paultiq 120b0b760d GH-50899: [CI][C++] Use OIDC instead of ACCESS_KEY and SECRET_KEY for sccache's s3 creds (#51028) ...

### Rationale for this change
This PR moves crossbow builds to short-lived S3 credentials. It does this via GitHub's OIDC provider and an AWS ROLE_ARN with a trust relationship configured. This configuration is detailed here: 
- [Use IAM roles to connect GitHub Actions to actions in AWS](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/)

The benefits of short-lived / temporary credentials discussed further here: [AWS Well-architected Framework Best Practices SEC02-BP02 Use temporary credentials](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_identities_unique.html)

sccache supports a variety of S3 creds: [S3 credentials](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials)

### What changes are included in this PR?

Use [AssumeRoleWithWebIdentity](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials) for sccache S3 credentials.

By assuming the AWS_ROLE_ARN, the sccache session relies on credentials that expire\*, issued only to workflows in the trusted repository, and scoped to the sccache bucket.

Specific tasks: 
- create a role in IAM with the bucket and object level permissions, 
- trust the github oidc-provider, 
- define AWS_ROLE_ARN and set id-token permission
- grant sts:AssumeRoleWithWebIdentity for the specific repositories or organization. 
- pass AWS_SESSION_TOKEN
- add a `aws-actions/configure-aws-credentials@ v6` step to the workflow. 

Separately, someone will need to add the role and trust to AWS:
- Procedure is in https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/ 
- Set a "Maximum session duration" to maximum runtime of any job... maybe 4 hours? 8 hours? 
- Permissions: Role needs BucketLevel and ObjectLevels permissions to the bucket. 

\* I can share an example if needed

### Are these changes tested?
Yes, locally and on a fork. 

### Are there any user-facing changes?
No
* GitHub Issue: #50899

Authored-by: paul@iqmo.com <paul@iqmo.com>
Signed-off-by: Sutou Kouhei <kou@clear-code.com>

2026-09-06 16:04:43 +09:00

..

github.linux.yml

GH-50899: [CI][C++] Use OIDC instead of ACCESS_KEY and SECRET_KEY for sccache's s3 creds (#51028)

2026-09-06 16:04:43 +09:00