-
Notifications
You must be signed in to change notification settings - Fork 79
chore(release) fix iam role used for dry run releases DEVPROD-21408 #2525
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
This commit adjusts our release dry run task to use the correct IAM role for its operations. The non-dry-run release task was using the expected role, but dry-run wasn't assuming the role we need to use.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR fixes the IAM role configuration for dry run releases by ensuring the correct AWS role is assumed and credentials are properly set. The dry run release task was missing the IAM role assumption that the non-dry-run release task already had.
- Adds
ec2.assume_role
command to assume the required IAM role for dry run releases - Sets up AWS credential environment variables for the download center artifacts
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
File | Description |
---|---|
.evergreen/evergreen.yml.in | Template file updated with IAM role assumption and AWS credential environment variables for dry run releases |
.evergreen.yml | Generated file updated with the same IAM role assumption and AWS credential environment variables |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
redacted: true | ||
- command: ec2.assume_role | ||
params: | ||
role_arn: "arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass" |
Copilot
AI
Aug 28, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The IAM role ARN is hardcoded with a specific AWS account ID (119629040606). Consider using an environment variable or parameter to make this configurable across different environments and avoid exposing account details in the codebase.
Copilot uses AI. Check for mistakes.
redacted: true | ||
- command: ec2.assume_role | ||
params: | ||
role_arn: "arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass" |
Copilot
AI
Aug 28, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The IAM role ARN is hardcoded with a specific AWS account ID (119629040606). Consider using an environment variable or parameter to make this configurable across different environments and avoid exposing account details in the codebase.
Copilot uses AI. Check for mistakes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
blocking the merge before release, LGTM generally though
This commit adjusts our release dry run task to use the correct IAM role for its operations. The non-dry-run release task was using the expected role, but dry-run wasn't assuming the role we need to use.