Skip to content

Commit 0a4024a

Browse files
author
Travis Sheppard
authored
feat(flutter): OIDC provider stack for Github actions (#116)
1 parent aec8659 commit 0a4024a

File tree

2 files changed

+144
-0
lines changed

2 files changed

+144
-0
lines changed

‎src/integ_test_resources/flutter/amplify/README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# OIDC Provider Stack For Amplify Flutter Integration Tests
2+
3+
This AWS CloudFormation template was created for use in the [Amplify Flutter](https://github.com/aws-amplify/amplify-flutter) repository but could be used for anyone wishing to use Github Actions with Amplify projects.
4+
5+
This template can be used to provision a stack in an AWS account so that Github Actions can run `amplify pull`. When provisioned from the AWS console, this stack will give a Github repo the ability to use the [OpenID Connect integration with AWS](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) with sufficient permissions to run `amplify pull` and get read-only access to Amplify projects in the account. It is designed to be used with the [Configure AWS Credentials Action](https://github.com/aws-actions/configure-aws-credentials).
6+
7+
## Usage
8+
9+
### Create the stack from the template:
10+
11+
1. Download the cloudformation_template.yaml file to somewhere that is convenient to upload from.
12+
2. Go into the AWS Console for the account you wish to connect. Search for "CloudFormation" in the search bar and click on "CloudFormation" to go to CloudFormation console.
13+
3. Click button "Create stack" > "With new resources (standard)".
14+
4. Select "Upload a template file" and click "Choose file," selecting the template file you downloaded from step 1.
15+
5. Click "Next."
16+
6. Enter a stack name such as "GithubAmplifyOIDC."
17+
7. For "FullRepoName" field, enter identifier for the Github repository such as "aws-amplify/amplify-flutter." Only Github Actions from this repository will be able to use the generated OIDC provider stack because Github will provide this as a parameter when requesting credentials from AWS and the configured stack will check that parameter.
18+
8. Specify an environment name like "dev" or "test."
19+
9. Optionally provide the lowercase version of an Amplify app name to limit permissions to apps with that name. If omitted, permissions will be scoped to all Amplify apps.
20+
10. Click "Next."
21+
11. Click "Next" again. There is nothing to change on this page.
22+
12. Scroll down to the bottom and click the checkbox next to "I acknowledge that AWS CloudFormation might create IAM resources with custom names."
23+
13. Click "Create stack."
24+
25+
Wait for the stack to finish creating, which should take less than 30 seconds.
26+
27+
### Connect Github Actions to the OIDC provider
28+
29+
1. Get the ARN of the generated "pull_amplify_integration_test_configs" IAM role. You will need to use this in your Github Action to tell Github which role to fetch credentials for. It is recommended to store this as a secret in your Github repository. You can get the ARN by navigating to "Stacks" in the CloudFormation console and searching for the name of the stack you used. Click on the stack, and click on the "Resources" tab. Click on the link next to "Role" which will take you to the role in the IAM console. There, you should see the ARN.
30+
2. Add the ARN value as a secret named "AWS_IAM_ROLE_ARN" to your repo. See [Github docs](https://docs.github.com/en/rest/actions/secrets).
31+
3. Use the [Configure AWS Credentials Action](https://github.com/aws-actions/configure-aws-credentials) and supply the secret as the value to `role-to-assume` as seen on https://github.com/aws-actions/configure-aws-credentials#examples in addition to the region that contains your Amplify backends. At this point, every execution of this Action will have temporary AWS credentials as redacted environmental variables you can use to run `amplify pull`.
32+
4. Run a script to pull the amplify environment. Such as:
33+
34+
```bash
35+
# Amplify needs a profile to run headless pulls because CLI does not support session token.
36+
aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
37+
aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
38+
aws configure set aws_session_token $AWS_SESSION_TOKEN
39+
aws configure set default.region $AWS_DEFAULT_REGION
40+
41+
# Amplify headless pull
42+
43+
FLUTTERCONFIG="{\
44+
\"ResDir\":\"./lib/\",\
45+
\"SourceDir\":\"lib\",\
46+
}"
47+
48+
AMPLIFY="{\
49+
\"appId\":\"my-app-id\",\
50+
\"envName\":\"test\",\
51+
\"defaultEditor\":\"code\"\
52+
}"
53+
54+
FRONTEND="{\
55+
\"frontend\":\"flutter\",\
56+
\"config\":$FLUTTERCONFIG\
57+
}"
58+
59+
AWSCLOUDFORMATIONCONFIG="{\
60+
\"configLevel\":\"project\",\
61+
\"useProfile\":true,\
62+
\"profileName\":\"default\",\
63+
\"region\":\"us-east-1\"\
64+
}"
65+
PROVIDERS="{\
66+
\"awscloudformation\":$AWSCLOUDFORMATIONCONFIG\
67+
}"
68+
69+
echo n | amplify pull \
70+
--amplify $AMPLIFY \
71+
--frontend $FRONTEND \
72+
--providers $PROVIDERS
73+
```

‎src/integ_test_resources/flutter/amplify/cloudformation_template.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
Parameters:
2+
FullRepoName:
3+
Type: String
4+
Description: Example "aws-amplify/amplify-flutter"
5+
AllowedPattern: ^[a-zA-Z0-9-\_\.]+\/[a-zA-Z0-9-\_\.]+$
6+
ConstraintDescription: must contain two alphanumeric strings with dashes, periods, or underscores separated by a slash
7+
AmplifyEnvName:
8+
Type: String
9+
Description: Name of Amplify environment for which pull permissions are granted. E.g. "test"
10+
Default: test
11+
AmplifyAppName:
12+
Type: String
13+
Description: Optional. If provided, pull permissions limited to this app. Otherwise, permissions granted for all apps. Should be all lowercase.
14+
15+
Conditions:
16+
AllAmplifyApps: !Equals [!Ref AmplifyAppName, ""]
17+
18+
Resources:
19+
Role:
20+
Type: AWS::IAM::Role
21+
Properties:
22+
RoleName: pull_amplify_integration_test_configs
23+
Policies:
24+
- PolicyName: AmplifyPullIntegrationTestsS3
25+
PolicyDocument:
26+
Statement:
27+
-
28+
Effect: Allow
29+
Action:
30+
- s3:GetObject
31+
- s3:ListBucket
32+
Resource: !If [AllAmplifyApps, !Sub "arn:aws:s3:::amplify-*${AmplifyEnvName}*", !Sub "arn:aws:s3:::amplify-${AmplifyAppName}-${AmplifyEnvName}*"]
33+
- PolicyName: AmplifyPullIntegrationTestsCloudformation
34+
PolicyDocument:
35+
Statement:
36+
-
37+
Effect: Allow
38+
Action:
39+
- cloudformation:ListStackResources
40+
Resource: !If [AllAmplifyApps, !Sub "arn:aws:cloudformation:*amplify*${AmplifyEnvName}*", !Sub "arn:aws:cloudformation:*amplify-${AmplifyAppName}-${AmplifyEnvName}*"]
41+
- PolicyName: AmplifyPullIntegrationTestsAmplify
42+
PolicyDocument:
43+
Statement:
44+
-
45+
Effect: Allow
46+
Action:
47+
- amplify:GetApp
48+
- amplify:GetBackendEnvironment
49+
Resource: "arn:aws:amplify:*"
50+
AssumeRolePolicyDocument:
51+
Statement:
52+
- Effect: Allow
53+
Action: sts:AssumeRoleWithWebIdentity
54+
Principal:
55+
Federated: !Ref GithubOidc
56+
Condition:
57+
StringLike:
58+
token.actions.githubusercontent.com:sub: !Sub repo:${FullRepoName}:*
59+
60+
GithubOidc:
61+
Type: AWS::IAM::OIDCProvider
62+
Properties:
63+
Url: https://token.actions.githubusercontent.com
64+
ThumbprintList:
65+
- 6938fd4d98bab03faadb97b34396831e3780aea1
66+
ClientIdList:
67+
- sts.amazonaws.com
68+
69+
Outputs:
70+
Role:
71+
Value: !GetAtt Role.Arn

0 commit comments

Comments
 (0)