Skip to content

Commit c813b7e

Browse files
authored
Rescope AWS ARN from secret to var (#1598)
The name of the role isn't a `secret`, so storing at such means it's masked logs etc which makes debugging difficult. More specifically, authentication is handled via [OIDC](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws), on it's own the role does nothing. Instead, it should be rescoped as a `var`.
1 parent 3503efd commit c813b7e

2 files changed

Lines changed: 2 additions & 2 deletions

File tree

.github/workflows/coverage_runner.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ jobs:
7676
- name: Configure AWS Credentials
7777
uses: aws-actions/configure-aws-credentials@v5
7878
with:
79-
role-to-assume: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
79+
role-to-assume: ${{ vars.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
8080
aws-region: 'us-east-1'
8181

8282
- name: Get Secrets

.github/workflows/nightly_runner_master.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
- name: Configure AWS Credentials
4343
uses: aws-actions/configure-aws-credentials@v5
4444
with:
45-
role-to-assume: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
45+
role-to-assume: ${{ vars.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }}
4646
aws-region: 'us-east-1'
4747

4848
- name: Get Secrets

0 commit comments

Comments
 (0)