mirror of
https://github.com/aws-actions/configure-aws-credentials.git
synced 2026-09-02 05:55:10 +09:00
feat: Allow audience to be explicitly specified
The default audience for the GitHub OIDC uses sts.amazonaws.com, but there are situations when it would be desirable to allow different audience names to be used instead. Allow this to be specified as an argument to the action.
This commit is contained in:
@@ -19,6 +19,7 @@ async function assumeRole(params) {
|
||||
const isDefined = i => !!i;
|
||||
|
||||
const {
|
||||
audience,
|
||||
sourceAccountId,
|
||||
roleToAssume,
|
||||
roleExternalId,
|
||||
@@ -263,6 +264,7 @@ async function run() {
|
||||
try {
|
||||
// Get inputs
|
||||
const accessKeyId = core.getInput('aws-access-key-id', { required: false });
|
||||
const audience = core.getInput('audience', { required: false });
|
||||
const secretAccessKey = core.getInput('aws-secret-access-key', { required: false });
|
||||
const region = core.getInput('aws-region', { required: true });
|
||||
const sessionToken = core.getInput('aws-session-token', { required: false });
|
||||
@@ -310,7 +312,7 @@ async function run() {
|
||||
let sourceAccountId;
|
||||
let webIdentityToken;
|
||||
if(useGitHubOIDCProvider()) {
|
||||
webIdentityToken = await core.getIDToken('sts.amazonaws.com');
|
||||
webIdentityToken = await core.getIDToken(audience);
|
||||
roleDurationSeconds = core.getInput('role-duration-seconds', {required: false}) || DEFAULT_ROLE_DURATION_FOR_OIDC_ROLES;
|
||||
// We don't validate the credentials here because we don't have them yet when using OIDC.
|
||||
} else {
|
||||
|
||||
Reference in New Issue
Block a user