Deploying AWS Credentials to GitHub Secrets

Jarrett Meyer — Tue, 31 May 2022 16:29:44 +0000

Objective

Deploy arbitrary projects using the AWS CDK from a GitHub action.

GitHub recommends using OIDC to allow communication between GitHub actions and AWS. But it wouldn't be an adventure if the instructions worked, would it? My company has blocked creating AWS OpenID providers, so we need a new way around this problem.

Create a Lambda function for rotating credentials

GH Personal Access Token

The first thing you're going to need is a personal access token from GitHub. We are going to save this PAT as a secret in AWS. This assumes you have saved your secret as a key-value pair that looks like

{
  "token": "thisismytokentherearemanylikeitbutthisoneismine"
}

const SECRET_NAME = "my-github-pat";

export async function getPersonalAccessToken(): Promise<string> {
  const secretsManager = new AWS.SecretsManager();
  const value = await secretsManager.getSecretValue({ SecretId: SECRET_NAME }).promise();
  const obj = JSON.parse(value || "{}");
  return obj.token;
}

Assume role

Assuming a role will allow us to generate temporary credentials for that role.

async function assumeGitHubRole() {
  const sts = new AWS.STS();

  const assumeRoleParams: AWS.STS.AssumeRoleRequest = {
    RoleArn: process.env.ROLE_ARN,
    RoleSessionName: process.env.ROLE_SESSION_NAME,
  };

  return await sts.assumeRole(assumeRoleParams).promise();
}

Save secrets to GitHub

Secrets must be encrypted using the public key for the repository. We are using libsodium crypto_box_seal function to encrypt the values.

interface SealFunction {
  (message: Uint8Array, publicKey: Uint8Array): Uint8Array;
}

function encryptMessage(sealer: SealFunction, message: string, publicKey: Buffer): string {
  const messageBuffer = Buffer.from(message);
  const encryptedMessage = sealer(messageBuffer, publicKey);
  return Buffer.from(encryptedMessage).toString("base64");
}

Update credentials

You now have all of the pieces necessary to update credentials in your GitHub repo.

export async function updateCredentials(): Promise<void> {
  try {
    const token = await getPersonalAccessToken();

    const repos = await request("GET /orgs/{org}/teams/{team_slug}/repos", {
      org: "my-org",
      team_slug: "my-team",
      headers: {
        authorization: `token ${token}`,
      },
    });

    const assumeRole = await assumeGitHubRole();

    // Ensure that the libsodium library has loaded and is ready to be called.
    await sodium.ready;

    // Loop through each repository, updating secrets as you go.
    const promises = [] as Promise<unknown>[];
    for (const repo of repos.data) {
      // Get the public key for the repo.
      const publicKeyResponse = await request("GET /repos/{owner}/{repo}/actions/secrets/public-key", {
        owner: "my-org",
        repo: repo.name,
        headers: {
          authorization: `token ${token}`,
        }
      };

      const publicKey = Buffer.from(publicKeyResponse.data.key, "base64");

      const encryptedAccessKeyId = encryptMessage(sodium.crypto_box_seal, assumeRole.Credentials.AccessKeyId, publicKey);
      const encryptedSecretAccessKey = encryptMessage(sodium.crypto_box_seal, assumeRole.Credentials.SecretAccessKey, publicKey);
      const encryptedSessionToken = encryptMessage(sodium.crypto_box_seal, assumeRole.Credentials.SessionToken, publicKey);

      promises.push(updateRepositorySecret(repo.name, "AWS_ACCESS_KEY_ID", getPublicKeyResponse.data.key_id, encryptedAccessKeyId));
      promises.push(updateRepositorySecret(repo.name, "AWS_SECRET_ACCESS_KEY", getPublicKeyResponse.data.key_id, encryptedSecretAccessKey));
      promises.push(updateRepositorySecret(repo.name, "AWS_SESSION_TOKEN", getPublicKeyResponse.data.key_id, encryptedSessionToken));
    }

    await Promise.all(promises);
    process.exit(0);
  } catch (error) {
    console.error("Error updating credentials:", JSON.stringify(error));
    process.exit(1);
  }
}

To be continued...

Simulated Annealing for Continuous Distribution Parameter Estimation in R

Jarrett Meyer — Wed, 27 Apr 2022 11:43:16 +0000

This was a fun one!

I've been trying to find a distribution that described HbA1c in the general population. After a few hours of digging, the best I could find was this research from NIH. In this article, all we are given is a few quantiles.

5%	10%	25%	50%	75%	90%	95%
4.7	4.8	5.1	5.4	5.7	6.1	6.8

I want to try to fit a continuous distribution to these points. Simulated annealing lets us search the problem space for a global optimum. I know from the text of the research that the data is skewed (mean = 5.6, mode = 5.3). We need a distribution that allows for skewness. Let’s go with the gamma distribution.

The first thing we need to do is create a data frame of our known data set.

df <- data.frame(quantile = c(0.05, 0.1, 0.25, 0.50, 0.75, 0.9, 0.95),
                 value = c(4.7, 4.8, 5.1, 5.4, 5.7, 6.1, 6.8))

Next, we need to write a function that we want our SA algorithm to minimize.

fun <- function (x) {
    shape <- x[1]
    scale <- x[2]
    df$est <- qgamma(df$quantile, shape, scale)
    df$sq_err <- (df$est - df$value) ^ 2
    error <- sum(df$sq_err)
    error
}

We will use the GenSA package for the simulated annealing.

library(GenSA)

lower_bound <- 1e-6
upper_bound <- 100

fit <- GenSA(par = c(1, 1), 
             fn = fun, 
             lower = c(lower_bound, lower_bound), 
             upper = c(upper_bound, upper_bound))

This gives us gamma distribution parameters of shape = 89.4837 and scale = 16.2514. The SSE for this fit is 0.1747.

Lets see how this looks when plotted against the original data.

library(ggplot2)

df2 <- data.frame(x = seq(from = 3.0, to = 10.0, by = 0.01))
df2$y = pgamma(df2$x, fit$par[1], fit$par[2])

ggplot() +
    geom_line(aes(x, y), df2, color = "red") +
    geom_point(aes(value, quantile), df, size = 2, color = "blue")

There you go! If you only have a few data points and their quantiles, you can make a guess about their distribution. You can try this with multiple distributions and compare their resulting SSEs.

Forem: Jarrett Meyer