use aws secrets manager for a secure retrieval

C-Accel-CRIPT · Mar 30, 2024 · adf4106 · adf4106
1 parent ac3c86e
commit adf4106
Showing 1 changed file with 7 additions and 9 deletions.
diff --git a/.github/workflows/test_coverage_with_tokens.yml b/.github/workflows/test_coverage_with_tokens.yml
@@ -42,11 +42,6 @@ jobs:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-
- run: |
- OUTPUT=$(aws cognito-idp "${{ secrets.COGNITO_INIT }}" --user-pool-id "${{ secrets.COGNITO_USER_POOL_ID }}" --client-id "${{ secrets.COGNITO_CLIENT_ID }}" --auth-flow "${{ secrets.COGNITO_AUTH_FLOW }}" --auth-parameters USERNAME="${{ secrets.COGNITO_USERNAME }}",PASSWORD=${{ secrets.COGNITO_PASSWORD }})
- echo ACCESS_TOKEN=$(echo "$OUTPUT" | jq -r '.AuthenticationResult.AccessToken' | sed 's/^"\(.*\)"$/\1/') >> $GITHUB_OUTPUT
- echo ID_TOKEN=$(echo "$OUTPUT" | jq -r '.AuthenticationResult.IdToken' | sed 's/^"\(.*\)"$/\1/') >> $GITHUB_OUTPUT
 
  - name: Setup Python
  uses: actions/setup-python@v4
@@ -59,13 +54,16 @@ jobs:
 
  - name: Install requirements_dev.txt
  run: pip install -r requirements_dev.txt
+
+ - name: Retrieve Cognito Tokens from AWS Secrets Manager
+ run: |
+ echo "CRIPT_TOKEN=$(aws secretsmanager get-secret-value --secret-id Pipelines_CognitoAccessToken --query SecretString --output text)" >> $GITHUB_ENV
+ echo "CRIPT_STORAGE_TOKEN=$(aws secretsmanager get-secret-value --secret-id Pipelines_CognitoIdToken --query SecretString --output text)" >> $GITHUB_ENV
 
  - name: Test Coverage
  run: pytest tests/api/test_api.py
  env:
- ACCESS_TOKEN: ${{ steps.cognito-token.outputs.ACCESS_TOKEN }}
- ID_TOKEN: ${{ steps.cognito-token.outputs.ID_TOKEN }}
  CRIPT_HOST: https://lb-stage.mycriptapp.org/
- CRIPT_TOKEN: $ACCESS_TOKEN
- CRIPT_STORAGE_TOKEN: $ID_TOKEN
+ CRIPT_TOKEN: ${{ env.CRIPT_TOKEN }}
+ CRIPT_STORAGE_TOKEN: ${{ env.CRIPT_STORAGE_TOKEN }}
  CRIPT_TESTS: True