Skip to content

Commit fbcd4b8

Browse files
jaronoff97jaronoff97
committed
use OIDC
1 parent 50be987 commit fbcd4b8

2 files changed

Lines changed: 289 additions & 2 deletions

File tree

‎.github/workflows/release-extension.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@ on:
4040
default: false
4141
type: boolean
4242

43+
permissions:
44+
id-token: write
45+
contents: read
46+
4347
jobs:
4448
prepare:
4549
name: Prepare release
@@ -227,8 +231,7 @@ jobs:
227231
- name: Configure AWS credentials
228232
uses: aws-actions/configure-aws-credentials@v4
229233
with:
230-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
231-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
234+
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
232235
aws-region: ${{ matrix.region }}
233236

234237
- name: Set variables
@@ -284,6 +287,7 @@ jobs:
284287
- name: Publish Lambda layer
285288
id: publish
286289
run: |
290+
aws sts get-caller-identity
287291
LAYER_NAME="${{ steps.vars.outputs.layer_name }}"
288292
VERSION="${{ steps.version.outputs.version }}"
289293
LAYER_FILE=".layers/datadog_extension-${{ steps.vars.outputs.suffix }}.zip"

‎Releasing.md‎

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
# Releasing the Datadog Lambda Extension
2+
3+
This guide covers how to build and publish the Lambda extension layer to AWS.
4+
5+
## Prerequisites
6+
7+
### Step 1: Create GitHub OIDC Identity Provider in AWS
8+
9+
1. Go to **IAM → Identity providers → Add provider**
10+
11+
2. Configure the provider:
12+
- **Provider type:** OpenID Connect
13+
- **Provider URL:** `https://token.actions.githubusercontent.com`
14+
- **Audience:** `sts.amazonaws.com`
15+
16+
3. Click **Add provider**
17+
18+
Or via AWS CLI:
19+
20+
```bash
21+
aws iam create-open-id-connect-provider \
22+
--url https://token.actions.githubusercontent.com \
23+
--client-id-list sts.amazonaws.com
24+
```
25+
26+
### Step 2: Create IAM Role for GitHub Actions
27+
28+
1. Go to **IAM → Roles → Create role**
29+
30+
2. Select **Web identity** as the trusted entity type
31+
32+
3. Configure:
33+
- **Identity provider:** `token.actions.githubusercontent.com`
34+
- **Audience:** `sts.amazonaws.com`
35+
36+
4. Click **Next**, then **Create policy** (in a new tab) with this JSON:
37+
38+
```json
39+
{
40+
"Version": "2012-10-17",
41+
"Statement": [
42+
{
43+
"Effect": "Allow",
44+
"Action": ["lambda:PublishLayerVersion", "lambda:ListLayerVersions"],
45+
"Resource": "arn:aws:lambda:*:YOUR_ACCOUNT_ID:layer:Datadog-Extension*"
46+
},
47+
{
48+
"Effect": "Allow",
49+
"Action": "sts:GetCallerIdentity",
50+
"Resource": "*"
51+
}
52+
]
53+
}
54+
```
55+
56+
5. Name the policy `LambdaLayerPublish` and create it
57+
58+
6. Back in the role creation, attach the `LambdaLayerPublish` policy
59+
60+
7. Name the role (e.g., `GitHubActionsLambdaLayerPublish`) and create it
61+
62+
8. **Edit the trust policy** to restrict to your repository. Go to the role →
63+
Trust relationships → Edit:
64+
65+
```json
66+
{
67+
"Version": "2012-10-17",
68+
"Statement": [
69+
{
70+
"Effect": "Allow",
71+
"Principal": {
72+
"Federated": "arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
73+
},
74+
"Action": "sts:AssumeRoleWithWebIdentity",
75+
"Condition": {
76+
"StringEquals": {
77+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
78+
},
79+
"StringLike": {
80+
"token.actions.githubusercontent.com:sub": "repo:YOUR_ORG/YOUR_REPO:*"
81+
}
82+
}
83+
}
84+
]
85+
}
86+
```
87+
88+
Replace:
89+
90+
- `YOUR_ACCOUNT_ID` with your AWS account ID
91+
- `YOUR_ORG/YOUR_REPO` with your GitHub org and repo (e.g.,
92+
`usetero/datadog-lambda-extension`)
93+
94+
### Step 3: Add Role ARN to GitHub Secrets
95+
96+
1. Copy the role ARN (e.g.,
97+
`arn:aws:iam::123456789012:role/GitHubActionsLambdaLayerPublish`)
98+
99+
2. Go to your GitHub repository **Settings → Secrets and variables → Actions**
100+
101+
3. Add a new secret:
102+
- **Name:** `AWS_ROLE_ARN`
103+
- **Value:** Your role ARN
104+
105+
## Releasing via GitHub Actions
106+
107+
### Option 1: Manual Release (Recommended)
108+
109+
1. Go to **Actions → Release Lambda Extension → Run workflow**
110+
111+
2. Configure the release options:
112+
113+
| Option | Description | Example |
114+
| --------------- | ---------------------------------------------------- | ------------------------------- |
115+
| `version` | Version number (auto-increments if empty) | `100` |
116+
| `layer_suffix` | Suffix to differentiate from official Datadog layers | `-Tero` |
117+
| `regions` | Comma-separated AWS regions | `us-east-1,us-west-2,eu-west-1` |
118+
| `architectures` | Which architectures to build | `amd64,arm64` |
119+
| `fips` | Include FIPS-compliant builds | `false` |
120+
| `dry_run` | Build without publishing to AWS | `false` |
121+
122+
3. Click **Run workflow**
123+
124+
4. After completion, find the Layer ARNs in the workflow summary
125+
126+
### Option 2: Tag-based Release
127+
128+
Push a version tag to trigger an automatic release:
129+
130+
```bash
131+
git tag v100
132+
git push origin v100
133+
```
134+
135+
This publishes to the default region (us-east-1) with both architectures.
136+
137+
## Layer Naming Convention
138+
139+
The workflow creates layers with this naming pattern:
140+
141+
| Architecture | FIPS | Suffix | Layer Name |
142+
| ------------ | ---- | ------- | --------------------------------- |
143+
| amd64 | No | `-Tero` | `Datadog-Extension-Tero` |
144+
| arm64 | No | `-Tero` | `Datadog-Extension-ARM-Tero` |
145+
| amd64 | Yes | `-Tero` | `Datadog-Extension-FIPS-Tero` |
146+
| arm64 | Yes | `-Tero` | `Datadog-Extension-ARM-FIPS-Tero` |
147+
148+
## Using the Published Layer
149+
150+
### Find your Layer ARN
151+
152+
After publishing, the Layer ARN follows this format:
153+
154+
```
155+
arn:aws:lambda:REGION:ACCOUNT_ID:layer:LAYER_NAME:VERSION
156+
```
157+
158+
Example:
159+
160+
```
161+
arn:aws:lambda:us-east-1:123456789012:layer:Datadog-Extension-ARM-Tero:1
162+
```
163+
164+
### Update a Lambda function
165+
166+
**AWS CLI:**
167+
168+
```bash
169+
aws lambda update-function-configuration \
170+
--function-name my-function \
171+
--layers "arn:aws:lambda:us-east-1:123456789012:layer:Datadog-Extension-ARM-Tero:1"
172+
```
173+
174+
**Terraform:**
175+
176+
```hcl
177+
resource "aws_lambda_function" "example" {
178+
# ... other configuration ...
179+
180+
layers = [
181+
"arn:aws:lambda:us-east-1:123456789012:layer:Datadog-Extension-ARM-Tero:1"
182+
]
183+
}
184+
```
185+
186+
**AWS SAM:**
187+
188+
```yaml
189+
MyFunction:
190+
Type: AWS::Serverless::Function
191+
Properties:
192+
Layers:
193+
- arn:aws:lambda:us-east-1:123456789012:layer:Datadog-Extension-ARM-Tero:1
194+
```
195+
196+
**Serverless Framework:**
197+
198+
```yaml
199+
functions:
200+
myFunction:
201+
layers:
202+
- arn:aws:lambda:us-east-1:123456789012:layer:Datadog-Extension-ARM-Tero:1
203+
```
204+
205+
## Local Build and Manual Publish
206+
207+
If you need to build and publish manually without GitHub Actions:
208+
209+
### Build the layer
210+
211+
```bash
212+
# For ARM64
213+
ARCHITECTURE=arm64 FIPS=0 ALPINE=0 DEBUG=0 ./scripts/build_bottlecap_layer.sh
214+
215+
# For AMD64
216+
ARCHITECTURE=amd64 FIPS=0 ALPINE=0 DEBUG=0 ./scripts/build_bottlecap_layer.sh
217+
```
218+
219+
The layer zip will be created in `.layers/`.
220+
221+
### Publish to AWS
222+
223+
```bash
224+
# Set your region
225+
export AWS_REGION=us-east-1
226+
227+
# Publish ARM64 layer
228+
aws lambda publish-layer-version \
229+
--layer-name "Datadog-Extension-ARM-Tero" \
230+
--description "Tero fork of Datadog Lambda Extension" \
231+
--zip-file "fileb://.layers/datadog_extension-arm64.zip" \
232+
--compatible-architectures arm64 \
233+
--region $AWS_REGION
234+
235+
# Publish AMD64 layer
236+
aws lambda publish-layer-version \
237+
--layer-name "Datadog-Extension-Tero" \
238+
--description "Tero fork of Datadog Lambda Extension" \
239+
--zip-file "fileb://.layers/datadog_extension-amd64.zip" \
240+
--compatible-architectures x86_64 \
241+
--region $AWS_REGION
242+
```
243+
244+
## Troubleshooting
245+
246+
### Build fails with Boost download error
247+
248+
The Boost download URL may change. Check `images/Dockerfile.bottlecap.compile`
249+
and update the SourceForge URL if needed.
250+
251+
### Build fails with policy-rs compilation error on ARM64
252+
253+
Ensure you're using `policy-rs` version 1.1.1 or later, which includes the ARM64
254+
compatibility fix.
255+
256+
### Layer version already exists
257+
258+
The workflow skips publishing if the target version already exists. Either:
259+
260+
- Let the version auto-increment (leave version field empty)
261+
- Specify a higher version number
262+
263+
### Permission denied when publishing
264+
265+
Verify your IAM role has the required `lambda:PublishLayerVersion` permission
266+
and the trust policy allows your repository.
267+
268+
### OIDC authentication fails
269+
270+
1. Verify the OIDC provider exists in IAM → Identity providers
271+
2. Check the trust policy has the correct `sub` claim for your repo
272+
3. Ensure `AWS_ROLE_ARN` secret is set correctly in GitHub
273+
274+
## Multi-Region Deployment
275+
276+
To deploy to multiple regions, specify them comma-separated:
277+
278+
```
279+
us-east-1,us-west-2,eu-west-1,ap-southeast-1
280+
```
281+
282+
Each region will get its own copy of the layer. Lambda functions must use a
283+
layer from the same region they're deployed in.

0 commit comments

Comments
 (0)