Fix deploy by using OIDC

buildkite · Mar 31, 2023 · 8a74c83 · 8a74c83
1 parent 035f358
commit 8a74c83
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 5 deletions.
diff --git a/.buildkite/pipeline.release.yml b/.buildkite/pipeline.release.yml
@@ -5,7 +5,7 @@ steps:
     command: ".buildkite/steps/release-version.sh"
     branches: master
     agents:
-      queue: "deploy"
+      queue: elastic-runners
     concurrency: 1
     concurrency_group: 'release'
 
@@ -14,13 +14,18 @@ steps:
     command: ".buildkite/steps/github-release.sh"
     branches: master
     agents:
-      queue: "deploy"
+      queue: elastic-runners
     concurrency: 1
     concurrency_group: 'release'
     plugins:
+      - aws-assume-role-with-web-identity:
+          role-arn: arn:aws:iam::445615400570:role/pipeline-buildkite-agent-scaler
+      - aws-ssm#v1.0.0:
+          parameters:
+            GITHUB_RELEASE_ACCESS_TOKEN: /pipelines/buildkite-agent-scaler/GITHUB_RELEASE_ACCESS_TOKEN
       - ecr#v2.0.0:
           login: true
-          account-ids: "032379705303"
+          account-ids: "445615400570"
       - docker#v3.5.0:
-          image: "032379705303.dkr.ecr.us-east-1.amazonaws.com/deploytools:2020.03"
+          image: "445615400570.dkr.ecr.us-east-1.amazonaws.com/deploytools:2020.03"
           propagate-environment: true
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
@@ -16,7 +16,10 @@ steps:
   - label: ":s3:"
     command: ".buildkite/steps/upload-to-s3.sh"
     agents:
-      queue: "deploy"
+      queue: elastic-runners
+    plugins:
+      - aws-assume-role-with-web-identity:
+          role-arn: arn:aws:iam::032379705303:role/pipeline-buildkite-agent-scaler
 
   - wait
   - name: ":pipeline:"