aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-02 05:55:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce allowed-account-ids on the use-existing-credentials path

Browse Source 
The early return for valid pre-existing credentials skipped the
allowed-account-ids check, now included.
This commit is contained in:
Tom Keller
2026-08-31 11:59:08 -07:00
parent ed5da29eb9
commit 1f2d3ed486
3 changed files with 40 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/index.test.ts
+27
View File
@@ -1015,6 +1015,33 @@ describe('Configure AWS Credentials', {}, () => {
await run();
expect(core.setFailed).not.toHaveBeenCalled();
});
it('fails on the use-existing-credentials path when the account is not allowed', async () => {
vi.mocked(core.getInput).mockImplementation(
mocks.getInput({
...mocks.USE_EXISTING_CREDENTIALS_INPUTS,
'allowed-account-ids': '999999999999',
}),
);
mockedSTSClient.on(GetCallerIdentityCommand).resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
await run();
expect(core.setFailed).toHaveBeenCalledWith(expect.stringContaining('does not match'));
});
it('reuses existing credentials when their account is allowed', async () => {
vi.mocked(core.getInput).mockImplementation(
mocks.getInput({
...mocks.USE_EXISTING_CREDENTIALS_INPUTS,
'allowed-account-ids': '111111111111',
}),
);
mockedSTSClient.on(GetCallerIdentityCommand).resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
await run();
expect(core.notice).toHaveBeenCalledWith('Pre-existing credentials are valid. No need to generate new ones.');
expect(core.setFailed).not.toHaveBeenCalled();
});
});
describe('Global Timeout Configuration', {}, () => {