Skip to content

Commit e8d2957

Browse files
pietroalbiniMark-Simulacrum
authored andcommitted
ci: split aws credentials in two separate users with scoped perms
This commit changes our CI to use two separate IAM users to authenticate with AWS: * ci--rust-lang--rust--sccache: has access to the rust-lang-ci-sccache2 S3 bucket and its credentials are available during the whole build. * ci--rust-lang--rust--upload: has access to the rust-lang-ci2 S3 bucket and its credentials are available just during the upload step. The new tokens are available in the `prod-credentials` library.
1 parent 73c70ca commit e8d2957

File tree

4 files changed

+10
-7
lines changed

4 files changed

+10
-7
lines changed

src/ci/azure-pipelines/auto.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ trigger:
77
- auto
88

99
variables:
10-
- group: real-prod-credentials
10+
- group: prod-credentials
1111

1212
jobs:
1313
- job: Linux

src/ci/azure-pipelines/master.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ trigger:
77
- master
88

99
variables:
10-
- group: real-prod-credentials
10+
- group: prod-credentials
1111

1212
pool:
1313
vmImage: ubuntu-16.04

src/ci/azure-pipelines/steps/run.yml

+7-4
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,8 @@ steps:
168168
env:
169169
CI: true
170170
SRC: .
171-
AWS_SECRET_ACCESS_KEY: $(AWS_SECRET_ACCESS_KEY)
171+
AWS_ACCESS_KEY_ID: $(SCCACHE_AWS_ACCESS_KEY_ID)
172+
AWS_SECRET_ACCESS_KEY: $(SCCACHE_AWS_SECRET_ACCESS_KEY)
172173
TOOLSTATE_REPO_ACCESS_TOKEN: $(TOOLSTATE_REPO_ACCESS_TOKEN)
173174
condition: and(succeeded(), not(variables.SKIP_JOB))
174175
displayName: Run build
@@ -192,7 +193,8 @@ steps:
192193
fi
193194
retry aws s3 cp --no-progress --recursive --acl public-read ./$upload_dir s3://$DEPLOY_BUCKET/$deploy_dir/$BUILD_SOURCEVERSION
194195
env:
195-
AWS_SECRET_ACCESS_KEY: $(AWS_SECRET_ACCESS_KEY)
196+
AWS_ACCESS_KEY_ID: $(UPLOAD_AWS_ACCESS_KEY_ID)
197+
AWS_SECRET_ACCESS_KEY: $(UPLOAD_AWS_SECRET_ACCESS_KEY)
196198
condition: and(succeeded(), not(variables.SKIP_JOB), or(eq(variables.DEPLOY, '1'), eq(variables.DEPLOY_ALT, '1')))
197199
displayName: Upload artifacts
198200

@@ -201,7 +203,8 @@ steps:
201203
# errors here ever fail the build since this is just informational.
202204
- bash: aws s3 cp --acl public-read cpu-usage.csv s3://$DEPLOY_BUCKET/rustc-builds/$BUILD_SOURCEVERSION/cpu-$SYSTEM_JOBNAME.csv
203205
env:
204-
AWS_SECRET_ACCESS_KEY: $(AWS_SECRET_ACCESS_KEY)
205-
condition: variables['AWS_SECRET_ACCESS_KEY']
206+
AWS_ACCESS_KEY_ID: $(UPLOAD_AWS_ACCESS_KEY_ID)
207+
AWS_SECRET_ACCESS_KEY: $(UPLOAD_AWS_SECRET_ACCESS_KEY)
208+
condition: variables['UPLOAD_AWS_SECRET_ACCESS_KEY']
206209
continueOnError: true
207210
displayName: Upload CPU usage statistics

src/ci/azure-pipelines/try.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ trigger:
33
- try
44

55
variables:
6-
- group: real-prod-credentials
6+
- group: prod-credentials
77

88
jobs:
99
- job: Linux

0 commit comments

Comments
 (0)