terraform-iam: configure OIDC for NixOS/nix releases#879
Conversation
zimbatm
force-pushed
the
nix-releases-oidc
branch
from
2783814 to
bcdf931
Compare
|
|
||
| locals { | ||
| administrator_role_pattern = format( | ||
| "arn:aws:iam::%s:role/aws-reserved/sso.amazonaws.com/%s/AWSReservedSSO_AWSAdministratorAccess_*", |
There was a problem hiding this comment.
Side-comment: we probably wanna have a separate IAM Identity Center Role that is not AWSAdministratorAccess for this. Maybe NixReleases or something? Then we can give the nix people access to the AWS account for manual releases without giving them admin access to the AWS account
There was a problem hiding this comment.
💯 I was just looking into that. Then I went down the rabbit hole of configuring the management account with terraform as well.
There was a problem hiding this comment.
Done. I will do the other side in a follow-up PR.
zimbatm
force-pushed
the
nix-releases-oidc
branch
2 times, most recently
from
f184e71 to
7bf8533
Compare
zimbatm
force-pushed
the
nix-releases-oidc
branch
from
7bf8533 to
79e18ba
Compare
|
Okay so this should work in theory :-D The changes were applied so I'm going to merge this. Most likely we will need follow-up PRs. |
|
Ok it works on the other side |
|
@zimbatm I've enabled branch protection rules for the |
|
Seems blocked on a check that is pending. I enabled auto merge ages ago. Not sure what's up. Lemme update branch |
4 participants
Make it possible to publish releases from the NixOS/nix repo.
This requires creating a "releases" environment on the Nix repo. And then wiring up GitHub Actions to publish the releases on trigger.