shahar1 opened a new pull request, #68: URL: https://github.com/apache/airflow-ci-infra/pull/68
Temporary, until [INFRA-28572](https://issues.apache.org/jira/browse/INFRA-28572) opts this repository into immutable OIDC subjects. Today `gh api repos/apache/airflow-ci-infra/actions/oidc/customization/sub` returns `use_immutable_subject: false`, so the workflow's tokens carry the default subject `repo:apache/airflow-ci-infra:...`, while both roles in `terraform/runs-on-access` trust only `repo:apache@47359/airflow-ci-infra@321691041:...`. Every run of `Terraform (RunsOn)` since #66 (for example [40078259850](https://github.com/apache/airflow-ci-infra/actions/runs/40078259850)) therefore fails at `configure-aws-credentials` with `Not authorized to perform sts:AssumeRoleWithWebIdentity`. **Change.** `github_subject` becomes `github_subject_prefixes`, listing the default and the immutable subject, and both trust policies accept either. Trusting both rather than swapping means that the moment INFRA flips the setting (tokens change form immediately) the roles keep working, and the follow-up is a deletion with no outage window. Rendered trust subjects: | Role | `sub` values | |---|---| | `runs-on-terraform-plan` | `repo:apache/airflow-ci-infra:pull_request`, `repo:apache/airflow-ci-infra:ref:refs/heads/main`, and the two immutable equivalents | | `runs-on-terraform-apply` | `repo:apache/airflow-ci-infra:environment:runs-on-prod` and its immutable equivalent | The default subject still pins repository, event, branch and environment; what is lost until INFRA-28572 is only the protection against a renamed or re-created repository, which needs an apache org admin anyway. AWS cannot condition on `repository_id` directly (only `sub`/`aud` are supported for this provider), so there is no way to keep that protection without the GitHub setting. **What to revert once INFRA-28572 is done** (also in `terraform/runs-on-access/README.rst`, section "Switching to the immutable subject"): 1. Remove `"repo:apache/airflow-ci-infra"` from `github_subject_prefixes` in `main.tf` and the `TEMPORARY` comment above it. 2. Drop the README section and the "Temporarily" sentence, restore bootstrap step 1 to its original wording. 3. An account admin applies `terraform/runs-on-access` by hand (two trust policies change in place). **After merge.** `terraform/runs-on-access` is applied by hand, not by the workflow, so an account admin has to apply it for the `plan` check to go green; this PR touches no path the workflow triggers on, so no CI run is expected here. **Checks run.** `terraform fmt -check` and `terraform validate` on the module; the rendered `local.github_subjects` was evaluated in a scratch module and matches the table above; `docutils --strict` on the README. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Fable 5.1) Generated-by: Claude Code (Fable 5.1) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01SsYkPJ1GghTeeT4Hx3DQzA -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
