Security: migrate workflows from static AWS keys to OIDC

.github/executions/fp_ds_test_execution_arm.json

@@ -31,7 +31,11 @@
         "Tags": [
             {
                 "Key"   : "Name",
-                "Value" : "arm_docker_buildNtester"
+                "Value" : "ci_fp_integration_test_arm"
+            },
+            {
+                "Key"   : "Project",
+                "Value" : "ci_fp_integration_test_arm"
             }
         ]
     }

.github/executions/fp_push_execution_arm.json

@@ -35,7 +35,11 @@
         "Tags": [
             {
                 "Key"   : "Name",
-                "Value" : "arm_docker_buildNtester"
+                "Value" : "ci_fp_build_push_arm"
+            },
+            {
+                "Key"   : "Project",
+                "Value" : "ci_fp_build_push_arm"
             }
         ]
     }

.github/workflows/build_push_fp.yaml

@@ -34,6 +34,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
   security-events: write
 
@@ -132,12 +133,13 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Configure AWS
-      run: |
-        aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        aws configure set region us-east-1
-
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+        aws-region: us-east-1
+
+
     - name: Build docker containers
       run: |
           if [ "${{ needs.detect-changes.outputs.build_deps }}" == "true" ]; then
@@ -214,11 +216,11 @@ jobs:
         uses: actions/checkout@v4
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1        
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
 
       # Dynamically configures the test execution JSON by setting the branch name and conditionally removing Docker build commands for containers whose Dockerfiles haven't changed (optimization only applies to push events, not manual triggers)
       - name: Prepare execution config

.github/workflows/build_test_fp_arm.yaml

@@ -22,6 +22,7 @@ on:
       - 'setup.cfg'
       - '.python-version'
 permissions:
+  id-token: write
   contents: read
   security-events: write
 
@@ -39,11 +40,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
 
       - name: Build forcingprocessor-deps
         run: |
@@ -181,14 +182,21 @@ jobs:
           done
 
 
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Run ${{ matrix.test-suite.name }}
         run: |
           docker run --rm \
             -v $(pwd):/forcingprocessor \
             -w /forcingprocessor \
             -e AWS_REGION=us-east-1 \
-            -e AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }} \
-            -e AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }} \
+            -e "AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }}" \
+            -e "AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }}" \
+            -e "AWS_SESSION_TOKEN=${{ env.AWS_SESSION_TOKEN }}" \
             awiciroh/${{ matrix.test-suite.image }}:latest-arm64 \
             ${{ matrix.test-suite.command }}
 

.github/workflows/build_test_fp_x86.yaml

@@ -24,6 +24,7 @@ on:
 
 
 permissions:
+  id-token: write
   contents: read
   security-events: write
 
@@ -40,11 +41,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
 
       - name: Build forcingprocessor-deps
         run: |
@@ -179,14 +180,21 @@ jobs:
           done
 
 
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Run ${{ matrix.test-suite.name }}
         run: |
           docker run --rm \
             -v $(pwd):/forcingprocessor \
             -w /forcingprocessor \
             -e AWS_REGION=us-east-1 \
-            -e AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }} \
-            -e AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }} \
+            -e "AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }}" \
+            -e "AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }}" \
+            -e "AWS_SESSION_TOKEN=${{ env.AWS_SESSION_TOKEN }}" \
             awiciroh/${{ matrix.test-suite.image }}:latest-x86 \
             ${{ matrix.test-suite.command }}
 

.github/workflows/forcingprocessor_nrds.yaml

@@ -24,6 +24,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
 jobs:
   test-forcingprocessor:
@@ -41,12 +42,12 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1           
-          
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/forcingprocessor_output_opts.yaml

@@ -24,6 +24,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
 jobs:
   test-forcingprocessor:
@@ -41,12 +42,12 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1           
-          
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/forcingprocessor_plotting.yaml

@@ -24,6 +24,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
 jobs:
   test-forcingprocessor:
@@ -41,12 +42,12 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1           
-          
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/forcingprocessor_sources_nomads.yaml

@@ -24,6 +24,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
 jobs:
   test-forcingprocessor:
@@ -41,12 +42,12 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1           
-          
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/forcingprocessor_sources_nwm_aws.yaml

@@ -24,6 +24,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
 jobs:
   test-forcingprocessor:
@@ -41,11 +42,11 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1           
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
 
       - name: Install dependencies
         run: |

.github/workflows/forcingprocessor_sources_nwm_google.yaml

@@ -24,6 +24,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
 jobs:
   test-forcingprocessor:
@@ -41,12 +42,12 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1           
-          
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/forcingprocessor_weights.yaml

@@ -24,6 +24,7 @@ on:
       - '.python-version'
 
 permissions:
+  id-token: write
   contents: read
 jobs:
   test-forcingprocessor:
@@ -41,12 +42,12 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1           
-          
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/integration_fp_ds_arm64.yaml

@@ -43,10 +43,11 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  id-token: write
   contents: read
   security-events: write
 
-jobs:    
+jobs:
   build-test-docker-arm:
     runs-on: ubuntu-latest
     steps:
@@ -56,11 +57,11 @@ jobs:
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_wrapper: false
-      - name: Configure AWS
-        run: |
-          aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws configure set region us-east-1        
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: us-east-1
 
       # Dynamically configures the test execution JSON by setting the branch name and conditionally removing Docker build commands for containers whose Dockerfiles haven't changed (optimization only applies to push events, not manual triggers)
       - name: Prepare execution config