Fix Android Device Farm OIDC sessions - #3444
Conversation
|
🔒 Security Review — View Report Please review before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3444 +/- ##
=======================================
Coverage 78.02% 78.02%
=======================================
Files 699 699
Lines 124589 124589
Branches 17286 17286
=======================================
+ Hits 97205 97208 +3
+ Misses 26516 26514 -2
+ Partials 868 867 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| devicefarm: DeviceFarmCiProps) -> iam.Role: | ||
|
|
||
| device_farm_role = iam.Role(scope, id, role_name=id, | ||
| assumed_by=iam.SessionTagsPrincipal(principal), |
There was a problem hiding this comment.
We should also set max_session_duration=Duration.hours(4) on the Device Farm role.
| max_session_duration=Duration.hours(4), |
| ) | ||
| }, | ||
| } | ||
|
|
There was a problem hiding this comment.
Direct OIDC assumption avoids the one-hour role-chaining limit, but it also bypasses the minimal OIDC role. Restrict this trust path to the one workflow that needs longer-lived Device Farm credentials.
device_farm_oidc_conditions = {
**github_actions_oidc_conditions,
"StringEquals": {
**github_actions_oidc_conditions["StringEquals"],
"token.actions.githubusercontent.com:workflow":
"android-omnibus",
},
}| principals=[ | ||
| iam.WebIdentityPrincipal( | ||
| self.oidc_provider.attr_arn, | ||
| github_actions_oidc_conditions, |
There was a problem hiding this comment.
Use device_farm_oidc_conditions instead.
| with: | ||
| role-to-assume: arn:aws:iam::${{ steps.env.outputs.aws_account_id }}:role/${{ inputs.oidcRole }} | ||
| role-session-name: ${{ github.run_id }}-${{ github.run_attempt }} | ||
| role-duration-seconds: ${{ inputs.roleDurationSeconds }} |
There was a problem hiding this comment.
Nit: roleDurationSeconds also applies to the chained role, but AWS caps chained sessions at 3600 seconds. Could we document that values above 3600 require roleName: ''?
3 participants
Context and motivation
Android Device Farm jobs can outlive the one-hour STS role-chaining limit. Their credentials then expire while jobs are queued or running, causing otherwise valid CI runs to fail.
Description of changes
roleNameis empty.pull_request_targetfor all target branches, while limiting push runs tomainandfips-*.Testing
yq.py_compile.sts:AssumeRoleWithWebIdentitystatement.No AWS deployment was performed from the development session.
Review considerations
The changes can be merged before the production trust policy lands. Android runs may temporarily fail until the normal CI pipeline deploys the production OIDC stack; those jobs can be rerun afterward. Sessions are static and still fail if queue plus execution time exceeds four hours.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.