Use OpenID Connect to deploy to ECR public (#371)

seqsense · Jun 29, 2022 · 397a7cb · 397a7cb
1 parent e148ccc
commit 397a7cb
Showing 1 changed file with 13 additions and 5 deletions.
diff --git a/.github/workflows/tunnel-server.yaml b/.github/workflows/tunnel-server.yaml
@@ -12,6 +12,10 @@ on:
 jobs:
   tunnel-server:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
     steps:
       - name: Set image tag
         if: startsWith(github.ref, 'refs/tags/v')
@@ -42,13 +46,17 @@ jobs:
           docker push ${image}:latest
           docker logout ghcr.io
 
-      - name: Login to ECR public
+      - name: Configure AWS credentials
         if: startsWith(github.ref, 'refs/tags')
-        uses: docker/login-action@v2
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          role-to-assume: arn:aws:iam::610248501808:role/ci/GitHubActions-aws-iot-device-sdk-go
+          aws-region: us-east-1
+      - name: Login to Amazon ECR Public
+        if: startsWith(github.ref, 'refs/tags')
+        uses: aws-actions/amazon-ecr-login@v1
         with:
-          registry: public.ecr.aws
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          registry-type: public
       - name: Push to ECR public
         if: startsWith(github.ref, 'refs/tags')
         run: |