aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-02 05:55:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

chore: document container credentials provider support (and delete transitive tags in AssumeRoleWithWebIdentity) (#1780)

Browse Source 
* chore: document container credentials provider support (and delete transitive tags in AssumeRoleWithWebIdentity)

Closes #1546
Closes #942

Documents that eks and codebuild work when using the role-chaining flag.

* revert force-skip-oidc changes

* README changes for Container Credentials and adding missing input options

* linting

---------

Co-authored-by: Michael Lehmann <lehmanmj@amazon.com>
This commit is contained in:
Tom Keller
2026-05-27 13:42:45 -07:00
committed by GitHub
parent dbacf3135e
commit 77cd089899
4 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+11
View File
@@ -168,6 +168,7 @@ detail.
| role-session-name | Defaults to "GitHubActions", but may be changed if required. | No |
| role-skip-session-tagging | Skips session tagging if set. | No |
| transitive-tag-keys | Define a list of transitive tag keys to pass when assuming a role. | No |
| custom-tags | Additional tags to apply to the assumed role session. Must be a JSON object provided as a string. Custom tags are not usable with OIDC or web identity token authentication. | No |
| inline-session-policy | You may further restrict the assumed role policy by defining an inline policy here. | No |
| managed-session-policies | You may further restrict the assumed role policy by specifying a managed policy here. | No |
| output-credentials | When set, outputs fetched credentials as action step output. (Outputs aws-access-key-id, aws-secret-access-key, aws-session-token, aws-account-id, authenticated-arn, and aws-expiration). Defaults to false. | No |
@@ -180,6 +181,8 @@ detail.
| allowed-account-ids | A comma-delimited list of expected AWS account IDs. The action will fail if we receive credentials for the wrong account. | No |
| force-skip-oidc | When set, the action will skip using GitHub OIDC provider even if the id-token permission is set. | No |
| action-timeout-s | Global timeout for the action in seconds. If set to a value greater than 0, the action will fail if it takes longer than this time to complete. | No |
| no-proxy | Hosts to skip for the proxy configuration. | No |
| sts-endpoint | Custom STS endpoint URL. Use this to point to an STS-compatible API (e.g. MinIO, LocalStack) instead of the default AWS STS endpoint for the region. | No |
</details>
@@ -617,6 +620,14 @@ For further information on OIDC and GitHub Actions, please see:
- [GitHub docs: Configuring OpenID Connect in Amazon Web Services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
- [GitHub changelog: GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/)
## Running in AWS Containers
To run this action using self-hosted action runners on AWS Containers such as
Codebuild or EKS, you may need to set `role-chaining: true`.
If you are using EKS and encountering an error related to the packed size of
session tags, set `role-skip-session-tagging: true`.
## Compatibility with non-GitHub Actions environments
This action has been sucessfully tested with