Skip to content

Commit f37af93

Browse files
leandrodamascenaleandrodamascena
authored
Merge branch 'develop' into custom_mask
2 parents bbffca8 + 27737cf commit f37af93

File tree

26 files changed

+791
-544
lines changed

26 files changed

+791
-544
lines changed

‎.github/workflows/bootstrap_region.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
name: Region Bootstrap
2+
13
# bootstraps new regions
24
#
35
# PURPOSE
@@ -27,7 +29,6 @@ on:
2729
required: true
2830
description: AWS region to bootstrap (i.e. eu-west-1)
2931

30-
name: Region Bootstrap
3132
run-name: Region Bootstrap ${{ inputs.region }}
3233

3334
permissions:
@@ -38,13 +39,13 @@ jobs:
3839
name: Install CDK
3940
runs-on: ubuntu-latest
4041
permissions:
41-
contents: write
42+
contents: read
4243
id-token: write
4344
environment: layer-${{ inputs.environment }}
4445
steps:
4546
- id: credentials
4647
name: AWS Credentials
47-
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502
48+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
4849
with:
4950
aws-region: ${{ inputs.region }}
5051
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
@@ -69,7 +70,7 @@ jobs:
6970
name: Copy Layers
7071
runs-on: ubuntu-latest
7172
permissions:
72-
contents: write
73+
contents: read
7374
id-token: write
7475
strategy:
7576
matrix:
@@ -90,7 +91,7 @@ jobs:
9091
steps:
9192
- id: credentials
9293
name: AWS Credentials
93-
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502
94+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
9495
with:
9596
aws-region: us-east-1
9697
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
@@ -106,4 +107,4 @@ jobs:
106107
run: go install github.com/aws-powertools/actions/layer-balancer/cmd/balance@latest
107108
- id: run-balance
108109
name: Run Balance
109-
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role ${{ secrets.BALANCE_ROLE_ARN }} -layer-name ${{ matrix.layer }} -dry-run=false
110+
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role ${{ secrets.BALANCE_ROLE_ARN }} -layer-name ${{ matrix.layer }} -dry-run=false

‎.github/workflows/dispatch_analytics.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,11 @@ jobs:
4343
statuses: read
4444
steps:
4545
- name: Configure AWS credentials
46-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
46+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
4747
with:
4848
aws-region: eu-central-1
49-
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}
49+
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
50+
mask-aws-account-id: true
5051

5152
- name: Invoke Lambda function
5253
run: |

‎.github/workflows/layer_govcloud.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
name: Layer Deployment (GovCloud)
2+
13
# GovCloud Layer Publish
24
# ---
35
# This workflow publishes a specific layer version in an AWS account based on the environment input.
@@ -32,9 +34,11 @@ on:
3234
type: string
3335
required: true
3436

35-
name: Layer Deployment (GovCloud)
3637
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
3738

39+
permissions:
40+
contents: read
41+
3842
jobs:
3943
download:
4044
runs-on: ubuntu-latest

‎.github/workflows/layer_govcloud_python313.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
name: Layer Deployment (GovCloud) - Temporary for Python 3.13
2+
13
# GovCloud Layer Publish
24
# ---
35
# This workflow publishes a specific layer version in an AWS account based on the environment input.
@@ -32,9 +34,11 @@ on:
3234
type: string
3335
required: true
3436

35-
name: Layer Deployment (GovCloud) - Temporary for Python 3.13
3637
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
3738

39+
permissions:
40+
contents: read
41+
3842
jobs:
3943
download:
4044
runs-on: ubuntu-latest

‎.github/workflows/publish_v3_layer.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -303,8 +303,8 @@ jobs:
303303
needs: [update_v3_layer_arn_docs, prepare_docs_alias]
304304
permissions:
305305
# lower privilege propagated from parent workflow (release.yml)
306-
contents: write
307-
pages: write
306+
#contents: write
307+
#pages: write
308308
pull-requests: none
309309
id-token: write
310310
secrets: inherit

‎.github/workflows/quality_check.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
with:
6161
python-version: ${{ matrix.python-version }}
6262
- name: Install dependencies
63-
run: make dev
63+
run: make dev-quality-code
6464
- name: Formatting and Linting
6565
run: make lint
6666
- name: Static type checking

‎.github/workflows/reusable_deploy_v2_layer_stack.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,11 +152,12 @@ jobs:
152152

153153
- name: Install poetry
154154
run: pipx install git+https://github.com/python-poetry/poetry@68b88e5390720a3dd84f02940ec5200bfce39ac6 # v1.5.0
155-
- name: aws credentials
156-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
155+
- name: Configure AWS Credentials
156+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
157157
with:
158158
aws-region: ${{ matrix.region }}
159159
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
160+
mask-aws-account-id: true
160161
- name: Setup Node.js
161162
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
162163
with:

‎.github/workflows/reusable_deploy_v2_sar.yml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -89,19 +89,19 @@ jobs:
8989
integrity_hash: ${{ inputs.source_code_integrity_hash }}
9090
artifact_name: ${{ inputs.source_code_artifact_name }}
9191

92-
93-
- name: AWS credentials
94-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
92+
- name: Configure AWS credentials
93+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
9594
with:
9695
aws-region: ${{ env.AWS_REGION }}
9796
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
97+
mask-aws-account-id: true
9898

99-
# NOTE
100-
# We connect to Layers account to log our intent to publish a SAR Layer
101-
# we then jump to our specific SAR Account with the correctly scoped IAM Role
102-
# this allows us to have a single trail when a release occurs for a given layer (beta+prod+SAR beta+SAR prod)
99+
# NOTE
100+
# We connect to Layers account to log our intent to publish a SAR Layer
101+
# we then jump to our specific SAR Account with the correctly scoped IAM Role
102+
# this allows us to have a single trail when a release occurs for a given layer (beta+prod+SAR beta+SAR prod)
103103
- name: AWS credentials SAR role
104-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
104+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
105105
id: aws-credentials-sar-role
106106
with:
107107
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
@@ -110,6 +110,8 @@ jobs:
110110
role-duration-seconds: 1200
111111
aws-region: ${{ env.AWS_REGION }}
112112
role-to-assume: ${{ secrets.AWS_SAR_V2_ROLE_ARN }}
113+
mask-aws-account-id: true
114+
113115
- name: Setup Node.js
114116
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
115117
with:

‎.github/workflows/reusable_deploy_v3_layer_stack.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,11 +154,12 @@ jobs:
154154

155155
- name: Install poetry
156156
run: pipx install git+https://github.com/python-poetry/poetry@68b88e5390720a3dd84f02940ec5200bfce39ac6 # v1.5.0
157-
- name: aws credentials
158-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
157+
- name: Configure AWS credentials
158+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
159159
with:
160160
aws-region: ${{ matrix.region }}
161161
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
162+
mask-aws-account-id: true
162163
- name: Setup Node.js
163164
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
164165
with:

‎.github/workflows/reusable_deploy_v3_sar.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,18 +86,19 @@ jobs:
8686
artifact_name: ${{ inputs.source_code_artifact_name }}
8787

8888

89-
- name: AWS credentials
90-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
89+
- name: Configure AWS credentials
90+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
9191
with:
9292
aws-region: ${{ env.AWS_REGION }}
9393
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
94+
mask-aws-account-id: true
9495

9596
# NOTE
9697
# We connect to Layers account to log our intent to publish a SAR Layer
9798
# we then jump to our specific SAR Account with the correctly scoped IAM Role
9899
# this allows us to have a single trail when a release occurs for a given layer (beta+prod+SAR beta+SAR prod)
99100
- name: AWS credentials SAR role
100-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
101+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
101102
id: aws-credentials-sar-role
102103
with:
103104
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
@@ -106,6 +107,7 @@ jobs:
106107
role-duration-seconds: 1200
107108
aws-region: ${{ env.AWS_REGION }}
108109
role-to-assume: ${{ secrets.AWS_SAR_V2_ROLE_ARN }}
110+
mask-aws-account-id: true
109111
- name: Setup Node.js
110112
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
111113
with:

0 commit comments

Comments
 (0)