[env-kvstore]: tool to retrieve CI/CD secrets and vars from AWS Secrets

[bpdohall]

Initial PR to add a shared workflow enabling replacement of GitHub secrets and variables with a key-value store backed by AWS Secrets Manager.

The first commit here adds the token exchange behaviour which allows a GitHub workflow to obtain an AWS role session having session tags that match the OIDC claims from a GitHub token.

RFD reference: https://github.com/gravitational/cloud/blob/master/rfd/0193-Replace-GitHub-Secrets.md

Example run output: https://github.com/gravitational/bpdohall-platformops-gha/actions/runs/22505998282/job/65204598612#step:6:135

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​aws/​aws-sdk-go-v2@​v1.41.2
	golang/​github.com/​aws/​aws-sdk-go-v2/​config@​v1.32.10
	golang/​github.com/​spf13/​cobra@​v1.10.1
	golang/​github.com/​aws/​aws-sdk-go-v2/​credentials@​v1.19.10
	golang/​github.com/​golang-jwt/​jwt/​v5@​v5.3.1
	golang/​github.com/​aws/​aws-sdk-go-v2/​service/​cognitoidentity@​v1.33.19
	golang/​github.com/​aws/​aws-sdk-go-v2/​service/​sts@​v1.41.7
	golang/​github.com/​hashicorp/​go-retryablehttp@​v0.7.8

View full report

[zmb3]

Can you elaborate? Why is it safe to trust the claims in the JWT without first verifying the signature?

[bpdohall]

The only GHA token claim values we use are as follows:

1. runID and sha are concatenated to create a unique session name used during role assumption. AWS IAM policies require these match role session tags.
2. enterprise, repository and environment are used to generate names of Secrets Manager secrets that will be retrieved. Access to retrieve the secrets is gated by an IAM Role policy that requires a tagged session.

In both cases, a role session with tags is a prerequisite for accessing anything in AWS. Role assumption requires a Cognito token from a specific Identity Pool. If the Cognito Identity pool is presented with a forged GitHub token it will fail to produce a Cognito token so no tagged role session can be obtained.

Fundamentally, this GitHub action implements a compliant client, rather than "enforce" any rules.

The TokenExchanger conforms with the rule "SessionName must be runID@sha". Enforcement is through the IAM role trust policy.

shared-workflows/tools/env-kvstore/README.md

Lines 75 to 110 in fdff6ca

	{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Sid": "",
	"Effect": "Allow",
	"Principal": {
	"Federated": "cognito-identity.amazonaws.com"
	},
	"Action": "sts:AssumeRoleWithWebIdentity",
	"Condition": {
	"StringEquals": {
	"aws:RequestTag/enterprise": "${GITHUB_ORG}$",
	"cognito-identity.amazonaws.com:aud": "us-west-2:12345678-1234-1234-1234-1234567890ab",
	"sts:RoleSessionName": "${aws:RequestTag/run_id}@${aws:RequestTag/sha}"
	},
	"StringNotEquals": {
	"aws:RequestTag/event_name": "pull_request"
	}
	}
	},
	{
	"Sid": "",
	"Effect": "Allow",
	"Principal": {
	"Federated": "cognito-identity.amazonaws.com"
	},
	"Action": "sts:TagSession",
	"Condition": {
	"StringEquals": {
	"cognito-identity.amazonaws.com:aud": "us-west-2:12345678-1234-1234-1234-1234567890ab"
	}
	}
	}
	]
	}

The KVStore getter will conform with the rule on how Secrets Manager secrets are named for each repository. Enforcement relies on the IAM Role Policy (ABAC).

shared-workflows/tools/env-kvstore/README.md

Lines 119 to 132 in fdff6ca

	{
	"Statement": [
	{
	"Sid": "AllowReadSecretsBasedOnSessionTags"
	"Action": "secretsmanager:GetSecretValue",
	"Effect": "Allow",
	"Resource": [
	"arn:aws:secretsmanager:us-west-2:278576220453:secret:${aws:PrincipalTag/enterprise}/repo/${aws:PrincipalTag/repository}/secrets",
	"arn:aws:secretsmanager:us-west-2:278576220453:secret:${aws:PrincipalTag/enterprise}/repo/${aws:PrincipalTag/repository}/variables",
	"arn:aws:secretsmanager:us-west-2:278576220453:secret:${aws:PrincipalTag/enterprise}/repo/${aws:PrincipalTag/repository}/env/${aws:PrincipalTag/environment}/*",
	],
	}
	],
	}

Separately, the Cognito Identity Pool enforces the rule that the token needs to be from our GitHub organization because it relies on the Identity Provider.

shared-workflows/tools/env-kvstore/README.md

Lines 44 to 60 in fdff6ca

	resource "aws_cognito_identity_pool_provider_principal_tag" "gha" {
	identity_provider_name = "arn:aws:iam::${AWS_ACCOUNT_ID}$:oidc-provider/token.actions.githubusercontent.com/${GITHUB_ORG}"
	identity_pool_id = aws_cognito_identity_pool.gha.id
	use_defaults = false
	principal_tags = {
	"repository" = "repository"
	"enterprise" = "enterprise"
	"environment" = "environment"
	"event_name" = "event_name"
	"run_id" = "run_id"
	"actor" = "actor"
	"sha" = "sha"
	"workflow" = "workflow"
	}
	}
	```

[taraspos]

Approved left bunch of small nits and suggestions.

[logand22]

Don't want to continue to delay the release of this over command line stuff. So here's an approval. It's just that the current usage of cobra doesn't really add much or follow the pattern.

In my earlier feedback I didn't realize you were only creating a single command. In which I case I don't think you need to introduce additional dependencies at all.