使用 GitHub Actions 将 repo 同步到 S3 - OIDC答案

【问题标题】：Using GitHub Actions to sync repo to S3 - OIDC使用 GitHub Actions 将 repo 同步到 S3 - OIDC
【发布时间】：2022-10-22 00:42:30
【问题描述】：

我正在将我的 GitHub 存储库与 S3 存储桶同步，我不想将我的 AWS 凭证作为 GitHub 机密传递。我已经尝试通过 GitHub 机密传递我的凭据并且代码有效。但是，当我尝试让 GitHub 担任执行操作的角色时，我不断收到错误消息。请参阅下面的代码和图像。

GitHub main.yml

name: Upload Website
on:
  push:
    branches:
    - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Git checkout
        uses: actions/checkout@v3


      - name: Configure AWS credentials from AWS account
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ secrets.AWS_ROLE }}[
          aws-region: ${{ secrets.AWS_REGION }}
          role-session-name: GitHub-OIDC-frontend
      

      - uses: actions/checkout@master
      - uses: jakejarvis/s3-sync-action@master
        with:
          args: --follow-symlinks --exclude '.git/*' --exclude '.github/*' 
        env:
          AWS_REGION: ${{ secrets.AWS_REGION }}
          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}

      - name: Invalidate CloudFront
        uses: chetan/invalidate-cloudfront-action@v2
        env:
          DISTRIBUTION: ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
          PATHS: "/index.html"

AWS 角色政策

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::************:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:sub": [
                        "repo:ACCOUNT_ID/REPO_NAME:*",
                        "repo:ACCOUNT_ID/REPO_NAME:*"
                    ],
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

GitHub 错误

Run aws-actions/configure-aws-credentials@v1
  with:
    role-to-assume: ***
    aws-region: ***
    role-session-name: GitHub-OIDC-frontend
    audience: sts.amazonaws.com
  
Error: Not authorized to perform sts:AssumeRoleWithWebIdentity

【问题讨论】：

标签： github amazon-s3 github-actions amazon-iam amazon-cloudfront

【解决方案1】：

你设置claim_keys via the Github REST API了吗？

如果您使用的是 github cli，它看起来像这样

gh api /repos/ACCOUNT_ID/REPO_NAME/actions/oidc/customization/sub --method PUT --input ./body.txt

body.txt 的样子

{"use_default":false,"include_claim_keys":["repo"]}

我也很好奇您的 token.actions.githubusercontent.com:sub 值是否存在问题。那颗星只是明确地允许任何其他声明吗？您可能希望（或需要）将其降低为 repo:ACCOUNT_ID/REPO_NAME。

【讨论】：