|
| 1 | +## Amazon ServiceDiscovery Service Action for GitHub Actions |
| 2 | + |
| 3 | +Creates an Amazon ServiceDiscovery Service |
| 4 | + |
| 5 | +**Table of Contents** |
| 6 | + |
| 7 | +<!-- toc --> |
| 8 | + |
| 9 | +- [Amazon ServiceDiscovery Service Action for GitHub Actions](#amazon-servicediscovery-service-action-for-github-actions) |
| 10 | +- [Usage](#usage) |
| 11 | + - [Service Creation](#service-creation) |
| 12 | + - [Service Deletion](#service-deletion) |
| 13 | +- [Credentials and Region](#credentials-and-region) |
| 14 | +- [Permissions](#permissions) |
| 15 | +- [Troubleshooting](#troubleshooting) |
| 16 | + |
| 17 | +<!-- tocstop --> |
| 18 | + |
| 19 | +## Usage |
| 20 | + |
| 21 | +### Service Creation |
| 22 | + |
| 23 | +Create a ServiceDiscovery Service. At the minimum, supply `name`, and `dns-config` with an entry for `NamespaceId`. |
| 24 | + |
| 25 | +parameter | description | default |
| 26 | +-----------------------|---------------------------------------------|---------- |
| 27 | +`name` | The name that you want to assign to the service. | |
| 28 | +`namespace-id` | The ID of the namespace that you want to use to create the service. The namespace ID must be specified, but it can be specified either here or in the DnsConfig object. | |
| 29 | + |
| 30 | +`description` | A description for the service. | `undefined` |
| 31 | +`dns-config` | A complex type that contains information about the Amazon Route 53 records that you want Cloud Map to create when you register an instance. | {} |
| 32 | +`health-check-config` | Public DNS and HTTP namespaces only. A complex type that contains settings for an optional Route 53 health check. If you specify settings for a health check, Cloud Map associates the health check with all the Route 53 DNS records that you specify in DnsConfig. | {} |
| 33 | +`health-check-custom-config` | A complex type that contains information about an optional custom health check. | {} |
| 34 | +`tags` | The tags to add to the service. Each Tag consists of a key and a value that you define(`[{Key: my-key, Value: my-value}]`). | [] |
| 35 | +`type` | If present, specifies that the service instances are only discoverable using the DiscoverInstances API operation. No DNS records is registered for the service instances. The only valid value is HTTP. | `HTTP_DNS` |
| 36 | + |
| 37 | + |
| 38 | +```yaml |
| 39 | +- name: ServiceDiscovery Service |
| 40 | + id: create-servicediscovery-service |
| 41 | + uses: scribd/amazon-servicediscovery-service@master |
| 42 | + with: |
| 43 | + name: my-service |
| 44 | + dns-config: | |
| 45 | + { |
| 46 | + "NamespaceId": "ns-namespacename", |
| 47 | + "RoutingPolicy": "MULTIVALUE", |
| 48 | + "DnsRecords": [ |
| 49 | + { |
| 50 | + "Type": "SRV", |
| 51 | + "TTL": 10 |
| 52 | + } |
| 53 | + ] |
| 54 | + } |
| 55 | + tags: | |
| 56 | + [ |
| 57 | + { |
| 58 | + "Key": "tags-must", |
| 59 | + "Value": "be-passed-in-as-a-json-string" |
| 60 | + }, |
| 61 | + { |
| 62 | + "Key": "this-is-because", |
| 63 | + "Value": "GitHub Actions translates these values into Environment Variables" |
| 64 | + } |
| 65 | + ] |
| 66 | +``` |
| 67 | +
|
| 68 | +### Service Deletion |
| 69 | +
|
| 70 | +The only value necessary to delete a service is the ID of the service. You can also specify the other inputs, but they will be ignored. |
| 71 | +
|
| 72 | +Note: This command will fail if there are still instances registered to the service. |
| 73 | +
|
| 74 | +```yaml |
| 75 | +- name: Delete ServiceDiscovery Service |
| 76 | + uses: scribd/amazon-servicediscovery-service@master |
| 77 | + with: |
| 78 | + action: delete |
| 79 | + id: ${{ steps.create-servicediscovery-service.outputs.id }} |
| 80 | +``` |
| 81 | +
|
| 82 | +See [action.yml](action.yml) for the full documentation for this action's inputs and outputs. |
| 83 | +
|
| 84 | +
|
| 85 | +## Credentials and Region |
| 86 | +
|
| 87 | +This action relies on the [default behavior of the AWS SDK for Javascript](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html) to determine AWS credentials and region. |
| 88 | +Use [the `aws-actions/configure-aws-credentials` action](https://github.com/aws-actions/configure-aws-credentials) to configure the GitHub Actions environment with environment variables containing AWS credentials and your desired region. |
| 89 | + |
| 90 | +We recommend following [Amazon IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) for the AWS credentials used in GitHub Actions workflows, including: |
| 91 | +* Do not store credentials in your repository's code. You may use [GitHub Actions secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets) to store credentials and redact credentials from GitHub Actions workflow logs. |
| 92 | +* [Create an individual IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users) with an access key for use in GitHub Actions workflows, preferably one per repository. Do not use the AWS account root user access key. |
| 93 | +* [Grant least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege) to the credentials used in GitHub Actions workflows. Grant only the permissions required to perform the actions in your GitHub Actions workflows. See the Permissions section below for the permissions required by this action. |
| 94 | +* [Rotate the credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials) used in GitHub Actions workflows regularly. |
| 95 | +* [Monitor the activity](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#keep-a-log) of the credentials used in GitHub Actions workflows. |
| 96 | + |
| 97 | +## Permissions |
| 98 | + |
| 99 | +This action requires the following minimum set of permissions: |
| 100 | + |
| 101 | +```json |
| 102 | +{ |
| 103 | + "Version":"2012-10-17", |
| 104 | + "Statement":[ |
| 105 | + { |
| 106 | + "Sid":"DeployService", |
| 107 | + "Effect":"Allow", |
| 108 | + "Action":[ |
| 109 | + "servicediscovery:ListServices", |
| 110 | + "servicediscovery:CreateService", |
| 111 | + "servicediscvoery:DeleteService", |
| 112 | + "servicediscovery:TagResource" |
| 113 | + ], |
| 114 | + "Resource":[ |
| 115 | + "arn:aws:servicediscovery:us-east-1:1234567890:namespace/ns-abc123" |
| 116 | + ] |
| 117 | + } |
| 118 | + ] |
| 119 | +} |
| 120 | +``` |
| 121 | + |
| 122 | + |
| 123 | +## Troubleshooting |
| 124 | + |
| 125 | +To see the debug logs, create a secret named `ACTIONS_STEP_DEBUG` with value `true` in your repository. |
| 126 | + |
| 127 | +To run this action from your workstation, you have to take into account the following bug: BASH doesn't think dashes are valid in environment variables, but Node does. You should therefore supply your environment variables with the `env` command. |
| 128 | + |
| 129 | +Please include output from the following commands when submitting issues, it'll help greatly! Don't forget to redact any sensitive data from your submission. |
| 130 | + |
| 131 | +See this example: |
| 132 | + |
| 133 | +```bash |
| 134 | +❯ env "ACTIONS_STEP_DEBUG=true" "GITHUB_WORKSPACE=$(pwd)" 'AWS_REGION=us-east-1' 'INPUT_DNS-CONFIG={"NamespaceId": "ns-abc123", "RoutingPolicy": "MULTIVALUE", "DnsRecords":[{"Type": "SRV","TTL": 10}]}' "INPUT_NAME=my-service" 'INPUT_TAGS=[{"Key": "hello", "Value": "world"}]' node index.js |
| 135 | +``` |
0 commit comments