configure-aws-credentials
cfn_nag
configure-aws-credentials | cfn_nag | |
---|---|---|
20 | 14 | |
2,287 | 1,220 | |
1.2% | 0.1% | |
9.4 | 0.0 | |
11 days ago | 9 months ago | |
TypeScript | Ruby | |
MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
configure-aws-credentials
-
CI/CI deploy a static website to AWS S3 bucket through Github Actions
The AWS configure-aws-credentials Github Action allows the connection to the AWS S3 bucket through an AWS Role. The configuration of this role is explained in the next chapter
-
How to Get Preview Environments for Every Pull Request
In this example, we'll be using the aws-actions/configure-aws-credentials action with GitHub's OIDC provider. Make sure the configured role has the required permissions.
-
Better GitHub AWS Secrets with OIDC
The first step is to set up GitHub Actions as a recognized identity provider in my AWS account. This is also called an "OIDC Trust" relationship. In AWS IAM, create an Identity Provider with GitHub's provider URL and Audience. I am using the open-source action configure-aws-credentials (link) which means I want to use an Audience value of sts.amazonaws.com. Be sure to click the "Get Thumbprint" button to save a copy of the x.509 certificate used by GitHub into the AWS identity provider.
-
Deployment github and aws, how to correctly use secrets?
You can use configure-aws-credentials Github aciton. Which is pretty good. Here is a blog post about it from AWS: https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/
-
AWS SSO & GitHub OpenID Connect Setup
We are now ready to utilize configure-aws-credentials within our GitHub Actions as we move onto deploying our code!
-
AssumeRoleWithWebIdentity WHAT?! Solving the Github to AWS OIDC InvalidIdentityToken Failure Loop
The AssumeRoleWithWebIdentity error manifests itself mostly around parallel access attempts, and how the various AWS interfaces are able to authenticate, as well as run and deploy services. We started encountering this issue when running our pipelines for deployment, and attempting to authenticate our Github account to AWS via the OIDC plugin. This is a well-known (and widely discussed) limitation for authentication to AWS for web application providers. In our case it was Github, but this is true for pretty much any web application integration.
- request critical feedback on the yaml for my first github action, please
-
Deploying to AWS from GitHub actions: is this something Fortune 500 security reviews will cry about?
What you are looking at is totally doable, you MUST use: https://github.com/aws-actions/configure-aws-credentials
-
Trending open source repositories on GitHub
AWS Actions: It's an open source project from AWS which the goal is to get easy to Configure AWS credential and region environment variables for use in other GitHub Actions.
-
App with self-contained infrastructure on AWS
In order to achieve this, AWS credentials need to be properly configured. Here we use a handy Github action called configure-aws-credential, from AWS itself. You can also read more about the many methods of authentication available. This step requires the AWS_REGION and AWS_ROLE_ARN secrets to be properly configured in the repo, both of which that should be shared by the platform team.
cfn_nag
-
Setting up my own landing zone on AWS
.pre-commit-config.yaml โ contains the cfn-lint and cfn_nag pre-commit hooks.
-
Guide to Serverless & Lambda Testing โ Part 2 โ Testing Pyramid
For generic CloudFormation templates, check CFN-NAG.
-
AWS Serverless Production Readiness Checklist
If you use CDK, you should implement CDK nag; otherwise, use cfn-nag.
-
Make your life easier using Makefiles
cfn_nag
-
Creating a Multi-Account CI/CD Pipeline with AWS CodePipeline
CodeBuild will run a linting check against the CloudFormation Template using cfn-lint and will then run cfn-nag to check for patterns that indicate insecure resources within the CloudFormation template.
-
App with self-contained infrastructure on AWS
Security checks for the Cloudformation stack using cfn-nag
-
Mastering AWS CDK Aspects
cdk-nag contains several Aspects to check your applications for best practices. It is especially useful if you need to be HIPAA-compliant or have other compliance requirements. It is inspired by cfn_nag which is a a tool checking for patterns in your CloudFormation templates.
-
how did you get good at iac-cloudformation
cfn-lint and cfn_nag or other tools of that nature to check as you write so you don't need to continually try to deploy only to find that you've done something dumb.
-
Source Control your AWS CloudFormation templates with GitHub
There is another tool called cfn_nag that can check your code for potentially any insecure infrastructure. When you read the documentation around this tool, the author says it can check for things such as:
-
Install cfn_nag on Windows
I recently wanted to use the cfn-nag tool on some templates I was writing but couldn't find any instructions to install on Windows, but I have found a way to do it.
What are some alternatives?
kubectl-aws-eks - A Github action for kubectl, the Kubernetes CLI
checkov - Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
buildkit - concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit
cfn-python-lint - CloudFormation Linter
setup-buildx-action - GitHub Action to set up Docker Buildx
SonarQube - Continuous Inspection
goss - Quick and Easy server testing/validation
aws-secure-environment-accelerator - The AWS Secure Environment Accelerator is a tool designed to help deploy and operate secure multi-account, multi-region AWS environments on an ongoing basis. The power of the solution is the configuration file which enables the completely automated deployment of customizable architectures within AWS without changing a single line of code.
actions - GitHub Action for Infracost. See cloud cost estimates for Terraform in pull requests. ๐ฐ๐ Love your cloud bill!
vscode-cloudformation-snippets - This extension adds snippets for all the AWS CloudFormation resources into Visual Studio Code.
s3-sync-action - ๐ GitHub Action to sync a directory with a remote S3 bucket ๐งบ
tfsec - Security scanner for your Terraform code