在S3 OIDC中找不到GitHub后端的有效凭证源

Question

我正与GitHub一起登录到AWS并部署我们的terraform代码，我被困在terraform init上，互联网上的大多数解决方案都指向删除凭据文件或显式提供凭据，我不能这样做，因为OIDC不存在凭据文件，而且我也不希望在后端模块中显式地提供Access_key和Secret_ID，因为这可能会导致安全风险，下面是我的Github部署文件：

name: AWS Terraform Plan & Deploy

on:
  push:
    paths:
      - "infrastructure/**"
    # branches-ignore:
    #   - '**'
  pull_request:

env:
  tf_actions_working_dir: infrastructure/env/dev-slb-alpha/dev
  tf_actions_working_dir_prod: infrastructure/env/prod-slb-prod/prod
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  TF_WORKSPACE: "default"
  TF_ACTION_COMMENT: 1
  plan: "plan.tfplan"
  BUCKET_NAME : "slb-dev-terraform-state"
  AWS_REGION : "us-east-1"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - run: sleep 5 # there's still a race condition for now
      - name: Clone Repository (Latest)
        uses: actions/checkout@v2
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
         aws-region: us-east-1
         role-to-assume: arn:aws:iam::262267462662:role/slb-dev-github-actions-role
         role-session-name: GithubActionsSession

      # - name: Configure AWS
      #   run: |
      #     export AWS_ROLE_ARN=arn:aws:iam::262267462662:role/slb-dev-github-actions-role
      #     # export AWS_WEB_IDENTITY_TOKEN_FILE=/tmp/awscreds
      #     export AWS_DEFAULT_REGION=us-east-1

      #     # echo AWS_WEB_IDENTITY_TOKEN_FILE=$AWS_WEB_IDENTITY_TOKEN_FILE >> $GITHUB_ENV
      #     echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
      #     echo AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION >> $GITHUB_ENV
      - run: aws sts get-caller-identity

  setup:
    runs-on: ubuntu-latest
    environment:
      name: Dev
      url: https://dev.test.com
    name: checkov-action-dev
    steps:
      - name: Checkout repo
        uses: actions/checkout@master
        with:
          submodules: 'true'
#       - name: Add Space to Dev
#         run: |
#           sysconfig -r proc exec_disable_arg_limit=1
#         shell: bash

      - name: Run Checkov action
        run: |
          pip3 install checkov
          checkov --directory /infrastructure
        id: checkov
#         uses: bridgecrewio/checkov-action@master
#         with:
#          directory: infrastructure/
         #skip_check: CKV_AWS_1
#          quiet: true
#          soft_fail: true
         #framework: terraform

  tfsec:
    name: tfsec
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      # - name: Terraform security scan
      #   uses: aquasecurity/tfsec-pr-commenter-action@v0.1.10
      #   env:
      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: tfsec
        uses: tfsec/tfsec-sarif-action@master
        with:
          # sarif_file: tfsec.sarif
          github_token: ${{ secrets.INPUT_GITHUB_TOKEN }}

      # - name: Upload SARIF file
      #   uses: github/codeql-action/upload-sarif@v1
      #   with:
      #     sarif_file: tfsec.sarif

  superlinter:
    name: superlinter
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Scan Code Base
        # uses: github/super-linter@v4
        # env:
        #   VALIDATE_ALL_CODEBASE: false
        #   # DEFAULT_BRANCH: master
        #   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        #   VALIDATE_TERRAFORM_TERRASCAN: false
        uses: terraform-linters/setup-tflint@v1
        with:
          tflint_version: v0.29.0

  terrascan:
    name: terrascan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Run Terrascan
        id: terrascan
        uses: accurics/terrascan-action@v1
        with:
          iac_type: "terraform"
          iac_version: "v15"
          policy_type: "aws"
          only_warn: true
          #iac_dir:
          #policy_path:
          #skip_rules:
          #config_path:

  terraform:
    defaults:
      run:
        working-directory: ${{ env.tf_actions_working_dir}}

    name: "Terraform"
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Clone Repository (Latest)
        uses: actions/checkout@v2
        if: github.event.inputs.git-ref == ''
      - name: Clone Repository (Custom Ref)
        uses: actions/checkout@v2
        if: github.event.inputs.git-ref != ''
        with:
          ref: ${{ github.event.inputs.git-ref }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1
        with:
          terraform_version: 1.1.2

      - name: Terraform Format
        id: fmt
        run: terraform fmt -check

      - name: Terraform Init
        id: init
        run: |
          # # cat ~/.aws/crendentials
          # # export AWS_PROFILE=pki-aws-informatics
          # aws configure list-profiles
          #terraform init -backend-config="bucket=slb-dev-terraform-state"
          terraform init -backend-config="access_key=${{ env.AWS_ACCESS_KEY_ID}}" -backend-config="secret_key=${{ env.AWS_SECRET_ACCESS_KEY}}"
          terraform init --backend-config="access_key=${{ env.AWS_ACCESS_KEY_ID}}" --backend-config="secret_key=${{ env.AWS_SECRET_ACCESS_KEY}}"

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: Terraform Plan
        id: plan
        run: terraform plan -var-file="terraform.tfvars" -out=${{ env.plan }}

      - uses: actions/github-script@0.9.0
        if: github.event_name == 'pull_request'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          github-token: ${{ secrets.INPUT_GITHUB_TOKEN }}
          script: |
            const output = `#### Terraform Format and Style \`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Validation ${{ steps.validate.outputs.stdout }}
            #### Terraform Plan \`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`${process.env.PLAN}\`\`\`

            </details>

            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;

            github.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

正如您所看到的，我尝试过几种方法，但结果仍然是相同的错误，即

，我已经确保了我们使用的配置文件是正确的，我也不能在init命令本身中预置OIDC凭据，它正在验证正确的配置文件，因为它正在为我需要它处理的配置文件获取正确的arn，我还在某个地方看到aws配置文件和S3的凭据可能是不同的，如果是这样的话，我如何将OIDC集成到not项目中，不确定我在哪里或哪里出错，感谢任何帮助或标题，

Answer 1

我不能给出特定于Github的建议(因为我使用Bitbucket)，但是如果您使用OIDC从您的SCM访问AWS，那么同样的主体也适用。Terraform本身的S3后端不允许为OIDC指定任何正常配置，但您可以使用环境变量设置它并使其工作：

• AWS_WEB_IDENTITY_TOKEN_FILE=<web-identity-token-file>
• AWS_ROLE_ARN=arn:aws:iam::<account-id>:role/<role-name>

对于Bitbucket管道用户：

echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token

• Export

• 指定管道中的oidc: true配置

• 编写OIDC令牌文件，例如使用环境变量(如上面的

)

我已经将我的S3后端存储从有资源的帐户中分离出来，因此需要分别考虑配置实际的AWS提供程序--它确实有assume_role.web_identity_token_file和assume_role.role_arn的选项