shahar1 opened a new pull request, #66:
URL: https://github.com/apache/airflow-ci-infra/pull/66
The Terraform (RunsOn) workflow plans terraform/runs-on on pull requests
and on main, and applies the main plan once a required reviewer approves
the runs-on-prod environment, which .asf.yaml limits to main. It uses
GitHub OIDC, so no AWS credential is stored anywhere.
terraform/runs-on-access holds the roles, applied by hand by an account
admin so the workflow cannot widen its own permissions:
- runs-on-terraform-plan: read-only, kms:Decrypt denied so the license
key stays unreadable even though the aws/ssm key policy would allow it.
- runs-on-terraform-apply: trusted only from runs-on-prod; can only
resubmit the runs-on stack from RunsOn's published templates and pass
the service role.
- runs-on-cloudformation: the stack's service role. RunsOn documents
only admin rights for its stack, so AdministratorAccess, with denies
for IAM outside the stack's own roles, sts:AssumeRole and the state
bucket.
Trust uses GitHub's immutable OIDC subject (owner and repository IDs),
as apache/reqsign does; the repository has to opt in first.
---
<sub>Stack created with <a href="https://github.com/github/gh-stack";>GitHub
Stacks CLI</a> • <a href="https://gh.io/stacks-feedback";>Give Feedback
💬</a></sub>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
