Update Github token in Codepipeline with Cloudformation
Tags: website, aws, cloudformation, codepipeline
Published: 2024-03-25 08:38:32

---
title: Update Github token in Codepipeline with Cloudformation
published: true
date: 2024-03-25 14:12:32 UTC
tags: Website,AWS,Cloudformation,Codepipeline
canonical_url: https://marcoaguzzi.it/2024/03/25/secret-to-github/
---

## The use case

This post comes from the fact that the token used by Codepipeline to connect to Github to download the source code of the website has expired. Hence, the automation “push and update the website” is not working. Here’s the error:

![Error in pipeline](https://marcoaguzzi.it/img/secret-github/codepipeline-insufficient-permission.png "Error in pipeline")

Let’s view how the secret is stored into cloudformation, and how codepipeline can connect.

## The secret stack

The cloudformation stack is quite easy. It does not have any hard dependency on other stacks, and it’s used both to download code for dev and prod website.
 
```
{
 "AWSTemplateFormatVersion": "2010-09-09",
 "Parameters": {
 "GithubOAuthTokenParameter": {
 "Description": "Github OAuth Token",
 "NoEcho": "true",
 "Type": "String"
 }
 },
 "Resources": {
 "GithubOAuthToken": {
 "Properties": {
 "Name": "GithubOAuthToken",
 "SecretString": {
 "Ref": "GithubOAuthTokenParameter"
 }
 },
 "Type": "AWS::SecretsManager::Secret"
 }
 }
}

```

The next part of the post is dedicated on how to create and use this cloudformation template

### Create stack

```
aws cloudformation create-stack --stack-name secrets-stack `
--template-body file://secrets-stack.json `
--parameters file://secret-token-sample.json

```

The _secret-stacks.json_ refers to the code just shown before, and the _secret-token-sample.json_ file is written with the parameter syntax. Here’s a sample:

```
[
 {
 "ParameterKey": "GithubOAuthTokenParameter",
 "ParameterValue": "sample value",
 "UsePreviousValue": false
 }
]

```

### Check stack resources

```
aws cloudformation list-stack-resources `
--stack-name secrets-stack `
--query 'StackResourceSummaries[\*].[LogicalResourceId,ResourceType,ResourceStatus]'

```

The output is quite straightforward (the stack was already created when I re-ran the command)

```
[
 [
 "GithubOAuthToken",
 "AWS::SecretsManager::Secret",
 "UPDATE\_COMPLETE"
 ]
]

```

This is how the resource appears in AWS ui, once created (the output of the CLI is just the ARN of the stack).

![Secret AWS](https://marcoaguzzi.it/img/secret-github/secret-aws.png "Secret AWS")

The actual value (the one that’s expired) of the token can be viewed by clicking on the retrieve secret value button. Time to move to Github and generate the new token

## Github account setting

While logged in into the Github profile where the repository with the code is kept, go to settings page, and then move to developer settings. Click on “fine grained tokens”:

![Fine grained tokens](https://marcoaguzzi.it/img/secret-github/secret-setting-1.png "Fine grained tokens")

Clicking on _AWS CP_ shows the token settings. It can be seen that it grants read-only access to one repository and no user permission. Of course the actual key cannot be seen anymore, it’s only possible to regenerate it.

![Token grants](https://marcoaguzzi.it/img/secret-github/secret-setting-2.png "Token grants")

Click on regenerate token

![Regenerate step 1](https://marcoaguzzi.it/img/secret-github/regenerate-1.png "Regenerate step 1")

Confirm the token regeneration. The token will be visile only for it to be copied

![Regenerate step 2](https://marcoaguzzi.it/img/secret-github/regenerate-2.png "Regenerate step 2")

## Cloudformation update

Now that the token is in our hands, we can update the cloudformation stack by putting the token in the place of “sample value” shown before and then issuing

```
aws cloudformation update-stack --stack-name secrets-stack `
--template-body file://secrets-stack.json `
--parameters file://secret-token-sample.json

```

Let’s check the stack after the update

### Check stack

```
aws cloudformation describe-stacks --stack-name secrets-stack `
--query '[Stacks[0].[StackName,StackStatus,Parameters],Stacks[0].Outputs]'

```#### Output

The _null_ value is because there are no outputs to be used by other stacks. Please note that in the template file _GithubOAuthTokenParameter_ is reported as _“NoEcho”: “true”_. In this way the real token won’t be shown neither in output logs nor in the Cloudformation ui.
  
```
[
 [
 "secrets-stack",
 "UPDATE\_COMPLETE",
 [
 {
 "ParameterKey": "GithubOAuthTokenParameter",
 "ParameterValue": "\*\*\*\*"
 }
 ]
 ],
 null
]

```

The token is then actually used in code pipeline

![Github secret in codepipeline](https://marcoaguzzi.it/img/secret-github/secret-aws-codepipeline.png "Github secret in codepipeline")

And the cloudformation code hosting the reference to the token is:

```
"Configuration": {
 "Branch": { "Ref": "RepoBranchParameter" },
 "OAuthToken": "{{resolve:secretsmanager:GithubOAuthToken}}",
 "Owner": {"Ref":"RepoOwnerParameter" },
 ...
},

```


## Refresh and restart the pipeline

Navigate the AWS UI in Codepipelines, select the pipeline, click edit pipeline:

![Edit pipeline](https://marcoaguzzi.it/img/secret-github/edit_pipeline.png "Edit pipeline")

Search for the button “Edit stage” on the source stage:

![Edit stage](https://marcoaguzzi.it/img/secret-github/edit_stage.png "Edit stage")

Click it, and then search for the pencil in the “Github download” box:

![Edit Github](https://marcoaguzzi.it/img/secret-github/edit_stage_pencil.png "Edit Github")

Even if repository and branch are selected, click on “Connect to Github”

![Connect to Github](https://marcoaguzzi.it/img/secret-github/connect_to_github.png "Connect to Github")

A pop-up will appear asking the oauth confirmation, click it

![OAuth request](https://marcoaguzzi.it/img/secret-github/oauth_request.png "OAuth request")

Insert repository and branch in their respective fields (a popup should appear, letting you select)

![Respository and branch](https://marcoaguzzi.it/img/secret-github/repo_and_branch.png "Respository and branch")

Scroll to the bottom of the page and click done to save (actually refresh) the changes. Now you can trigger a new pipeline and it should connect with the repo and dowload the code.

![Codepipeline ok](https://marcoaguzzi.it/img/secret-github/codepipeline-ok.png "Codepipeline ok")

Next time I’ll check how to automate the pipeline refresh via clouformation CLI.

Thanks for reading it all!