paultiq opened a new issue, #50899: URL: https://github.com/apache/arrow/issues/50899
### Describe the enhancement requested #### Summary Several crossbow workflows use sccache w/ S3 for build caching. They are currently configured to use long-lived access key / secret key pairs stored as github secrets. An alternative approach exists w/ temporary credentials: by registering GitHub's OIDC provider and assuming an AWS_ROLE_ARN that's been properly trusted. References: - AWS Well-architected Framework - Best Practices: [SEC02-BP02 Use temporary credentials](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_identities_unique.html) - sccache documentation: [S3 credentials](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials) #### Current State `compose.yaml`'s `x-sccache` anchor passes `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` through to the build containers, inherited from the runner environment: https://github.com/apache/arrow/blob/18146fc78784f482014780417aa5e2546cd76552/compose.yaml#L74-L75 In GitHub Actions, these come from repository secrets: long-term IAM user credentials / secret-access key pairs: https://github.com/apache/arrow/blob/18146fc78784f482014780417aa5e2546cd76552/dev/tasks/macros.jinja#L292-L293 #### Proposal: AssumeRoleWithWebIdentity w/ AWS_ROLE_ARN By assuming the AWS_ROLE_ARN, the sccache session relies on credentials that expire\*, issued only to workflows in the trusted repository, and scoped to the sccache bucket. This requires a few things: - create a role in IAM with the bucket and object level permissions, - trust the github oidc-provider, - define AWS_ROLE_ARN and set id-token permission - grant sts:AssumeRoleWithWebIdentity for the specific repositories or organization. - pass AWS_SESSION_TOKEN - add a `aws-actions/configure-aws-credentials@v4` step to the workflow. \* default is 1 hour, configurable Reference: [Use IAM roles to connect GitHub Actions to actions in AWS](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/) ### Component(s) Continuous Integration -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
