tiennm99/miti99bot
1
0
Fork 0
mirror of https://github.com/tiennm99/miti99bot.git synced 2026-08-10 10:22:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): pin deploy role ARN for OIDC auth

Browse Source 
The deploy workflow no longer relies on a missing AWS_ACCOUNT_ID secret,
preventing invalid assume-role ARNs and matching the repo's documented AWS setup.
This commit is contained in:
tiennm99
2026-05-15 22:36:15 +07:00
parent ecf92faf22
commit 09c8e563b2
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/deploy.yml
+1 -1
View File
@@ -34,7 +34,7 @@ jobs:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-deploy-miti99bot
role-to-assume: arn:aws:iam::225603493174:role/github-deploy-miti99bot
aws-region: ${{ env.AWS_REGION }}
- name: Build Lambda binary
aws/README.md
+2 -3
View File
@@ -56,7 +56,7 @@ aws iam create-open-id-connect-provider \
## 4. Deploy IAM role for GitHub Actions
Edit `aws/iam-github-oidc-trust.json` to set your AWS account ID and GitHub repo, then:
Edit `aws/iam-github-oidc-trust.json` if you are changing the AWS account or GitHub repo. This repo is already prefilled for account `225603493174` and `tiennm99/miti99bot`. If you change accounts, update `.github/workflows/deploy.yml` to match the same role ARN, then:
```sh
aws iam create-role \
@@ -89,10 +89,9 @@ In GitHub repo settings → Secrets and variables → Actions:
| Secret | Value |
|---|---|
| `AWS_ACCOUNT_ID` | 12-digit AWS account ID |
| `ALERT_EMAIL` (optional) | Email for the $1 budget alert |
`AWS_ACCOUNT_ID` is not a credential — it's hidden only to keep the ARN out of the workflow file.
The deploy workflow now uses the repo's fixed AWS account ID directly for the OIDC role ARN, so `AWS_ACCOUNT_ID` no longer needs to be stored in GitHub.
## 6. First deploy (manual)
docs/deploy-aws-free-tier-guide.md
+5 -4
View File
@@ -187,12 +187,14 @@ aws iam get-open-id-connect-provider --profile admin \
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
```
Edit `aws/iam-github-oidc-trust.json` — fill in your 12-digit AWS account ID and `tiennm99/miti99bot` (or your fork):
Edit `aws/iam-github-oidc-trust.json` if you're deploying from a different AWS account or repo fork. This repo is already prefilled for account `225603493174` and `tiennm99/miti99bot`:
```sh
sed -i "s|225603493174|$ACCT|" aws/iam-github-oidc-trust.json # only if the placeholder differs
sed -i "s|225603493174|$ACCT|" aws/iam-github-oidc-trust.json # only if you are changing accounts
```
If you change accounts, update `.github/workflows/deploy.yml` to match the same role ARN.
Create the role (idempotent — `update-assume-role-policy` if it already exists):
```sh
@@ -283,7 +285,6 @@ In GitHub → repo Settings → Secrets and variables → Actions:
| Secret | Value |
|---|---|
| `AWS_ACCOUNT_ID` | 12-digit AWS account ID |
| `ALERT_EMAIL` (optional) | Email for the $1 budget alert |
After this, every push to `main` triggers `.github/workflows/deploy.yml`:
@@ -292,7 +293,7 @@ After this, every push to `main` triggers `.github/workflows/deploy.yml`:
3. `sam deploy --template-file template.yaml`
4. Smoke `curl <function-url>/`
No long-lived keys live in GitHub.
No long-lived keys live in GitHub. The deploy workflow now uses the repo's fixed AWS account ID directly for the OIDC role ARN, so `AWS_ACCOUNT_ID` no longer needs to be stored in GitHub.
---