From d5f3f20521f0f617483f3d2bc196531b3dfd4f8c Mon Sep 17 00:00:00 2001
From: "paul@iqmo.com" <paul@iqmo.com>
Date: Fri, 28 Aug 2026 16:45:11 -0400
Subject: [PATCH 1/2] ci: use oidc for sccache s3 short term credentials

---
 compose.yaml                            |  1 +
 dev/tasks/docker-tests/github.linux.yml |  6 ++++++
 dev/tasks/macros.jinja                  | 16 ++++++++++++++--
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/compose.yaml b/compose.yaml
index 00e791ccea18..48a1bb060a17 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -73,6 +73,7 @@ x-cpp: &cpp
 x-sccache: &sccache
   AWS_ACCESS_KEY_ID:
   AWS_SECRET_ACCESS_KEY:
+  AWS_SESSION_TOKEN:
   SCCACHE_BUCKET:
   SCCACHE_REGION:
   SCCACHE_S3_KEY_PREFIX: ${SCCACHE_S3_KEY_PREFIX:-sccache}
diff --git a/dev/tasks/docker-tests/github.linux.yml b/dev/tasks/docker-tests/github.linux.yml
index a893432cf941..afb0e1569eea 100644
--- a/dev/tasks/docker-tests/github.linux.yml
+++ b/dev/tasks/docker-tests/github.linux.yml
@@ -19,6 +19,11 @@
 
 {{ macros.github_header() }}
 
+permissions:
+  contents: read
+  # For OIDC token for sccache
+  id-token: write
+
 jobs:
   test:
     name: |
@@ -31,6 +36,7 @@ jobs:
       {{ macros.github_free_space()|indent }}
       {{ macros.github_install_archery()|indent }}
 
+      {{ macros.github_configure_aws_credentials()|indent }}
       - name: Execute Docker Build
         shell: bash
         env:
diff --git a/dev/tasks/macros.jinja b/dev/tasks/macros.jinja
index 8e9a41b46b75..db550024b8e3 100644
--- a/dev/tasks/macros.jinja
+++ b/dev/tasks/macros.jinja
@@ -26,6 +26,7 @@ on:
 
 env:
   ARCHERY_DEBUG: 1
+  SCCACHE_OIDC_ROLE: {{ '${{ secrets.AWS_ROLE_ARN }}' }}
 {% endmacro %}
 
 {%- macro github_checkout_arrow(fetch_depth=1, submodules="recursive", action_v="4") -%}
@@ -287,10 +288,21 @@ env:
   {% endif %}
 {%- endmacro -%}
 
+{%- macro github_configure_aws_credentials() -%}
+  - name: Configure AWS credentials for sccache
+    if: env.SCCACHE_OIDC_ROLE != ''
+    uses: aws-actions/configure-aws-credentials@v6
+    with:
+      aws-region: {{ '${{ secrets.SCCACHE_REGION }}' }}
+      role-to-assume: {{ '${{ env.SCCACHE_OIDC_ROLE }}' }}
+      role-duration-seconds: 14400
+{% endmacro %}
+
 {% macro github_set_sccache_envvars(sccache_key_prefix = "sccache") %}
   {% set sccache_vars =  {
-            "AWS_ACCESS_KEY_ID": '${{ secrets.AWS_ACCESS_KEY_ID }}',
-            "AWS_SECRET_ACCESS_KEY": '${{ secrets.AWS_SECRET_ACCESS_KEY }}',
+            "AWS_ACCESS_KEY_ID": '${{ env.AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}',
+            "AWS_SECRET_ACCESS_KEY": '${{ env.AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}',
+            "AWS_SESSION_TOKEN": '${{ env.AWS_SESSION_TOKEN }}',
             "SCCACHE_BUCKET": '${{ secrets.SCCACHE_BUCKET }}',
             "SCCACHE_REGION": '${{ secrets.SCCACHE_REGION }}',
             "SCCACHE_S3_KEY_PREFIX": sccache_key_prefix

From a6306645bec9da971cce8038c112d76f55db7dca Mon Sep 17 00:00:00 2001
From: "paul@iqmo.com" <paul@iqmo.com>
Date: Mon, 31 Aug 2026 22:28:00 -0400
Subject: [PATCH 2/2] ci: use SCCACHE_ENABLED env var, rather than copying
 AWS_ROLE_ARN to env. Remove references to unneeded secrets.

---
 dev/tasks/macros.jinja | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/dev/tasks/macros.jinja b/dev/tasks/macros.jinja
index db550024b8e3..386abe62098c 100644
--- a/dev/tasks/macros.jinja
+++ b/dev/tasks/macros.jinja
@@ -26,7 +26,7 @@ on:
 
 env:
   ARCHERY_DEBUG: 1
-  SCCACHE_OIDC_ROLE: {{ '${{ secrets.AWS_ROLE_ARN }}' }}
+  SCCACHE_ENABLED: {{ "${{ secrets.SCCACHE_REGION != '' }}" }}
 {% endmacro %}
 
 {%- macro github_checkout_arrow(fetch_depth=1, submodules="recursive", action_v="4") -%}
@@ -290,18 +290,18 @@ env:
 
 {%- macro github_configure_aws_credentials() -%}
   - name: Configure AWS credentials for sccache
-    if: env.SCCACHE_OIDC_ROLE != ''
+    if: env.SCCACHE_ENABLED == 'true'
     uses: aws-actions/configure-aws-credentials@v6
     with:
       aws-region: {{ '${{ secrets.SCCACHE_REGION }}' }}
-      role-to-assume: {{ '${{ env.SCCACHE_OIDC_ROLE }}' }}
+      role-to-assume: {{ '${{ secrets.AWS_ROLE_ARN }}' }}
       role-duration-seconds: 14400
 {% endmacro %}
 
 {% macro github_set_sccache_envvars(sccache_key_prefix = "sccache") %}
   {% set sccache_vars =  {
-            "AWS_ACCESS_KEY_ID": '${{ env.AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}',
-            "AWS_SECRET_ACCESS_KEY": '${{ env.AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}',
+            "AWS_ACCESS_KEY_ID": '${{ env.AWS_ACCESS_KEY_ID }}',
+            "AWS_SECRET_ACCESS_KEY": '${{ env.AWS_SECRET_ACCESS_KEY }}',
             "AWS_SESSION_TOKEN": '${{ env.AWS_SESSION_TOKEN }}',
             "SCCACHE_BUCKET": '${{ secrets.SCCACHE_BUCKET }}',
             "SCCACHE_REGION": '${{ secrets.SCCACHE_REGION }}',