Setting up the Technical GitHub Actions IAM User

[Partyschaum]

Setting up the Technical GitHub Actions IAM User

[BjoernKW]

Thanks for the feedback! Could you please try and use these AWS-managed policies instead?

• AmazonEC2FullAccess
• AmazonECS_FullAccess
• AWSLambda_FullAccess
• AWSCloudFormationFullAccess
• AmazonCognitoPowerUser

The AWS-managed AmazonEC2ContainerServiceFullAccess policy has been phased out (see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-iam-awsmanpol-amazonecs-full-access-migration.html )

Both Permissive_CloudFormation_permissions and Manage_Cognito_user_pools are custom policies we've set up ourselves (and which therefore won't work out of the box; so, thanks again for notifying us about this issue). The default AWS policies mentioned above are somewhat more permissive in that they allow actions which are probably not required by our setup, but they're easier to get started with than by setting up those custom policies in the IAM console individually.

I know this runs against the principle of least privilege. Hence, we'll consider describing these more restrictive permission sets in a future edition of the ebook. Anyway, the next minor release of the ebook will contain a modified list of policies including the ones mentioned above.

[Partyschaum]

Thank you so much for the fast response. 💚 🚀

It works now. 👍

[Partyschaum]

Moin,

I just wanted to give you additional feedback on this. Today I tried to push images to my private ECR repository and got An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::***:user/github is not authorized to perform: ecr:GetAuthorizationToken on resource: * because no identity-based policy allows the ecr:GetAuthorizationToken action.

After some google-foo I found an example on Accessing One Amazon ECR Repository which I then applied to the CF stack for my GitHub user. I'm not sure if those rights are too broad but it made the login and pushing images to the private ECR repository finally possible.

Maybe you want to add this to the next minor release of the ebook too. 👍

    val managedGroupPolicies = listOf(
        "AmazonEC2FullAccess",
        "AmazonECS_FullAccess",
        "AmazonCognitoPowerUser",
        "AWSCloudFormationFullAccess",
        "AWSLambda_FullAccess",
    ).map { ManagedPolicy.fromAwsManagedPolicyName(it) }

    val gitHubActionsGroup = Group(
        gitHubActionsStack,
        "GitHubActionsGroup",
        GroupProps.builder()
            .groupName(gitHubActionsGroupName)
            .managedPolicies(managedGroupPolicies)
            .build()
    ).also {
        it.addToPolicy(
            PolicyStatement.Builder.create()
                .sid("GetAuthorizationToken")
                .effect(Effect.ALLOW)
                .actions(listOf("ecr:GetAuthorizationToken"))
                .resources(listOf("*"))
                .build()
        )
        it.addToPolicy(
            PolicyStatement.Builder.create()
                .sid("ListImagesInRepository")
                .effect(Effect.ALLOW)
                .actions(listOf("ecr:ListImages"))
                .resources(listOf("*"))
                .build()
        )
        it.addToPolicy(
            PolicyStatement.Builder.create()
                .sid("ManageRepositoryContents")
                .effect(Effect.ALLOW)
                .actions(
                    listOf(
                        "ecr:BatchCheckLayerAvailability",
                        "ecr:GetDownloadUrlForLayer",
                        "ecr:GetRepositoryPolicy",
                        "ecr:DescribeRepositories",
                        "ecr:ListImages",
                        "ecr:DescribeImages",
                        "ecr:BatchGetImage",
                        "ecr:InitiateLayerUpload",
                        "ecr:UploadLayerPart",
                        "ecr:CompleteLayerUpload",
                        "ecr:PutImage",
                    )
                )
                .resources(listOf("*"))
                .build()
        )
    }

    val gitHubActionsUser = User(
        gitHubActionsStack,
        "GitHubActionsUser",
        UserProps.builder()
            .userName(gitHubActionsUserName)
            .managedPolicies(managedGroupPolicies)
            .groups(listOf(gitHubActionsGroup))
            .build()
    )

[BjoernKW]

Thanks for the additional feedback! The ecr:GetAuthorizationToken permissions is part of the AmazonEC2ContainerRegistryFullAccess policy, which I didn't mention in my comment (but which is listed in the appendix of the ebook).