feat: Allow audience to be explicitly specified

The default audience for the GitHub OIDC uses sts.amazonaws.com, but there are
situations when it would be desirable to allow different audience names to be
used instead. Allow this to be specified as an argument to the action.
This commit is contained in:
Alex Blewitt
2021-10-09 09:13:53 +01:00
parent f350a92ff6
commit 2f8dfd0ed4
3 changed files with 9 additions and 1 deletions
+3 -1
View File
@@ -19,6 +19,7 @@ async function assumeRole(params) {
const isDefined = i => !!i;
const {
audience,
sourceAccountId,
roleToAssume,
roleExternalId,
@@ -263,6 +264,7 @@ async function run() {
try {
// Get inputs
const accessKeyId = core.getInput('aws-access-key-id', { required: false });
const audience = core.getInput('audience', { required: false });
const secretAccessKey = core.getInput('aws-secret-access-key', { required: false });
const region = core.getInput('aws-region', { required: true });
const sessionToken = core.getInput('aws-session-token', { required: false });
@@ -310,7 +312,7 @@ async function run() {
let sourceAccountId;
let webIdentityToken;
if(useGitHubOIDCProvider()) {
webIdentityToken = await core.getIDToken('sts.amazonaws.com');
webIdentityToken = await core.getIDToken(audience);
roleDurationSeconds = core.getInput('role-duration-seconds', {required: false}) || DEFAULT_ROLE_DURATION_FOR_OIDC_ROLES;
// We don't validate the credentials here because we don't have them yet when using OIDC.
} else {