search

nextstrain / zika

Nextstrain build for Zika virus
https://nextstrain.org/zika
8 stars 10 forks source link

Switch AWS credentials from a long-lived IAM user to short-lived role sessions #59

Closed tsibley closed 5 months ago

tsibley commented 5 months ago

I'll also be removing the corresponding repository secrets.

Related-to: https://github.com/nextstrain/private/issues/110

Checklist

tsibley commented 5 months ago

Deleted secrets… test run of "ingest to phylo" succeeded, including with some S3 interaction, but not with an actual upload nor phylo run as there was no new data.

tsibley commented 5 months ago

Manually cleared the GitHub Actions cache key used by "check new data" and re-ran. Still no new upload from ingest (because same content hash), but phylo is now running and will upload datasets, run invalidations, etc. … It failed with an AWS access error that I thought I'd taken care of…

botocore.errorfactory.AccessDenied: An error occurred (AccessDenied) when calling the ListDistributions operation: User: arn:aws:sts::827581582529:assumed-role/GitHubActionsRoleNextstrainRepo@zika/GitHubActions is not authorized to perform: cloudfront:ListDistributions because no identity-based policy allows the cloudfront:ListDistributions action

but I guess I did something wrong.

tsibley commented 5 months ago

Phylo job was successful in last test run after fixing a couple errors with the CloudFront permissions in https://github.com/nextstrain/infra/pull/13.

tsibley commented 5 months ago

Merging this since the removal of repository secrets means they won't be available on main anyway.