feat: support custom STS endpoints (#1762)

Closes #1067. This is a advanced option
and is not needed for most deployments.

src/CredentialsClient.ts

@@ -12,6 +12,7 @@ export interface CredentialsClientProps {
   region?: string;
   proxyServer?: string;
   noProxy?: string;
+  stsEndpoint?: string;
   roleChaining: boolean;
 }
 
@@ -19,6 +20,7 @@ export class CredentialsClient {
   public region?: string;
   private _stsClient?: STSClient;
   private readonly requestHandler?: NodeHttpHandler;
+  private readonly stsEndpoint?: string;
   private roleChaining?: boolean;
 
   constructor(props: CredentialsClientProps) {
@@ -41,6 +43,9 @@ export class CredentialsClient {
         httpAgent: handler,
       });
     }
+    if (props.stsEndpoint) {
+      this.stsEndpoint = props.stsEndpoint;
+    }
     this.roleChaining = props.roleChaining;
   }
 
@@ -49,9 +54,11 @@ export class CredentialsClient {
       const config = { customUserAgent: USER_AGENT } as {
         customUserAgent: string;
         region?: string;
+        endpoint?: string;
         requestHandler?: NodeHttpHandler;
       };
       if (this.region !== undefined) config.region = this.region;
+      if (this.stsEndpoint !== undefined) config.endpoint = this.stsEndpoint;
       if (this.requestHandler !== undefined) config.requestHandler = this.requestHandler;
       this._stsClient = new STSClient(config);
     }

src/index.ts

@@ -64,6 +64,7 @@ export async function run() {
       .map((s) => s.trim());
     const forceSkipOidc = getBooleanInput('force-skip-oidc', { required: false });
     const noProxy = core.getInput('no-proxy', { required: false });
+    const stsEndpoint = core.getInput('sts-endpoint', { required: false });
     const globalTimeout = Number.parseInt(core.getInput('action-timeout-s', { required: false })) || 0;
 
     let timeoutId: NodeJS.Timeout | undefined;
@@ -128,12 +129,19 @@ export async function run() {
     exportRegion(region, outputEnvCredentials);
 
     // Instantiate credentials client
-    const clientProps: { region: string; proxyServer?: string; noProxy?: string; roleChaining: boolean } = {
+    const clientProps: {
+      region: string;
+      proxyServer?: string;
+      noProxy?: string;
+      stsEndpoint?: string;
+      roleChaining: boolean;
+    } = {
       region,
       roleChaining,
     };
     if (proxyServer) clientProps.proxyServer = proxyServer;
     if (noProxy) clientProps.noProxy = noProxy;
+    if (stsEndpoint) clientProps.stsEndpoint = stsEndpoint;
     const credentialsClient = new CredentialsClient(clientProps);
     let sourceAccountId: string;
     let webIdentityToken: string;