You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
## Steps to be taken in the console(UI) to setup the secret in github for terraform deployment
8
+
9
+
1.[Login to console via IDIR MFA](https://login.nimbus.cloud.gov.bc.ca/)
10
+
2. Navigate to IAM, click on policies on left hand menu.
11
+
3. Click on `Create policy` button and switch from visual to JSON then paste the below snippet
12
+
13
+
```json
14
+
{
15
+
"Version": "2012-10-17",
16
+
"Statement": [
17
+
{
18
+
"Sid": "IAM",
19
+
"Effect": "Allow",
20
+
"Action": ["iam:*"],
21
+
"Resource": ["*"]
22
+
},
23
+
{
24
+
"Sid": "S3",
25
+
"Effect": "Allow",
26
+
"Action": ["s3:*"],
27
+
"Resource": ["*"]
28
+
},
29
+
{
30
+
"Sid": "Cloudfront",
31
+
"Effect": "Allow",
32
+
"Action": ["cloudfront:*"],
33
+
"Resource": ["*"]
34
+
},
35
+
{
36
+
"Sid": "ecs",
37
+
"Effect": "Allow",
38
+
"Action": ["ecs:*"],
39
+
"Resource": "*"
40
+
},
41
+
{
42
+
"Sid": "ecr",
43
+
"Effect": "Allow",
44
+
"Action": ["ecr:*"],
45
+
"Resource": "*"
46
+
},
47
+
{
48
+
"Sid": "Dynamodb",
49
+
"Effect": "Allow",
50
+
"Action": ["dynamodb:*"],
51
+
"Resource": ["*"]
52
+
},
53
+
{
54
+
"Sid": "APIgateway",
55
+
"Effect": "Allow",
56
+
"Action": ["apigateway:*"],
57
+
"Resource": ["*"]
58
+
},
59
+
{
60
+
"Sid": "Cloudwatch",
61
+
"Effect": "Allow",
62
+
"Action": ["cloudwatch:*"],
63
+
"Resource": "*"
64
+
},
65
+
{
66
+
"Sid": "EC2",
67
+
"Effect": "Allow",
68
+
"Action": ["ec2:*"],
69
+
"Resource": "*"
70
+
},
71
+
{
72
+
"Sid": "Autoscaling",
73
+
"Effect": "Allow",
74
+
"Action": ["autoscaling:*"],
75
+
"Resource": "*"
76
+
},
77
+
{
78
+
"Sid": "KMS",
79
+
"Effect": "Allow",
80
+
"Action": ["kms:*"],
81
+
"Resource": "*"
82
+
},
83
+
{
84
+
"Sid": "SecretsManager",
85
+
"Effect": "Allow",
86
+
"Action": ["secretsmanager:*"],
87
+
"Resource": "*"
88
+
},
89
+
{
90
+
"Sid": "CloudWatchLogs",
91
+
"Effect": "Allow",
92
+
"Action": ["logs:*"],
93
+
"Resource": "*"
94
+
},
95
+
{
96
+
"Sid": "WAF",
97
+
"Effect": "Allow",
98
+
"Action": ["wafv2:*"],
99
+
"Resource": "*"
100
+
},
101
+
{
102
+
"Sid": "ELB",
103
+
"Effect": "Allow",
104
+
"Action": ["elasticloadbalancing:*"],
105
+
"Resource": "*"
106
+
},
107
+
{
108
+
"Sid": "AppAutoScaling",
109
+
"Effect": "Allow",
110
+
"Action": ["application-autoscaling:*"],
111
+
"Resource": "*"
112
+
}
113
+
114
+
]
115
+
}
116
+
```
117
+
4. Then create a role by clicking `create role` button and then selecting (custom trust policy radio button).
118
+
5. Paste the below JSON after making modifications to set trust relationships of the role with your github repo(<repo_name> ex: bcgov/quickstart-aws-containers) .
6. Click on Next button, then add the policies after searching for it and then enabling it by checking the checkbox.
144
+
7. Finally give a role name for ex: `GHA_CI_CD` and then click on `create role` button.
145
+
7. After the role is created copy the ARN, it would be like `arn:aws:iam::<account_number>:role/<role_name>` , `role_name` is what was created on step 4.
146
+
8. Paste this value into github secrets, repository secret or environment secret based on your needs. The key to use is `AWS_DEPLOY_ROLE_ARN`
147
+
9. Paste the license plate value( 6 alphanumeric characters ex: `ab9okj`) without the env as a repository secret. The Key to use is `AWS_LICENSE_PLATE`
148
+
10. After this the github action workflows would be able to deploy the stack to AWS.
0 commit comments