paultiq opened a new pull request, #51028: URL: https://github.com/apache/arrow/pull/51028
### Rationale for this change This PR moves crossbow builds to short-lived S3 credentials from long-lived ACCESS_KEY/SECRET_KEYs. It does this via GitHub's OIDC provider and an AWS ROLE_ARN with a trust relationship configured. This configuration is detailed here: - [Use IAM roles to connect GitHub Actions to actions in AWS](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/) The benefits of short-lived / temporary credentials discussed further here: [AWS Well-architected Framework Best Practices SEC02-BP02 Use temporary credentials](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_identities_unique.html) sccache supports a variety of S3 creds: [S3 credentials](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials) ### What changes are included in this PR? Use [AssumeRoleWithWebIdentity](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials) for sccache S3 credentials. By assuming the AWS_ROLE_ARN, the sccache session relies on credentials that expire\*, issued only to workflows in the trusted repository, and scoped to the sccache bucket. Specific tasks: - create a role in IAM with the bucket and object level permissions, - trust the github oidc-provider, - define AWS_ROLE_ARN and set id-token permission - grant sts:AssumeRoleWithWebIdentity for the specific repositories or organization. - pass AWS_SESSION_TOKEN - add a `aws-actions/configure-aws-credentials@v4` step to the workflow. Separately, someone will need to add the role and trust to AWS: - Procedure is in https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/ - Set a "Maximum session duration" to maximum runtime of any job... maybe 4 hours? 8 hours? - Permissions: Role needs BucketLevel and ObjectLevels permissions to the bucket. I can share an example if needed. ### Are these changes tested? Yes, locally and on a fork. ### Are there any user-facing changes? No -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
