GH-50899: [CI][C++] Use OIDC instead of ACCESS_KEY and SECRET_KEY for sccache's s3 creds

compose.yaml

@@ -73,6 +73,7 @@ x-cpp: &cpp
 x-sccache: &sccache
   AWS_ACCESS_KEY_ID:
   AWS_SECRET_ACCESS_KEY:
+  AWS_SESSION_TOKEN:
   SCCACHE_BUCKET:
   SCCACHE_REGION:
   SCCACHE_S3_KEY_PREFIX: ${SCCACHE_S3_KEY_PREFIX:-sccache}

dev/tasks/docker-tests/github.linux.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   test:
     name: |
@@ -31,6 +36,7 @@ jobs:
       {{ macros.github_free_space()|indent }}
       {{ macros.github_install_archery()|indent }}
 
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Execute Docker Build
         shell: bash
         env:

dev/tasks/macros.jinja

@@ -26,6 +26,7 @@ on:
 
 env:
   ARCHERY_DEBUG: 1
+  SCCACHE_ENABLED: {{ "${{ secrets.SCCACHE_REGION != '' }}" }}
 {% endmacro %}
 
 {%- macro github_checkout_arrow(fetch_depth=1, submodules="recursive", action_v="4") -%}
@@ -287,10 +288,23 @@ env:
   {% endif %}
 {%- endmacro -%}
 
+{%- macro github_configure_aws_credentials() -%}
+  - name: Configure AWS credentials for sccache
+    if: env.SCCACHE_ENABLED == 'true'
+    # don't fail the build if AWS credentials are unavailable
+    continue-on-error: true
+    uses: aws-actions/configure-aws-credentials@v6
+    with:
+      aws-region: {{ '${{ secrets.SCCACHE_REGION }}' }}
+      role-to-assume: {{ '${{ secrets.AWS_ROLE_ARN }}' }}
+      role-duration-seconds: 14400
+{% endmacro %}
+
 {% macro github_set_sccache_envvars(sccache_key_prefix = "sccache") %}
   {% set sccache_vars =  {
-            "AWS_ACCESS_KEY_ID": '${{ secrets.AWS_ACCESS_KEY_ID }}',
-            "AWS_SECRET_ACCESS_KEY": '${{ secrets.AWS_SECRET_ACCESS_KEY }}',
+            "AWS_ACCESS_KEY_ID": '${{ env.AWS_ACCESS_KEY_ID }}',
+            "AWS_SECRET_ACCESS_KEY": '${{ env.AWS_SECRET_ACCESS_KEY }}',
+            "AWS_SESSION_TOKEN": '${{ env.AWS_SESSION_TOKEN }}',
             "SCCACHE_BUCKET": '${{ secrets.SCCACHE_BUCKET }}',
             "SCCACHE_REGION": '${{ secrets.SCCACHE_REGION }}',
             "SCCACHE_S3_KEY_PREFIX": sccache_key_prefix

dev/tasks/matlab/github.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: write
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
 
   ubuntu:
@@ -32,6 +37,7 @@ jobs:
         uses: matlab-actions/setup-matlab@v2
         with:
           release: R2025b
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Build MATLAB Interface
         env:
         {{ macros.github_set_sccache_envvars()|indent(8) }}
@@ -74,6 +80,7 @@ jobs:
         uses: matlab-actions/setup-matlab@v2
         with:
           release: R2025b
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Build MATLAB Interface
         env:
         {{ macros.github_set_sccache_envvars()|indent(8) }}
@@ -103,6 +110,7 @@ jobs:
       - name: Install sccache
         shell: bash
         run: arrow/ci/scripts/install_sccache.sh pc-windows-msvc $(pwd)/sccache
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Build MATLAB Interface
         shell: cmd
         env:

dev/tasks/python-wheels/github.linux.yml

@@ -21,6 +21,8 @@
 
 permissions:
   packages: write
+  # For OIDC token for sccache
+  id-token: write
 
 jobs:
   build:
@@ -65,6 +67,7 @@ jobs:
           fi
           echo "TEST_IMAGE_PREFIX=${test_image_prefix}" >> ${GITHUB_ENV}
 
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Build wheel
         shell: bash
         env:

dev/tasks/r/github.linux.arrow.version.back.compat.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   write-files:
     name: "Write files"
@@ -44,6 +49,7 @@ jobs:
         shell: Rscript {0}
       - name: Install sccache
         run: arrow/ci/scripts/install_sccache.sh unknown-linux-musl /usr/local/bin
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Install Arrow
         env:
         {{ macros.github_set_sccache_envvars()|indent(8) }}

dev/tasks/r/github.linux.cran.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   as-cran:
     name: "rhub/{{ '${{ matrix.config.r_image }}' }}"
@@ -43,6 +48,7 @@ jobs:
       {{ macros.github_checkout_arrow()|indent }}
       {{ macros.github_install_archery()|indent }}
 
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Docker Run
         shell: bash
         env:

dev/tasks/r/github.linux.offline.build.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   grab-dependencies:
     name: "Download thirdparty dependencies"
@@ -77,6 +82,7 @@ jobs:
           install.packages(c("remotes", "glue", "sys"))
           remotes::install_deps("arrow/r", dependencies = TRUE)
         shell: Rscript {0}
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Install
         env:
           ARROW_OFFLINE_BUILD: true

dev/tasks/r/github.linux.sanitizers.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   r-linux-sanitizers:
     name: "rhub/{{ '${{ matrix.config.r_image }}' }}"
@@ -41,6 +46,7 @@ jobs:
       {{ macros.github_checkout_arrow()|indent }}
       {{ macros.github_install_archery()|indent }}
 
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Docker Run
         shell: bash
         env:

dev/tasks/r/github.linux.versions.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   r-versions:
     name: "posit/r-base:{{ MATRIX }}-jammy"
@@ -43,6 +48,7 @@ jobs:
       {{ macros.github_checkout_arrow()|indent }}
       {{ macros.github_install_archery()|indent }}
 
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Docker Run
         shell: bash
         env:

dev/tasks/r/github.macos-linux.local.yml

@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   local:
     name: "install from local source"
@@ -78,6 +83,7 @@ jobs:
           extra-packages: |
             any::rcmdcheck
             any::sys
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Install
         env:
           _R_CHECK_CRAN_INCOMING_: false

dev/tasks/r/github.packages.yml

@@ -21,6 +21,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: write
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   source:
     # This job will change the version to either the custom_version param or YMD format.
@@ -77,6 +82,7 @@ jobs:
           brew install sccache ninja
           brew install openssl@3.0
           brew install libxml2
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Build libarrow
         shell: bash
         env:
@@ -132,6 +138,7 @@ jobs:
       {{ macros.github_checkout_arrow()|indent }}
       {{ macros.github_change_r_pkg_version(is_fork, '${{ needs.source.outputs.pkg_version }}')|indent }}
       {{ macros.github_install_archery()|indent }}
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Build libarrow
         shell: bash
         env:
@@ -182,6 +189,7 @@ jobs:
       - name: Install sccache
         shell: bash
         run: arrow/ci/scripts/install_sccache.sh pc-windows-msvc $(pwd)/sccache
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Build Arrow C++ with rtools40
         shell: bash
         env:
@@ -387,6 +395,7 @@ jobs:
         run: |
           cores=`nproc || sysctl -n hw.logicalcpu`
           echo "MAKEFLAGS=-j$cores" >> $GITHUB_ENV
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Install arrow source package
         env:
           # Test source build so be sure not to download a binary