouse]

Sorry forgot about this. This is all we do in CI to setup the build cache

    uses: aws-actions/configure-aws-credentials@v4                    
    with:                                                             
      role-to-assume: role-name
      aws-region: ap-southeast-2                                      

We use the OIDC method outlined here I'm unfamiliar with that side of things as the ops team set it up

[ivanmjartan]

Hi there, thanks very much your hints, it help me very well. My problem was in OIDC trust settings and OIDC trust relationship.
After discussion with infra team they fix it for me and now s3 cache work well.

Just one note I was force to set this variable RUSH_BUILD_CACHE_CREDENTIAL because I use runs-on/cache/restore@v4 and this action reset AWS default envs variables.

- name: Configure AWS credentials
    id: aws-credentials
    uses: aws-actions/configure-aws-credentials@v4
    with:
      aws-region: us-east-1
      role-to-assume: role-name

  - name: Set up rush build cache credentials
    run: |
      RUSH_BUILD_CACHE_CREDENTIAL="$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY:$AWS_SESSION_TOKEN"
      echo "RUSH_BUILD_CACHE_CREDENTIAL=$RUSH_BUILD_CACHE_CREDENTIAL" >> $GITHUB_ENV
    shell: bash

Once agin thanks for your help