<h1 id="%E3%82%84%E3%82%8A%E3%81%9F%E3%81%84%E3%81%93%E3%81%A8">
<a class="header-anchor-link" href="#%E3%82%84%E3%82%8A%E3%81%9F%E3%81%84%E3%81%93%E3%81%A8" aria-hidden="true"></a> やりたいこと</h1>
<p>Github Actions 内で boto3 を使用したファイルが実行できるようにする<br>
この際 AWS への認証方法は OIDC を使用するものとする</p>
<h1 id="%E3%81%84%E3%81%8D%E3%81%AA%E3%82%8A%E7%B5%90%E8%AB%96">
<a class="header-anchor-link" href="#%E3%81%84%E3%81%8D%E3%81%AA%E3%82%8A%E7%B5%90%E8%AB%96" aria-hidden="true"></a> いきなり結論</h1>
<p>Github Actions 内 boto3 を呼び出すファイルが実行される step の環境変数(env)に "AWS_ROLE_ARN: &lt;使用するロールのARN&gt;" を設定する</p>
<p>例：</p>
<div class="code-block-container"><pre class="language-yaml"><code class="language-yaml"><span class="token key atrule">name</span><span class="token punctuation">:</span> test<span class="token punctuation">-</span>github<span class="token punctuation">-</span>actions
<span class="token key atrule">on</span><span class="token punctuation">:</span> <span class="token punctuation">[</span>push<span class="token punctuation">]</span>
<span class="token key atrule">jobs</span><span class="token punctuation">:</span>
  <span class="token key atrule">run-boto3</span><span class="token punctuation">:</span>
    <span class="token key atrule">runs-on</span><span class="token punctuation">:</span> ubuntu<span class="token punctuation">-</span>latest
    <span class="token key atrule">steps</span><span class="token punctuation">:</span>
      <span class="token punctuation">-</span> <span class="token key atrule">run</span><span class="token punctuation">:</span> python ./use_boto3.py
        <span class="token key atrule">env</span><span class="token punctuation">:</span> 
          <span class="token key atrule">AWS_ROLE_ARN</span><span class="token punctuation">:</span> arn<span class="token punctuation">:</span>aws<span class="token punctuation">:</span>iam<span class="token punctuation">:</span><span class="token punctuation">:</span>&lt;アカウントID<span class="token punctuation">&gt;</span><span class="token punctuation">:</span>role/&lt;Role名<span class="token punctuation">&gt;</span>
</code></pre></div><h1 id="%E9%81%8E%E7%A8%8B">
<a class="header-anchor-link" href="#%E9%81%8E%E7%A8%8B" aria-hidden="true"></a> 過程</h1>
<p>Github Actions で boto3 を読み込むファイルを実行すると以下のエラーが出力された</p>
<div class="code-block-container"><pre><code>Traceback (most recent call last):
  File 
    client = boto3.client('logs', region_name=region)
  File "/usr/local/lib/python3.8/dist-packages/boto3/__init__.py", line 92, in client
    return _get_default_session().client(*args, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/boto3/session.py", line 299, in client
    return self._session.create_client(
  File "/usr/local/lib/python3.8/dist-packages/botocore/session.py", line 957, in create_client
    credentials = self.get_credentials()
  File "/usr/local/lib/python3.8/dist-packages/botocore/session.py", line 513, in get_credentials
    self._credentials = self._components.get_component(
  File "/usr/local/lib/python3.8/dist-packages/botocore/credentials.py", line 2038, in load_credentials
    creds = provider.load()
  File "/usr/local/lib/python3.8/dist-packages/botocore/credentials.py", line 1734, in load
    return self._assume_role_with_web_identity()
  File "/usr/local/lib/python3.8/dist-packages/botocore/credentials.py", line 1771, in _assume_role_with_web_identity
    raise InvalidConfigError(error_msg=error_msg)
botocore.exceptions.InvalidConfigError: The provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.
Error: Process completed with exit code 1.
</code></pre></div><h2 id="pick-up">
<a class="header-anchor-link" href="#pick-up" aria-hidden="true"></a> Pick up</h2>
<p>OIDC を使うときは環境変数に "AWS_ROLE_ARN" を使ってねと言われている</p>
<div class="code-block-container"><pre><code>botocore.exceptions.InvalidConfigError: The provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.
</code></pre></div><p>一応 botocore のリポジトリも確認<br>
_assume_role_with_web_identity() が呼ばれてそこから環境変数 AWS_ROLE_ARN の値をチェックしている<br>
※ここでロール ARN の指定がなかったり取得できないとエラーを出力するようになっている<br style="display:none">
<span class="embed-block zenn-embedded zenn-embedded-github"><iframe id="zenn-embedded__8744034f0dcd9" src="https://embed.zenn.studio/github#zenn-embedded__8744034f0dcd9" data-content="https%3A%2F%2Fgithub.com%2Fboto%2Fbotocore%2Fblob%2F11ea35e64951d627bd7d075e2fbc31ec2fa599f6%2Fbotocore%2Fcredentials.py%23L1757-L1771" frameborder="0" scrolling="no" loading="lazy"></iframe></span><a href="https://github.com/boto/botocore/blob/11ea35e64951d627bd7d075e2fbc31ec2fa599f6/botocore/credentials.py#L1757-L1771" style="display:none" target="_blank" rel="nofollow noopener noreferrer">https://github.com/boto/botocore/blob/11ea35e64951d627bd7d075e2fbc31ec2fa599f6/botocore/credentials.py#L1757-L1771</a></p>
<p>この辺がロール ARN の取得関連の処理<br style="display:none">
<span class="embed-block zenn-embedded zenn-embedded-github"><iframe id="zenn-embedded__170a9d5d3735" src="https://embed.zenn.studio/github#zenn-embedded__170a9d5d3735" data-content="https%3A%2F%2Fgithub.com%2Fboto%2Fbotocore%2Fblob%2F11ea35e64951d627bd7d075e2fbc31ec2fa599f6%2Fbotocore%2Fcredentials.py%23L1708-L1755" frameborder="0" scrolling="no" loading="lazy"></iframe></span><a href="https://github.com/boto/botocore/blob/11ea35e64951d627bd7d075e2fbc31ec2fa599f6/botocore/credentials.py#L1708-L1755" style="display:none" target="_blank" rel="nofollow noopener noreferrer">https://github.com/boto/botocore/blob/11ea35e64951d627bd7d075e2fbc31ec2fa599f6/botocore/credentials.py#L1708-L1755</a></p>


Github Actions で boto3 を呼ぶ

Discussion