Do not recommend creating long lived credentials for Github Actions about grunge-stack

[tbeseda]

cc @tbeseda, could you verify this will work for Arc?

Hey, yeah this definitely works 👍
I created a test repo here https://github.com/tbeseda/arc-gha-aws-oidc
The deployed app is live here https://b5haybpklc.execute-api.us-west-2.amazonaws.com/ (not Remix, just a Node fn)

Easier is definitely better :)

This approach is great, IMO. but I'm not sure how to express the process to the developer. It involves creating a couple IAM resources; probably easiest to do by deploying a CloudFormation stack (like @thdxr's example above), which can be done from the AWS Console or with the aws CLI.
I'll talk to folks on the Arc team to see how this step could be streamlined for a grunge-stack user.

[kentcdodds]

That's great! Easier is definitely better :)

cc @tbeseda, could you verify this will work for Arc?

I'd definitely be open to a PR for this if it works well :)

[simonireilly]

I took the approach of setting up a one-time GitHub actions job in the repo that performs the bootstrapping.

The solution looks something like this.

1. Create a new project with grunge-stack, the GitHub workflow is already there.
2. Trigger the workflow manually by entering credentials that have privileges to create OIDC providers.
3. Use the role to assume the creds in the deploy actions

Source: https://dev.to/simonireilly/secure-aws-cdk-deployments-with-github-actions-3jfk

I've done so with the AWS CDK but that just makes cloudformation under the hood 👍

[thdxr]

I considered a PR but I imagine you'd want to would want to figure out how to do some of this stuff automatically (and should maybe be handled in arc?) so figured I'd leave it up to you all for design

[github-actions]

This issue has been automatically marked stale because we haven't received a response from the original author in a while 🙈. This automation helps keep the issue tracker clean from issues that are not actionable. Please reach out if you have more information for us or you think this issue shouldn't be closed! 🙂 If you don't do so within 7 days, this issue will be automatically closed.

[github-actions]

This issue has been automatically closed because we didn't hear anything from the original author after the previous notice.