Tmi2 532/run actions as aws role (#97)

* Update imageBuild.yml * Update promoteToProd.yml
cabinetoffice · Jan 30, 2024 · 31ba570 · 31ba570
1 parent 7aed984
commit 31ba570
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 6 deletions.
diff --git a/.github/workflows/imageBuild.yml b/.github/workflows/imageBuild.yml
@@ -53,6 +53,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
+    permissions:
+        id-token: write
+        contents: read
+
     # Need to check here as create event can't be filtered by branch name: https://github.com/orgs/community/discussions/54860
     if: github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release')
 
@@ -73,10 +77,10 @@ jobs:
           cache: maven
 
       - name: Setup AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1-node16
+        uses: aws-actions/configure-aws-credentials@v3
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: gap-apply-applicant-backend
           aws-region: ${{ env.AWS_REGION }}
 
       - name: Login to AWS ECR

diff --git a/.github/workflows/promoteToProd.yml b/.github/workflows/promoteToProd.yml
@@ -15,12 +15,16 @@ jobs:
     environment: AWS
     runs-on: ubuntu-latest
 
+    permissions:
+        id-token: write
+        contents: read
+
     steps:
       - name: Setup AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1-node16
+        uses: aws-actions/configure-aws-credentials@v3
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: gap-apply-applicant-backend
           aws-region: ${{ env.AWS_REGION }}
 
       - name: Login to AWS ECR