如何使用 github actions OIDC 功能在 github actions 中使用无服务器框架

我已经关注了这个问题如何在不使用密钥的情况下将 GitHub 操作与 AWS 部署连接起来？ https://stackoverflow.com/questions/69243571/how-can-i-connect-github-actions-with-aws-deployments-without-using-a-secret-key.

然而，我试图更进一步，使用无服务器部署 lambda 函数。

到目前为止我已经尝试过了。

name: For Production

on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    strategy:
      matrix:
        node-version: [16.x]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
      - uses: actions/checkout@v2
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v2
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
          cache-dependency-path: ./backend-operations/package-lock.json
      - name: Create env file
        run: |
          touch ./backend-operations/.env
          echo JWKS_URI=${{secrets.JWKS_URI}} >> ./backend-operations/.env
          echo AUDIENCE=${{ secrets.AUDIENCE }} >> ./backend-operations/.env
          echo TOKEN_ISSUER=${{ secrets.TOKEN_ISSUER }} >> ./backend-operations/.env
      - run: npm ci
        working-directory: ./backend-operations
      - run: npm run build --if-present
        working-directory: ./backend-operations
      - run: npm test
        working-directory: ./backend-operations
      - name: Install Serverless Framework
        run: npm install -g serverless
      - name: Configure AWS
        run: |
          sleep 5 # Need to have a delay to acquire this
          export AWS_ROLE_ARN=arn:aws:iam::xxxxxxx:role/my-role
          export AWS_WEB_IDENTITY_TOKEN_FILE=/tmp/awscreds
          export AWS_DEFAULT_REGION=ap-southeast-1

          echo AWS_WEB_IDENTITY_TOKEN_FILE=$AWS_WEB_IDENTITY_TOKEN_FILE >> $GITHUB_ENV
          echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
          echo AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION >> $GITHUB_ENV

          curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=githubactions" \
            | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
            
          sls deploy --stage prod --verbose
        working-directory: './backend-operations'
      
      # - name: Deploy to AWS
      #   run: serverless deploy --stage prod --verbose
      #   working-directory: './backend-operations'
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v1
        with:
          token: ${{secrets.CODECOV_SECRET_TOKEN}}

我用这个解决了这个问题aws-actions/configure-aws-credentialsgithub 操作，因为它将临时访问密钥和 id 设置为环境。 因此，从现在开始无需创建 aws programmticv 密钥。

注：- github OIDC最新更新已更改域名->https://token.actions.githubusercontent.com

# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions

name: Production-Deployment

on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    strategy:
      matrix:
        node-version: [16.x]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
      - uses: actions/checkout@v2
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v2
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
          cache-dependency-path: ./backend-operations/package-lock.json
      - name: Create env file
        run: |
          touch ./backend-operations/.env
          echo JWKS_URI=${{secrets.JWKS_URI}} >> ./backend-operations/.env
          echo AUDIENCE=${{ secrets.AUDIENCE }} >> ./backend-operations/.env
          echo TOKEN_ISSUER=${{ secrets.TOKEN_ISSUER }} >> ./backend-operations/.env
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@master
        with:
          aws-region: ap-southeast-1
          role-to-assume: ${{secrets.ROLE_ARN}}
      - run: npm ci
        working-directory: ./backend-operations
      - run: npm run build --if-present
        working-directory: ./backend-operations
      - run: npm test
        working-directory: ./backend-operations
      - name: Install Serverless Framework
        run: npm install -g serverless
      - name: Serverless Authentication
        run: sls config credentials --provider aws --key ${{ env.AWS_ACCESS_KEY_ID }} --secret ${{ env.AWS_SECRET_ACCESS_KEY }}
      - name: Deploy to AWS
        run: serverless deploy --stage prod --verbose
        working-directory: './backend-operations'
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v1
        with:
          token: ${{secrets.CODECOV_SECRET_TOKEN}}