Skip to content

Commit 9d7bb26

Browse files
Copilotelifouts
Copilot
and
elifouts
authored
Fix ECS deployment workflow: YAML syntax, OIDC auth, dynamic vars, and correct Docker context (#146)
* Initial plan * Fix aws.yml: YAML syntax, OIDC auth, vars context, steps indent, docker build path Co-authored-by: elifouts <116454864+elifouts@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elifouts <116454864+elifouts@users.noreply.github.com>
1 parent 0c39326 commit 9d7bb26

1 file changed

Lines changed: 53 additions & 59 deletions

File tree

‎.github/workflows/aws.yml‎

Lines changed: 53 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,43 @@
11
# This workflow will build and push a new container image to Amazon ECR,
2-
# and then will deploy a new task definition to Amazon ECS, when there is a push to the "main" branch.
2+
# and then will deploy a new task definition to Amazon ECS.
3+
# It is triggered manually via workflow_dispatch.
34
#
45
# To use this workflow, you will need to complete the following set-up steps:
56
#
67
# 1. Create an ECR repository to store your images.
78
# For example: `aws ecr create-repository --repository-name my-ecr-repo --region us-east-2`.
8-
# Replace the value of the `ECR_REPOSITORY` environment variable in the workflow below with your repository's name.
9-
# Replace the value of the `AWS_REGION` environment variable in the workflow below with your repository's region.
9+
# Set the `AWS_REGION` and `ECR_REPOSITORY` variables in your GitHub repository/environment settings.
1010
#
1111
# 2. Create an ECS task definition, an ECS cluster, and an ECS service.
1212
# For example, follow the Getting Started guide on the ECS console:
1313
# https://us-east-2.console.aws.amazon.com/ecs/home?region=us-east-2#/firstRun
14-
# Replace the value of the `ECS_SERVICE` environment variable in the workflow below with the name you set for the Amazon ECS service.
15-
# Replace the value of the `ECS_CLUSTER` environment variable in the workflow below with the name you set for the cluster.
14+
# Set the `ECS_SERVICE` and `ECS_CLUSTER` variables in your GitHub repository/environment settings.
1615
#
1716
# 3. Store your ECS task definition as a JSON file in your repository.
1817
# The format should follow the output of `aws ecs register-task-definition --generate-cli-skeleton`.
19-
# Replace the value of the `ECS_TASK_DEFINITION` environment variable in the workflow below with the path to the JSON file.
20-
# Replace the value of the `CONTAINER_NAME` environment variable in the workflow below with the name of the container
21-
# in the `containerDefinitions` section of the task definition.
18+
# Set the `ECS_TASK_DEFINITION` and `CONTAINER_NAME` variables in your GitHub repository/environment settings.
2219
#
23-
# 4. Store an IAM user access key in GitHub Actions secrets named `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
24-
# See the documentation for each action used below for the recommended IAM policies for this IAM user,
25-
# and best practices on handling the access key credentials.
20+
# 4. Configure GitHub OIDC for AWS and create an IAM role that GitHub Actions can assume.
21+
# Store the IAM role ARN in a GitHub Actions secret named `AWS_ROLE_ARN`.
22+
# See https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
23+
# for setup instructions and recommended IAM policies.
2624

2725
name: Deploy to Amazon ECS
2826

2927
on:
30-
workflow_dispatch
31-
# push:
32-
# branches: [ "main" ]
28+
workflow_dispatch:
3329

3430
env:
35-
AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1
36-
ECR_REPOSITORY: MY_ECR_REPOSITORY # set this to your Amazon ECR repository name
37-
ECS_SERVICE: MY_ECS_SERVICE # set this to your Amazon ECS service name
38-
ECS_CLUSTER: MY_ECS_CLUSTER # set this to your Amazon ECS cluster name
39-
ECS_TASK_DEFINITION: MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition
40-
# file, e.g. .aws/task-definition.json
41-
CONTAINER_NAME: MY_CONTAINER_NAME # set this to the name of the container in the
42-
# containerDefinitions section of your task definition
31+
AWS_REGION: ${{ vars.AWS_REGION }}
32+
ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
33+
ECS_SERVICE: ${{ vars.ECS_SERVICE }}
34+
ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
35+
ECS_TASK_DEFINITION: ${{ vars.ECS_TASK_DEFINITION }}
36+
CONTAINER_NAME: ${{ vars.CONTAINER_NAME }}
4337

4438
permissions:
4539
contents: read
40+
id-token: write
4641

4742
jobs:
4843
deploy:
@@ -51,45 +46,44 @@ jobs:
5146
environment: production
5247

5348
steps:
54-
- name: Checkout
55-
uses: actions/checkout@v4
49+
- name: Checkout
50+
uses: actions/checkout@v4
5651

57-
- name: Configure AWS credentials
58-
uses: aws-actions/configure-aws-credentials@v1
59-
with:
60-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
61-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
62-
aws-region: ${{ env.AWS_REGION }}
52+
- name: Configure AWS credentials
53+
uses: aws-actions/configure-aws-credentials@v1
54+
with:
55+
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
56+
aws-region: ${{ env.AWS_REGION }}
6357

64-
- name: Login to Amazon ECR
65-
id: login-ecr
66-
uses: aws-actions/amazon-ecr-login@v1
58+
- name: Login to Amazon ECR
59+
id: login-ecr
60+
uses: aws-actions/amazon-ecr-login@v1
6761

68-
- name: Build, tag, and push image to Amazon ECR
69-
id: build-image
70-
env:
71-
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
72-
IMAGE_TAG: ${{ github.sha }}
73-
run: |
74-
# Build a docker container and
75-
# push it to ECR so that it can
76-
# be deployed to ECS.
77-
docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
78-
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
79-
echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
62+
- name: Build, tag, and push image to Amazon ECR
63+
id: build-image
64+
env:
65+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
66+
IMAGE_TAG: ${{ github.sha }}
67+
run: |
68+
# Build a docker container and
69+
# push it to ECR so that it can
70+
# be deployed to ECS.
71+
docker build -f backend/Dockerfile -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG backend
72+
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
73+
echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
8074
81-
- name: Fill in the new image ID in the Amazon ECS task definition
82-
id: task-def
83-
uses: aws-actions/amazon-ecs-render-task-definition@v1
84-
with:
85-
task-definition: ${{ env.ECS_TASK_DEFINITION }}
86-
container-name: ${{ env.CONTAINER_NAME }}
87-
image: ${{ steps.build-image.outputs.image }}
75+
- name: Fill in the new image ID in the Amazon ECS task definition
76+
id: task-def
77+
uses: aws-actions/amazon-ecs-render-task-definition@v1
78+
with:
79+
task-definition: ${{ env.ECS_TASK_DEFINITION }}
80+
container-name: ${{ env.CONTAINER_NAME }}
81+
image: ${{ steps.build-image.outputs.image }}
8882

89-
- name: Deploy Amazon ECS task definition
90-
uses: aws-actions/amazon-ecs-deploy-task-definition@v1
91-
with:
92-
task-definition: ${{ steps.task-def.outputs.task-definition }}
93-
service: ${{ env.ECS_SERVICE }}
94-
cluster: ${{ env.ECS_CLUSTER }}
95-
wait-for-service-stability: true
83+
- name: Deploy Amazon ECS task definition
84+
uses: aws-actions/amazon-ecs-deploy-task-definition@v1
85+
with:
86+
task-definition: ${{ steps.task-def.outputs.task-definition }}
87+
service: ${{ env.ECS_SERVICE }}
88+
cluster: ${{ env.ECS_CLUSTER }}
89+
wait-for-service-stability: true

0 commit comments

Comments
 (0)