Skip to content

Commit

Permalink
update access for GH OIDC
Browse files Browse the repository at this point in the history 
we are switching from using a service user in GH action to
using a OIDC provider thus we need to provide the OIDC role
equivalent access as the service user role.
  • Loading branch information
@zaro0508
zaro0508 committed Jun 28, 2023
1 parent c302788 commit 865ae5e
Show file tree
Hide file tree
Showing 31 changed files with 32 additions and 0 deletions.
1 change: 1 addition & 0 deletions config/infra-dev/nextflow-aurora-mysql.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ parameters:
AccountAdminArns:
- {{stack_group_config.sso_admin_role.arn}}
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn

stack_tags:
{{stack_group_config.default_stack_tags}}
1 change: 1 addition & 0 deletions config/infra-dev/smtp-credentials.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ parameters:
AccountAdminArns:
- {{stack_group_config.sso_admin_role.arn}}
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn

stack_tags:
{{stack_group_config.default_stack_tags}}
1 change: 1 addition & 0 deletions config/infra-prod/nextflow-aurora-mysql.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ parameters:
AccountAdminArns:
- {{stack_group_config.sso_admin_role.arn}}
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn

stack_tags:
{{stack_group_config.default_stack_tags}}
2 changes: 2 additions & 0 deletions config/infra-prod/smtp-credentials.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ parameters:
AccountAdminArns:
- {{stack_group_config.sso_admin_role.arn}}
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn

stack_tags:
{{stack_group_config.default_stack_tags}}
1 change: 1 addition & 0 deletions config/infra-prod/workflows-kms-key.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ parameters:
- {{stack_group_config.sso_admin_role.arn}}
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external sagebase-github-oidc-workflows-prod-nextflow-infra::ProviderRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn

stack_tags:
{{stack_group_config.default_stack_tags}}
1 change: 1 addition & 0 deletions config/projects-ampad/agora-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-ampad/jared-hendrickson-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-ampad/strides-ampad-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-ampad/wei-an-chen-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-dev/example-dev-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-dev/mc2-mcmicro-dev-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-dev/orca-dev-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-dev/orca-service-test-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-dev/pec-dev-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/amp-ad-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/ctf-swnts-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/example-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/genie-bpc-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/htan-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/iatlas-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/imcore-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/jhu-biobank-nf-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/mc2-mcmicro-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/nf-ntap5-biobank-jineta.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/nfri-ctf-nf1-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/ntap-add5-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/ntap-cnf-cell-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/robert-allaway-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/sophia-jobe-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/ucf-dod-nf2-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ parameters:
AccountAdminArns:
- '{{stack_group_config.sso_admin_role.arn}}'
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: 'https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com'
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down
1 change: 1 addition & 0 deletions config/projects-prod/verena-chung-project.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ parameters:
AccountAdminArns:
- "{{stack_group_config.sso_admin_role.arn}}"
- !stack_output_external workflows-nextflow-ci-service-account::ServiceRoleArn
- !stack_output_external github-oidc-nextflow-infra::ProviderRoleArn
TemplateRootUrl: "https://{{stack_group_config.admincentral_cf_bucket}}.s3.amazonaws.com"
TowerForgePolicyArn: !stack_output_external nextflow-forge-iam-policy::NextFlowForgePolicyArn
TowerLaunchPolicyArn: !stack_output_external nextflow-launch-iam-policy::NextFlowLaunchPolicyArn
Expand Down

0 comments on commit 865ae5e

Please sign in to comment.