shahar1 commented on PR #65:
URL: https://github.com/apache/airflow-ci-infra/pull/65#issuecomment-6365327251
All review comments are addressed in 87e1da6 (replies in the threads). The
changes are applied to the `apache` stack, and the state now lives in S3.
The Terraform plan and apply workflow is the next PR in this stack: #66. In
short:
- Plans run on pull requests that touch `terraform/runs-on` and again on
`main` after merge. The `main` plan is applied only after a required reviewer
approves the `runs-on-prod` environment (defined in `.asf.yaml`, main only, no
self-approval).
- It authenticates with GitHub OIDC, so no AWS credential is stored
anywhere. The roles are in `terraform/runs-on-access`, which an account admin
applies by hand, so the workflow can't widen its own permissions:
- a read-only plan role (`kms:Decrypt` denied, so the license key stays
unreadable);
- an apply role that can only resubmit the `runs-on` stack from RunsOn's
published templates;
- a CloudFormation service role with explicit denies outside the stack's
own resources.
- The trust policies use GitHub's immutable OIDC subject
(`repo:apache@47359/airflow-ci-infra@321691041:...`), as `apache/reqsign` does.
A renamed or re-created repository can't match them.
That last point needs a repository setting only ASF Infra can change: opting
this repository into immutable OIDC subjects (`use_immutable_subject`). It is
requested in [INFRA-28572](https://issues.apache.org/jira/browse/INFRA-28572).
Until Infra approves and applies it, the workflow in #66 can't assume its AWS
roles.
---
Drafted-by: Claude Code (Opus 5.5) (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
