ci: switch test-warehouse AWS auth to OIDC role (CORE-687)

.github/workflows/cleanup-stale-schemas.yml

@@ -20,6 +20,9 @@ env:
 jobs:
   cleanup:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -30,6 +33,13 @@ jobs:
           - databricks_catalog
           - athena
     steps:
+      - name: Configure AWS credentials
+        if: matrix.warehouse-type == 'athena'
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
+          aws-region: eu-west-1
+
       - name: Checkout dbt package
         uses: actions/checkout@v6
         with:

.github/workflows/test-warehouse.yml

@@ -70,6 +70,9 @@ jobs:
     defaults:
       run:
         working-directory: elementary
+    permissions:
+      contents: read
+      id-token: write
     concurrency:
       # Serialises runs for the same warehouse × dbt-version × branch.
       # The schema name is derived from a hash of this group (see "Write dbt profiles").
@@ -82,6 +85,12 @@ jobs:
           path: elementary
           ref: ${{ inputs.elementary-ref }}
 
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
+          aws-region: eu-west-1
+
       - name: Checkout dbt package
         uses: actions/checkout@v6
         with:
@@ -382,8 +391,6 @@ jobs:
       - name: Run send report
         env:
           SLACK_TOKEN: ${{ secrets.CI_SLACK_TOKEN }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AZURE_CONNECTION_STRING: ${{ secrets.AZURE_CONNECTION_STRING }}
         run: >
           edr monitor send-report
@@ -394,8 +401,6 @@ jobs:
           --slack-token "$SLACK_TOKEN"
           --slack-channel-name data-ops
           --bucket-file-path "ci_reports/report_${{ inputs.warehouse-type }}_${{ env.BRANCH_NAME }}.html"
-          --aws-access-key-id "$AWS_ACCESS_KEY_ID"
-          --aws-secret-access-key "$AWS_SECRET_ACCESS_KEY"
           --s3-bucket-name elementary-ci-artifacts
           --azure-connection-string "$AZURE_CONNECTION_STRING"
           --azure-container-name reports

tests/profiles/profiles.yml.j2

@@ -149,8 +149,7 @@ elementary_tests:
       region_name: {{ athena_region | toyaml }}
       database: awsdatacatalog
       schema: {{ schema_name }}
-      aws_access_key_id: {{ athena_aws_access_key_id | toyaml }}
-      aws_secret_access_key: {{ athena_aws_secret_access_key | toyaml }}
+      work_group: oss_tests
       threads: 4
 
 # The internal CLI dbt_project uses profile "elementary", so we alias the