Replace AWS keys with IAM role #6007
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose of this pull request
This pull request updates the production deploy workflow by replacing the AWS access/secret keys with an IAM role. The workflow needs access to AWS to allow the GitHub to trigger the site deployment pipeline in Marketing's Jenkins server.
This change in credentials was requested by IT, to follow best practices. The request is included in the Asana linked below.
The IAM role has been tested for use in the free trial deployment workflows, which mirror the workflows in this repository. Because the IAM role is only used when deploying to production, it cannot be tested with the staging environment. Therefore, I recommend this PR be merged at a time when we can immediately follow up with a PR that deploys new content, to ensure the workflow runs successfully.
The change requires a new secret,
WEBOPS_AWS_ROLE_JENKINS, which has already been configured.Once this PR is merged, the
WEBOPS_AWS_ACCESS_KEYandWEBOPS_AWS_SECRET_KEYshould be removed from the repo and removed from the Marketing AWS account. I'll take that action once we confirm the workflow runs successfully.Select the type of change
Ticket (if applicable)
Asana