configure-aws-credentials VS s3-sync-action

The AWS configure-aws-credentials Github Action allows the connection to the AWS S3 bucket through an AWS Role. The configuration of this role is explained in the next chapter

In this example, we'll be using the aws-actions/configure-aws-credentials action with GitHub's OIDC provider. Make sure the configured role has the required permissions.

The first step is to set up GitHub Actions as a recognized identity provider in my AWS account. This is also called an "OIDC Trust" relationship. In AWS IAM, create an Identity Provider with GitHub's provider URL and Audience. I am using the open-source action configure-aws-credentials (link) which means I want to use an Audience value of sts.amazonaws.com. Be sure to click the "Get Thumbprint" button to save a copy of the x.509 certificate used by GitHub into the AWS identity provider.

You can use configure-aws-credentials Github aciton. Which is pretty good. Here is a blog post about it from AWS: https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/

We are now ready to utilize configure-aws-credentials within our GitHub Actions as we move onto deploying our code!

The AssumeRoleWithWebIdentity error manifests itself mostly around parallel access attempts, and how the various AWS interfaces are able to authenticate, as well as run and deploy services. We started encountering this issue when running our pipelines for deployment, and attempting to authenticate our Github account to AWS via the OIDC plugin. This is a well-known (and widely discussed) limitation for authentication to AWS for web application providers. In our case it was Github, but this is true for pretty much any web application integration.

What you are looking at is totally doable, you MUST use: https://github.com/aws-actions/configure-aws-credentials

AWS Actions: It's an open source project from AWS which the goal is to get easy to Configure AWS credential and region environment variables for use in other GitHub Actions.

In order to achieve this, AWS credentials need to be properly configured. Here we use a handy Github action called configure-aws-credential, from AWS itself. You can also read more about the many methods of authentication available. This step requires the AWS_REGION and AWS_ROLE_ARN secrets to be properly configured in the repo, both of which that should be shared by the platform team.

I cannot ignore the fact that I am an AWS Community Builder, so it was a no-brainer that I would implement this on AWS. Registering a domain and setting it up on Route 53 was the first step. Then I looked at the possibilities of hosting. The site is written in Jeklly and each page is generated separately. Using GitHub Actions, I can regenerate the static pages every time there is a new commit. Hosting a static website on AWS isn’t rocket science. S3 static file hosting is a cheap and easy way. I just needed to find a way how to publish my files to S3. Jake Jarvis created a GitHub Action that can sync your files to S3. All you have to do is to create the appropriate IAM permissions and your files will be pushed to the S3 bucket of your choice. From there, AWS will do the rest. I have created a CloudFront distribution to get HTTPS and fast access from Hungary. Currently there is no AWS region in Hungary, but there is an edge location in Budapest, so serving the site from there gives fast access to Hungarian users. 🔥🔥🔥

I mean.. I would probably just have used https://github.com/marketplace/actions/s3-sync :)

I would consider sending the UI build files to S3 using either cloud formation or Github Actions. For the backend, sounds like a docker container could serve you well and cloudformation or Github Actions can handle this.

The action in GitHub is the following (as per instructions here : https://github.com/jakejarvis/s3-sync-action )

You can deploy your frontend build to S3, then point your domain to these files, for example with CloudFlare or Route53. We use a Github action to publish these for each deploy. This makes the frontend and backend effectively two different services.

Git hub actions pushes the source code to my S3 bucket the moment they are pushed to my git repository using a git actions. Git action: https://github.com/jakejarvis/s3-sync-action