From 1ac8a300b94811050f322bc1b8d7e23b67f6775e Mon Sep 17 00:00:00 2001 From: Jack Green Date: Thu, 28 May 2026 10:39:06 +0100 Subject: [PATCH] Rescope AWS ARN from `secret` to `var` The name of the role isn't a `secret`, so storing at such means it's masked logs etc which makes debugging difficult. More specifically, authentication is handled via [OIDC](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws), on it's own the role does nothing. Instead, it should be rescoped as a `var`. --- .github/workflows/coverage_runner.yml | 2 +- .github/workflows/nightly_runner.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/coverage_runner.yml b/.github/workflows/coverage_runner.yml index af18c09804..b0ae090124 100644 --- a/.github/workflows/coverage_runner.yml +++ b/.github/workflows/coverage_runner.yml @@ -79,7 +79,7 @@ jobs: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v5 with: - role-to-assume: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }} + role-to-assume: ${{ vars.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }} aws-region: 'us-east-1' - name: Get Secrets diff --git a/.github/workflows/nightly_runner.yml b/.github/workflows/nightly_runner.yml index 64d2351743..ee3dd75e01 100644 --- a/.github/workflows/nightly_runner.yml +++ b/.github/workflows/nightly_runner.yml @@ -36,7 +36,7 @@ jobs: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v5 with: - role-to-assume: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }} + role-to-assume: ${{ vars.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }} aws-region: 'us-east-1' - name: Get Secrets uses: aws-actions/aws-secretsmanager-get-secrets@v2 @@ -46,7 +46,7 @@ jobs: - uses: hazelcast/docker-actions/get-jfrog-credentials@master id: jfrog with: - aws-role-to-assume: ${{ secrets.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }} + aws-role-to-assume: ${{ vars.AWS_HAZELCAST_OIDC_GITHUB_ACTIONS_ROLE_ARN }} jfrog-oidc-provider-name: ${{ github.repository_owner }}-snapshot-internal - name: Run tests env: