From cd3bae14db2641cec246bf00bee8a722704a9b29 Mon Sep 17 00:00:00 2001 From: Joseph H Kennedy Date: Wed, 24 Jun 2026 16:43:30 -0800 Subject: [PATCH 1/6] Update custom deploys and JPL deployment cf for OIDC --- .github/workflows/deploy-custom-prod.yml | 8 +++-- .github/workflows/deploy-custom-test.yml | 8 +++-- cicd-stacks/JPL-deployment-policy-cf.yml | 42 ++++++++++++++++++++++++ 3 files changed, 52 insertions(+), 6 deletions(-) diff --git a/.github/workflows/deploy-custom-prod.yml b/.github/workflows/deploy-custom-prod.yml index 2d11960d9..1f3d2ec1c 100644 --- a/.github/workflows/deploy-custom-prod.yml +++ b/.github/workflows/deploy-custom-prod.yml @@ -5,6 +5,10 @@ on: tags: - 'v*' +permissions: + contents: read + id-token: write + concurrency: ${{ github.workflow }}-${{ github.ref }} jobs: @@ -340,9 +344,7 @@ jobs: - uses: aws-actions/configure-aws-credentials@v6 with: - aws-access-key-id: ${{ secrets.V2_AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.V2_AWS_SECRET_ACCESS_KEY }} - aws-session-token: ${{ secrets.V2_AWS_SESSION_TOKEN }} + role-to-assume: ${{ secrets.AWS_ROLE_ARN }} aws-region: ${{ secrets.AWS_REGION }} - uses: actions/setup-python@v6 diff --git a/.github/workflows/deploy-custom-test.yml b/.github/workflows/deploy-custom-test.yml index 9be165093..fb9fe6281 100644 --- a/.github/workflows/deploy-custom-test.yml +++ b/.github/workflows/deploy-custom-test.yml @@ -5,6 +5,10 @@ on: branches: - develop +permissions: + contents: read + id-token: write + concurrency: ${{ github.workflow }}-${{ github.ref }} jobs: @@ -190,9 +194,7 @@ jobs: - uses: aws-actions/configure-aws-credentials@v6 with: - aws-access-key-id: ${{ secrets.V2_AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.V2_AWS_SECRET_ACCESS_KEY }} - aws-session-token: ${{ secrets.V2_AWS_SESSION_TOKEN }} + role-to-assume: ${{ secrets.AWS_ROLE_ARN }} aws-region: ${{ secrets.AWS_REGION }} - uses: actions/setup-python@v6 diff --git a/cicd-stacks/JPL-deployment-policy-cf.yml b/cicd-stacks/JPL-deployment-policy-cf.yml index c3f06f86b..d6da6dbd2 100644 --- a/cicd-stacks/JPL-deployment-policy-cf.yml +++ b/cicd-stacks/JPL-deployment-policy-cf.yml @@ -1,10 +1,47 @@ AWSTemplateFormatVersion: 2010-09-09 + +Parameters: + TemplateBucketName: + Description: AWS S3 bucket name for uploading CloudFormation templates + Type: String + + SourceRepositories: + Type: CommaDelimitedList + Default: repo:ASFHyP3/* + Resources: + GitHubActionsOidcProvider: + Type: AWS::IAM::OIDCProvider + Properties: + ClientIdList: + - sts.amazonaws.com + Url: https://token.actions.githubusercontent.com + + CloudformationDeploymentRole: + Type: Custom::JplRole + Properties: + ServiceToken: !ImportValue Custom::JplRole::ServiceToken + Path: /account-managed/hyp3/ + AssumeRolePolicyDocument: + Version: 2012-10-17 + Statement: + - Effect: Allow + Principal: + Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com + Action: sts:AssumeRoleWithWebIdentity + Condition: + StringEquals: + token.actions.githubusercontent.com:aud: sts.amazonaws.com + StringLike: + token.actions.githubusercontent.com:sub: !Ref SourceRepositories + DeployPolicy: Type: Custom::JplPolicy Properties: ServiceToken: !ImportValue Custom::JplPolicy::ServiceToken Path: /account-managed/hyp3/ + Roles: + - !Ref CloudformationDeploymentRole PolicyDocument: Version: 2012-10-17 Statement: @@ -47,6 +84,11 @@ Resources: - iam:UntagInstanceProfile Resource: !Sub "arn:aws:iam::${AWS::AccountId}:instance-profile/account-managed/*" + + - Effect: Allow + Action: s3:PutObject + Resource: !Sub "arn:aws:s3:::${TemplateBucketName}/*" + - Effect: Allow Action: - cloudformation:SetStackPolicy From c7419ab38d342bfdb069cfb90c2856f96f9c3b4a Mon Sep 17 00:00:00 2001 From: Joseph H Kennedy Date: Wed, 24 Jun 2026 16:43:52 -0800 Subject: [PATCH 2/6] Alphabatize permissions in ASF/EDC stacks --- cicd-stacks/ASF-deployment-ci-cf.yml | 20 ++++++++++---------- cicd-stacks/EDC-deployment-ci-cf.yml | 20 ++++++++++---------- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/cicd-stacks/ASF-deployment-ci-cf.yml b/cicd-stacks/ASF-deployment-ci-cf.yml index 8e78fce2c..6a949c475 100644 --- a/cicd-stacks/ASF-deployment-ci-cf.yml +++ b/cicd-stacks/ASF-deployment-ci-cf.yml @@ -34,23 +34,23 @@ Resources: Statement: - Effect: Allow Action: + - apigateway:* + - batch:* + - cloudwatch:* + - dynamodb:* - ec2:* - - s3:* - ecs:* - - batch:* - events:* - - logs:* - iam:* + - kms:* - lambda:* - - ssm:GetParameters - - apigateway:* - - states:* - - dynamodb:* + - logs:* - rds:* - - cloudwatch:* - - sns:* + - s3:* - secretsmanager:* - - kms:* + - sns:* + - ssm:GetParameters + - states:* Resource: "*" - Effect: Allow diff --git a/cicd-stacks/EDC-deployment-ci-cf.yml b/cicd-stacks/EDC-deployment-ci-cf.yml index e591a016d..2eefa76be 100644 --- a/cicd-stacks/EDC-deployment-ci-cf.yml +++ b/cicd-stacks/EDC-deployment-ci-cf.yml @@ -39,24 +39,24 @@ Resources: Statement: - Effect: Allow Action: + - apigateway:* + - batch:* + - cloudwatch:* + - dynamodb:* - ec2:* - - s3:* - ecs:* - - batch:* - events:* - - logs:* - iam:* + - kms:* - lambda:* - - ssm:GetParameters - - apigateway:* - - states:* - - dynamodb:* + - logs:* - rds:* - - cloudwatch:* - - sns:* + - s3:* - secretsmanager:* - - kms:* + - sns:* - sqs:* + - ssm:GetParameters + - states:* Resource: "*" - Effect: Allow From f1091f572339785b3489156271a3a3c9af61aaf4 Mon Sep 17 00:00:00 2001 From: Joseph H Kennedy Date: Wed, 24 Jun 2026 17:01:25 -0800 Subject: [PATCH 3/6] Add permissions for monitoring stack deployments --- cicd-stacks/ASF-deployment-ci-cf.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/cicd-stacks/ASF-deployment-ci-cf.yml b/cicd-stacks/ASF-deployment-ci-cf.yml index 6a949c475..d45b70d25 100644 --- a/cicd-stacks/ASF-deployment-ci-cf.yml +++ b/cicd-stacks/ASF-deployment-ci-cf.yml @@ -40,6 +40,7 @@ Resources: - dynamodb:* - ec2:* - ecs:* + - ecr:GetAuthorizationToken - events:* - iam:* - kms:* @@ -49,8 +50,9 @@ Resources: - s3:* - secretsmanager:* - sns:* - - ssm:GetParameters + - sqs:* - states:* + - sts:AssumeRole Resource: "*" - Effect: Allow @@ -66,6 +68,20 @@ Resources: - cloudformation:GetTemplateSummary Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*" + - Effect: Allow + Action: + - ecr:BatchCheckLayerAvailability + - ecr:GetDownloadUrlForLayer + - ecr:DescribeRepositories + - ecr:ListImages + - ecr:DescribeImages + - ecr:BatchGetImage + - ecr:InitiateLayerUpload + - ecr:UploadLayerPart + - ecr:CompleteLayerUpload + - ecr:PutImage + Resource: !Sub "arn:aws:ecr:*:${AWS::AccountId}:repository/*" + OIDCRole: Type: AWS::IAM::Role Properties: From 65b13138f33ad45d9087cf1876a2154413763e96 Mon Sep 17 00:00:00 2001 From: Joseph H Kennedy Date: Wed, 24 Jun 2026 17:07:56 -0800 Subject: [PATCH 4/6] drop un-needed tempate bucket parameter and permissions; add rds permission --- cicd-stacks/JPL-deployment-policy-cf.yml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/cicd-stacks/JPL-deployment-policy-cf.yml b/cicd-stacks/JPL-deployment-policy-cf.yml index d6da6dbd2..a1f379bf8 100644 --- a/cicd-stacks/JPL-deployment-policy-cf.yml +++ b/cicd-stacks/JPL-deployment-policy-cf.yml @@ -1,10 +1,6 @@ AWSTemplateFormatVersion: 2010-09-09 Parameters: - TemplateBucketName: - Description: AWS S3 bucket name for uploading CloudFormation templates - Type: String - SourceRepositories: Type: CommaDelimitedList Default: repo:ASFHyP3/* @@ -65,6 +61,7 @@ Resources: - kms:* - lambda:* - logs:* + - rds:* - s3:* - secretsmanager:* - sns:* @@ -84,11 +81,6 @@ Resources: - iam:UntagInstanceProfile Resource: !Sub "arn:aws:iam::${AWS::AccountId}:instance-profile/account-managed/*" - - - Effect: Allow - Action: s3:PutObject - Resource: !Sub "arn:aws:s3:::${TemplateBucketName}/*" - - Effect: Allow Action: - cloudformation:SetStackPolicy From 1941b23d0c1b5f7f3c6e3a71bc0d2fc1b9c33b91 Mon Sep 17 00:00:00 2001 From: Joseph H Kennedy Date: Fri, 26 Jun 2026 17:25:01 -0800 Subject: [PATCH 5/6] changelog --- CHANGELOG.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4d979befd..2fb7ca86a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed - Parquet file products are now visible. +- `JPL-deployment-ci-cf.yml` now deploys a role to be assumed via OIDC by GitHub Actions, rather than a service user +- HyP3 deployments in the `delpoy-custom-test.yml` and `deploy-custom-prod.yml` workflows are now deployed via OIDC ### Fixed - The SrgGslc and SlimSAR compute environments have been upgraded to AL2023-based AMIs from AL2 AMIs due to the pending end-of-life of AL2. @@ -24,7 +26,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Added an option to force static file regeneration for the `ITS_LIVE_AUTORIFT` job type. ### Changed -- ASF-deployment-ci-cf.yml now deploys a role to be assumed via OIDC by Github Actions, rather than a service user +- `ASF-deployment-ci-cf.yml` now deploys a role to be assumed via OIDC by GitHub Actions, rather than a service user - `plus-test` and `plus-prod` environments are now deployed via OIDC ## [10.17.4] From 2b90b9dccf82f86e4233b06658a5bda92ff87f2b Mon Sep 17 00:00:00 2001 From: Joseph H Kennedy Date: Fri, 26 Jun 2026 17:31:30 -0800 Subject: [PATCH 6/6] changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2fb7ca86a..bd95fb220 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Added `FIRE_TRACK` job spec to `hyp3-ak-fire-safe`. - Added parameter `upload_to_db` to `AK_FIRE_SAFE` job spec. - Added environment variable `DB_HOST` to `AK_FIRE_SAFE` job spec. +- Added SQS and ECR permissions to `ASF-deployment-ci-cf.yml` for deploying HyP3-based monitoring stacks. ### Changed - Parquet file products are now visible.