GitHub Actions

Private Cloud Access

Guidance

GitHub Actions workflows MUST use temporary credentials to deploy resources or services in the target private cloud account. The root account’s or service account’s credentials MUST NOT be stored in GitHub Actions secrets or variables.

The stack gives GitHub Actions workflow jobs permission to log into private cloud using the GitHub OIDC identity provider but limits which repositories, branches, or environments can assume which roles. For more information, refer to Configure AWS Credentials for GitHub Actions, Configuring a role for GitHub OIDC identity provider, About security hardening with OpenID Connect, and Using environments for deployment.

Private Repository Access

Guidance

GitHub Actions workflows MUST use temporary credentials with read access to the private GitHub repositories sourced by the stack.

This limits the scope of a possible supply-chain attack. For more information, refer to the configuration guide.

Manual Workflow Approvals

Guidance

The NIAID International Program’s Change Advisory Board MUST review any infrastructure changes prior to deployment following the principle of dual authorization.

As part of the Continuous Delivery workflow, this project implements a simple, multi-person consent protocol using GitHub Issues and GitHub organization teams using the Manual Workflow Approval action. To implement this protocol using role-based access controls, the NIAID International Program’s Change Advisory Board is represented by the change-advisory-board team in the IBRSP organization on GitHub. This requires a separate GitHub App, TODO because GITHUB_TOKEN, the API token used by GitHub Actions workflows and jobs, cannot be granted permission to read organization group memberships.