OIDC for custom deployments

.github/workflows/deploy-custom-prod.yml

@@ -5,6 +5,10 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+  id-token: write
+
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
@@ -340,9 +344,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
-          aws-access-key-id: ${{ secrets.V2_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.V2_AWS_SECRET_ACCESS_KEY }}
-          aws-session-token: ${{ secrets.V2_AWS_SESSION_TOKEN }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
 
       - uses: actions/setup-python@v6

.github/workflows/deploy-custom-test.yml

@@ -5,6 +5,10 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: read
+  id-token: write
+
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
@@ -190,9 +194,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
-          aws-access-key-id: ${{ secrets.V2_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.V2_AWS_SECRET_ACCESS_KEY }}
-          aws-session-token: ${{ secrets.V2_AWS_SESSION_TOKEN }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
 
       - uses: actions/setup-python@v6

CHANGELOG.md

@@ -10,9 +10,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added `FIRE_TRACK` job spec to `hyp3-ak-fire-safe`.
 - Added parameter `upload_to_db` to `AK_FIRE_SAFE` job spec.
 - Added environment variable `DB_HOST` to `AK_FIRE_SAFE` job spec.
+- Added SQS and ECR permissions to `ASF-deployment-ci-cf.yml` for deploying HyP3-based monitoring stacks.
 
 ### Changed
 - Parquet file products are now visible.
+- `JPL-deployment-ci-cf.yml` now deploys a role to be assumed via OIDC by GitHub Actions, rather than a service user
+- HyP3 deployments in the `delpoy-custom-test.yml` and `deploy-custom-prod.yml` workflows are now deployed via OIDC
 
 ### Fixed
 - The SrgGslc and SlimSAR compute environments have been upgraded to AL2023-based AMIs from AL2 AMIs due to the pending end-of-life of AL2.
@@ -24,7 +27,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added an option to force static file regeneration for the `ITS_LIVE_AUTORIFT` job type.
 
 ### Changed
-- ASF-deployment-ci-cf.yml now deploys a role to be assumed via OIDC by Github Actions, rather than a service user
+- `ASF-deployment-ci-cf.yml` now deploys a role to be assumed via OIDC by GitHub Actions, rather than a service user
 - `plus-test` and `plus-prod` environments are now deployed via OIDC
 
 ## [10.17.4]

cicd-stacks/ASF-deployment-ci-cf.yml

@@ -34,23 +34,25 @@ Resources:
             Statement:
               - Effect: Allow
                 Action:
+                  - apigateway:*
+                  - batch:*
+                  - cloudwatch:*
+                  - dynamodb:*
                   - ec2:*
-                  - s3:*
                   - ecs:*
-                  - batch:*
+                  - ecr:GetAuthorizationToken
                   - events:*
-                  - logs:*
                   - iam:*
+                  - kms:*
                   - lambda:*
-                  - ssm:GetParameters
-                  - apigateway:*
-                  - states:*
-                  - dynamodb:*
+                  - logs:*
                   - rds:*
-                  - cloudwatch:*
-                  - sns:*
+                  - s3:*
                   - secretsmanager:*
-                  - kms:*
+                  - sns:*
+                  - sqs:*
+                  - states:*
+                  - sts:AssumeRole
                 Resource: "*"
 
               - Effect: Allow
@@ -66,6 +68,20 @@ Resources:
                   - cloudformation:GetTemplateSummary
                 Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*"
 
+              - Effect: Allow
+                Action:
+                  - ecr:BatchCheckLayerAvailability
+                  - ecr:GetDownloadUrlForLayer
+                  - ecr:DescribeRepositories
+                  - ecr:ListImages
+                  - ecr:DescribeImages
+                  - ecr:BatchGetImage
+                  - ecr:InitiateLayerUpload
+                  - ecr:UploadLayerPart
+                  - ecr:CompleteLayerUpload
+                  - ecr:PutImage
+                Resource: !Sub "arn:aws:ecr:*:${AWS::AccountId}:repository/*"
+
   OIDCRole:
     Type: AWS::IAM::Role
     Properties:

cicd-stacks/EDC-deployment-ci-cf.yml

@@ -39,24 +39,24 @@ Resources:
             Statement:
               - Effect: Allow
                 Action:
+                  - apigateway:*
+                  - batch:*
+                  - cloudwatch:*
+                  - dynamodb:*
                   - ec2:*
-                  - s3:*
                   - ecs:*
-                  - batch:*
                   - events:*
-                  - logs:*
                   - iam:*
+                  - kms:*
                   - lambda:*
-                  - ssm:GetParameters
-                  - apigateway:*
-                  - states:*
-                  - dynamodb:*
+                  - logs:*
                   - rds:*
-                  - cloudwatch:*
-                  - sns:*
+                  - s3:*
                   - secretsmanager:*
-                  - kms:*
+                  - sns:*
                   - sqs:*
+                  - ssm:GetParameters
+                  - states:*
                 Resource: "*"
 
               - Effect: Allow

cicd-stacks/JPL-deployment-policy-cf.yml

@@ -1,10 +1,43 @@
 AWSTemplateFormatVersion: 2010-09-09
+
+Parameters:
+  SourceRepositories:
+    Type: CommaDelimitedList
+    Default: repo:ASFHyP3/*
+
 Resources:
+  GitHubActionsOidcProvider:
+    Type: AWS::IAM::OIDCProvider
+    Properties:
+      ClientIdList:
+        - sts.amazonaws.com
+      Url: https://token.actions.githubusercontent.com
+
+  CloudformationDeploymentRole:
+    Type: Custom::JplRole
+    Properties:
+      ServiceToken: !ImportValue Custom::JplRole::ServiceToken
+      Path: /account-managed/hyp3/
+      AssumeRolePolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
+            Action: sts:AssumeRoleWithWebIdentity
+            Condition:
+              StringEquals:
+                token.actions.githubusercontent.com:aud: sts.amazonaws.com
+              StringLike:
+                token.actions.githubusercontent.com:sub: !Ref SourceRepositories
+
   DeployPolicy:
     Type: Custom::JplPolicy
     Properties:
       ServiceToken: !ImportValue Custom::JplPolicy::ServiceToken
       Path: /account-managed/hyp3/
+      Roles:
+        - !Ref CloudformationDeploymentRole
       PolicyDocument:
         Version: 2012-10-17
         Statement:
@@ -28,6 +61,7 @@ Resources:
               - kms:*
               - lambda:*
               - logs:*
+              - rds:*
               - s3:*
               - secretsmanager:*
               - sns:*