How did you configure access rights in GitHub for the…

To configure GitHub Actions agent access rights to ECS for launching or downloading containers, follow these steps:

Create an IAM policy: Create a new IAM policy in AWS that grants the necessary permissions. The minimum permissions for running an ECS task include ecs:RunTask, ecs:PullImage (for ECR registry), iam:PassRole (if an IAM role is used in the task definition).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:RunTask",
                "ecs:DescribeTasks",
                "ecs:StopTask",
                "ecs:PullImage",
                "iam:PassRole"
            ],
            "Resource": "*" // It is recommended to restrict to specific resources
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Resource": "arn:aws:ecr:<region>:<account-id>:repository/<repository-name>" // Specify your ECR repository ARN
        }
    ]
}

If only downloading is needed, permissions can be limited to ECR actions only.

Create an IAM user or IAM role:

IAM user: Create a separate IAM user with programmatic access (Access Key ID and Secret Access Key). Attach the IAM policy created in step 1 to this user. This method is less secure due to the need to store access keys.
IAM role with trust relationships for OpenID Connect (OIDC) and GitHub Actions: This is the preferred and more secure method. Create an IAM role with trust relationships with the OIDC provider for GitHub Actions. Configure the OIDC condition to restrict access only from your GitHub repository. Attach the IAM policy created in step 1 to this role.

// Example trust policy for OIDC
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account-id>:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:<owner>/<repository>:*"
                }
            }
        }
    ]
}

Replace <account-id>, <owner>, <repository> with your values.

Configure GitHub Actions:

For IAM user: Save the Access Key ID and Secret Access Key as secrets in your GitHub repository (e.g., AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY). Use these secrets in your .github/workflows/*.yml workflow for authentication.
For IAM role with OIDC: In your workflow .github/workflows/*.yml, specify the ARN of the created IAM role. GitHub Actions will automatically obtain temporary credentials using OIDC. This method does not require storing AWS secrets in GitHub.

# Example of using OIDC in workflow
name: Deploy to ECS

on:
  push:
    branches:
      - main

permissions:
  id-token: write # Allow obtaining OIDC token
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::<account-id>:role/<your-iam-role-name> # Specify your OIDC-compatible IAM role ARN
          aws-region: <your-region>

      - name: Run ECS task
        run: |
          aws ecs run-task \
            --cluster <your-ecs-cluster> \
            --task-definition <your-task-definition> \
            --launch-type FARGATE \
            --network-configuration "awsvpcConfiguration={subnets=[<subnet-id>],securityGroups=[<security-group-id>],assignPublicIp='ENABLED'}"

Replace <account-id>, <your-iam-role-name>, <your-region>, <your-ecs-cluster>, <your-task-definition>, <subnet-id>, <security-group-id> with your values.

Using an IAM role with OIDC is the recommended approach for security and flexibility. The principle of least privilege should be applied to the IAM policy, restricting allowed actions and resources to the minimum.

How did you configure access rights in GitHub for the agent to be able to run or download the container in ECS?