Add AWS Secrets Manager OIDC POC

Author: suchcicki-dropbox

.github/workflows/aws-secrets-manager-oidc-poc.yml

@@ -0,0 +1,47 @@
+name: AWS Secrets Manager OIDC POC
+
+on:
+  push:
+    branches:
+      - aws-sm-oidc-poc
+
+permissions: {}
+
+jobs:
+  fetch-test-secret:
+    if: github.repository == 'hellosign/hellosign-openapi'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6.2.3
+        with:
+          role-to-assume: arn:aws:iam::781865768738:role/oidc-github-hellosign-hellosign-openapi-branch-aws-sm-oidc-poc
+          aws-region: us-west-2
+          role-duration-seconds: 900
+          role-session-name: hellosign-openapi-oidc-poc-${{ github.run_id }}
+          allowed-account-ids: "781865768738"
+          mask-aws-account-id: true
+
+      - name: Fetch test secret
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        with:
+          secret-ids: |
+            OIDC_POC_SECRET,dev/automation_hellosign_openapi_oidc_poc
+          parse-json-secrets: false
+
+      - name: Verify test secret
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          actual_digest="$(printf '%s' "$OIDC_POC_SECRET" | sha256sum | cut -d ' ' -f 1)"
+          expected_digest="b36c054d42285f712df06e782f4c338bb97794e5952b0eb2449113fab75c4567"
+
+          if [[ "$actual_digest" != "$expected_digest" ]]; then
+            echo "::error::The test secret did not contain the expected value"
+            exit 1
+          fi
+
+          echo "The test secret was retrieved and validated successfully"