GH-50899: [CI][C++] Use OIDC instead of ACCESS_KEY and SECRET_KEY for sccache's s3 creds - #51028
Conversation
|
|
|
Per @kou 's comment #50899 (comment), leaving as draft. I only made change to one workflow file. The other github.*.yml files will need the same change. I tested this with |
| "AWS_ACCESS_KEY_ID": '${{ env.AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}', | ||
| "AWS_SECRET_ACCESS_KEY": '${{ env.AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}', |
There was a problem hiding this comment.
Can we remove || secrets.AWS_* if we always use OIDC?
There was a problem hiding this comment.
Yes, the || secrets.AWS_* side can go away, but you still need the env.AWS_* half (populated by aws-actions/configure-aws-credentials).
Do you want them removed in this PR?
|
|
||
| env: | ||
| ARCHERY_DEBUG: 1 | ||
| SCCACHE_OIDC_ROLE: {{ '${{ secrets.AWS_ROLE_ARN }}' }} |
There was a problem hiding this comment.
Can we use secrets.AWS_ROLE_ARN directly instead of putting it to an environment variable?
There was a problem hiding this comment.
The reasoning was to enable this check: if: env.SCCACHE_OIDC_ROLE != '', since you can't use a secret directly in a GHA if statement.
Alternatively, and probably preferably: could use something like SCCACHE_ENABLED (or another SCCACHE_* field) as the sentry instead of SCCACHE_OIDC_ROLE.
Perhaps SCCACHE_REGION (existing) or SCCACHE_ENABLED (new)?
There was a problem hiding this comment.
Or even easier, I'll just set a boolean based on whether SCCACHE_REGION is defined rather than copy it.
There was a problem hiding this comment.
Ah, OK. I like the current boolean based approach. Let's use it.
github-actions
Bot
added
awaiting changes
|
@github-actions crossbow submit test-conda-cpp |
|
Revision: d5f3f20 Submitted crossbow builds: ursacomputing/crossbow @ actions-70dbb848c1
|
…env. Remove references to unneeded secrets.
github-actions
Bot
added
awaiting change review
|
I've configured the AWS side. |
|
@github-actions crossbow submit test-conda-cpp |
|
I've submitted a new job with the latest changes. |
|
Revision: a630664 Submitted crossbow builds: ursacomputing/crossbow @ actions-94c11124c0
|
|
sccache looks right: The CI failure seems unrelated, the nightly's have been failing for a few days, including https://github.com/ursacomputing/crossbow/actions/runs/32845953016/job/97795547624 If this looks good, I have the remaining github.*.yml's ready to commit. |
|
@github-actions crossbow submit test-ubuntu-22.04-cpp |
|
Revision: a630664 Submitted crossbow builds: ursacomputing/crossbow @ actions-5d1aa97c14
|
|
This looks good to me: if you're good with it, I'll commit the other workflow yml's. |
|
Please do it. |
github-actions
Bot
added
awaiting change review
|
Done. I added |
|
@github-actions crossbow submit matlab -g r -g wheel test-ubuntu-* |
|
Revision: 1497632 Submitted crossbow builds: ursacomputing/crossbow @ actions-beb4b71452
|
2 participants
Rationale for this change
This PR moves crossbow builds to short-lived S3 credentials. It does this via GitHub's OIDC provider and an AWS ROLE_ARN with a trust relationship configured. This configuration is detailed here:
The benefits of short-lived / temporary credentials discussed further here: AWS Well-architected Framework Best Practices SEC02-BP02 Use temporary credentials
sccache supports a variety of S3 creds: S3 credentials
What changes are included in this PR?
Use AssumeRoleWithWebIdentity for sccache S3 credentials.
By assuming the AWS_ROLE_ARN, the sccache session relies on credentials that expire*, issued only to workflows in the trusted repository, and scoped to the sccache bucket.
Specific tasks:
aws-actions/configure-aws-credentials@v6step to the workflow.Separately, someone will need to add the role and trust to AWS:
* I can share an example if needed
Are these changes tested?
Yes, locally and on a fork.
Are there any user-facing changes?
No