aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-08-31 05:35:04 +09:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Merge branch 'master' into v1-node16"

Browse Source 
This reverts commit df03f9f89e, reversing
changes made to 5f641521a3.
This commit is contained in:
Tom Keller
2023-02-24 14:28:16 -08:00
parent df03f9f89e
commit afbf093795
8 changed files with 600 additions and 2305 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/package.yml
+2 -2
View File
@@ -42,10 +42,10 @@ jobs:
OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp
- name: Commit
run: |
echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}}"
git config user.name "GitHub Actions"
git config user.email "github-aws-sdk-osds-automation@amazon.com"
git remote set-url origin https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
git remote set-url origin https://x-access-token:${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
git add dist
git commit -m "chore: Update dist" || echo "No changes to commit"
git push origin
README.md
+13 -38
View File
@@ -15,7 +15,6 @@ GitHub actions has recently started throwing warning messages regarding the depr
+ [Session tagging](#session-tagging)
+ [Sample IAM Role Permissions](#sample-iam-role-cloudformation-template)
- [Self-Hosted Runners](#self-hosted-runners)
+ [Proxy Configuration](#proxy-configuration)
- [License Summary](#license-summary)
- [Security Disclosures](#security-disclosures)
@@ -93,12 +92,12 @@ The default audience is `sts.amazonaws.com` which you can replace by specifying
The following table describes which identity is used based on which values are supplied to the Action:
| **Identity Used** | `aws-access-key-id` | `role-to-assume` | `web-identity-token-file` |
| --------------------------------------------------------------- | ------------------- | ---------------- | ------------------------- |
| **Identity Used** | `aws-access-key-id` | `role-to-assume` | `web-identity-token-file` |
|------------------------------------------------------------------|---------------------|------------------|---------------------------|
| [✅ Recommended] Assume Role directly using GitHub OIDC provider | | ✔ | |
| IAM User | ✔ | | |
| Assume Role using IAM User credentials | ✔ | ✔ | |
| Assume Role using WebIdentity Token File credentials | | ✔ | ✔ |
| IAM User | ✔ | | |
| Assume Role using IAM User credentials | ✔ | ✔ | |
| Assume Role using WebIdentity Token File credentials | | ✔ | ✔ |
### Examples
@@ -204,15 +203,15 @@ For further information on OIDC and GitHub Actions, please see:
The session will have the name "GitHubActions" and be tagged with the following tags:
(`GITHUB_` environment variable definitions can be [found here](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables#default-environment-variables))
| Key | Value |
| ---------- | ----------------- |
| GitHub | "Actions" |
| Key | Value|
| --- | --- |
| GitHub | "Actions" |
| Repository | GITHUB_REPOSITORY |
| Workflow | GITHUB_WORKFLOW |
| Action | GITHUB_ACTION |
| Actor | GITHUB_ACTOR |
| Branch | GITHUB_REF |
| Commit | GITHUB_SHA |
| Workflow | GITHUB_WORKFLOW |
| Action | GITHUB_ACTION |
| Actor | GITHUB_ACTOR |
| Branch | GITHUB_REF |
| Commit | GITHUB_SHA |
_Note: all tag values must conform to [the requirements](https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html). Particularly, `GITHUB_WORKFLOW` will be truncated if it's too long. If `GITHUB_ACTOR` or `GITHUB_WORKFLOW` contain invalid characters, the characters will be replaced with an '*'._
@@ -262,30 +261,6 @@ with:
web-identity-token-file: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
```
### Proxy Configuration
If you run in self-hosted environments and in secured environment where you need use a specific proxy you can set it in the action manually.
Additionally this action will always consider already configured proxy in the environment.
Manually configured proxy:
```yaml
uses: aws-actions/configure-aws-credentials@v1
with:
aws-region: us-east-2
role-to-assume: my-github-actions-role
http-proxy: "http://companydomain.com:3128"
```
Proxy configured in the environment variable:
```bash
# Your environment configuration
HTTP_PROXY="http://companydomain.com:3128"
```
The action will read the underlying proxy configuration from the environment and you don't need to configure it in the action.
### Use with the AWS CLI
This workflow does _not_ install the [AWS CLI](https://aws.amazon.com/cli/) into your environment. Self-hosted runners that intend to run this action prior to executing `aws` commands need to have the AWS CLI [installed](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) if it's not already present.
action.yml
-3
View File
@@ -55,9 +55,6 @@ inputs:
role-skip-session-tagging:
description: 'Skip session tagging during role assumption'
required: false
http-proxy:
description: 'Proxy to use for the AWS SDK agent'
required: false
outputs:
aws-account-id:
description: 'The AWS account ID for the provided credentials'
dist/index.js
Vendored
+198 -1764
View File
File diff suppressed because one or more lines are too long
index.js
-25
View File
@@ -3,7 +3,6 @@ const aws = require('aws-sdk');
const assert = require('assert');
const fs = require('fs');
const path = require('path');
const proxy = require('https-proxy-agent');
// Use 1hr as role duration when using session token or OIDC
// Otherwise, use the max duration of GitHub action (6hr)
@@ -261,26 +260,6 @@ const retryAndBackoff = async (fn, isRetryable, retries = 0, maxRetries = 12, ba
}
}
function configureProxy(proxyServer) {
const proxyFromEnv = process.env.HTTP_PROXY || process.env.http_proxy;
if (proxyFromEnv || proxyServer) {
let proxyToSet = null;
if (proxyServer){
console.log(`Setting proxy from actions input: ${proxyServer}`);
proxyToSet = proxyServer;
} else {
console.log(`Setting proxy from environment: ${proxyFromEnv}`);
proxyToSet = proxyFromEnv;
}
aws.config.update({
httpOptions: { agent: proxy(proxyToSet) }
});
}
}
async function run() {
try {
// Get inputs
@@ -299,7 +278,6 @@ async function run() {
const roleSkipSessionTaggingInput = core.getInput('role-skip-session-tagging', { required: false })|| 'false';
const roleSkipSessionTagging = roleSkipSessionTaggingInput.toLowerCase() === 'true';
const webIdentityTokenFile = core.getInput('web-identity-token-file', { required: false });
const proxyServer = core.getInput('http-proxy', { required: false });
if (!region.match(REGION_REGEX)) {
throw new Error(`Region is not valid: ${region}`);
@@ -329,9 +307,6 @@ async function run() {
exportCredentials({accessKeyId, secretAccessKey, sessionToken});
}
// Configures proxy
configureProxy(proxyServer);
// Attempt to load credentials from the GitHub OIDC provider.
// If a user provides an IAM Role Arn and DOESN'T provide an Access Key Id
index.test.js
+1 -71
View File
@@ -2,7 +2,6 @@ const core = require('@actions/core');
const assert = require('assert');
const aws = require('aws-sdk');
const { run, withSleep, reset } = require('./index.js');
const proxy = require('https-proxy-agent');
jest.mock('@actions/core');
@@ -34,7 +33,6 @@ function mockGetInput(requestResponse) {
return requestResponse[name]
}
}
const CREDS_INPUTS = {
'aws-access-key-id': FAKE_ACCESS_KEY_ID,
'aws-secret-access-key': FAKE_SECRET_ACCESS_KEY
@@ -54,8 +52,7 @@ const mockStsAssumeRoleWithWebIdentity = jest.fn();
jest.mock('aws-sdk', () => {
return {
config: {
getCredentials: jest.fn(),
update: jest.fn(),
getCredentials: jest.fn()
},
STS: jest.fn(() => ({
getCallerIdentity: mockStsCallerIdentity,
@@ -130,9 +127,6 @@ describe('Configure AWS Credentials', () => {
callback(null);
});
aws.config.update.mockReset();
aws.config.update.mockImplementationOnce();
mockStsAssumeRole.mockImplementation(() => {
return {
promise() {
@@ -810,68 +804,4 @@ describe('Configure AWS Credentials', () => {
await run();
});
describe('proxy settings', () => {
test('setting proxy with actions input', async () => {
const EXPECTED_PROXY = 'http://test.me'
core.getInput = jest
.fn()
.mockImplementation(
mockGetInput({ ...DEFAULT_INPUTS, 'http-proxy': EXPECTED_PROXY })
);
await run();
expect(aws.config.update).toHaveBeenCalledTimes(1);
expect(aws.config.update).toHaveBeenCalledWith({
httpOptions: { agent: proxy(EXPECTED_PROXY) }
});
});
test('setting proxy from environment vars', async () => {
const EXPECTED_PROXY = 'http://test.me'
process.env.HTTP_PROXY = EXPECTED_PROXY;
core.getInput = jest
.fn()
.mockImplementation(
mockGetInput({ ...DEFAULT_INPUTS })
);
await run();
expect(aws.config.update).toHaveBeenCalledTimes(1);
expect(aws.config.update).toHaveBeenCalledWith({
httpOptions: { agent: proxy(EXPECTED_PROXY) }
});
});
test('setting proxy - prefer action input', async () => {
const EXPECTED_PROXY = 'http://test.me'
const FALSE_PROXY = 'http://env.me'
process.env.HTTP_PROXY = FALSE_PROXY;
core.getInput = jest
.fn()
.mockImplementation(
mockGetInput({ ...DEFAULT_INPUTS, 'http-proxy': EXPECTED_PROXY })
);
await run();
expect(aws.config.update).toHaveBeenCalledTimes(1);
expect(aws.config.update).toHaveBeenCalledWith({
httpOptions: { agent: proxy(EXPECTED_PROXY) }
});
});
test('ignoring proxy - without anything set', async () => {
core.getInput = jest
.fn()
.mockImplementation(
mockGetInput({ ...DEFAULT_INPUTS})
);
await run();
expect(aws.config.update).toHaveBeenCalledTimes(0);
});
});
});
package-lock.json
Generated
+381 -396
View File
File diff suppressed because it is too large Load Diff
package.json
+5 -6
View File
@@ -26,13 +26,12 @@
"homepage": "https://github.com/aws-actions/configure-aws-credentials#readme",
"dependencies": {
"@actions/core": "^1.10.0",
"aws-sdk": "^2.1273.0",
"axios": "^1.2.2",
"https-proxy-agent": "^5.0.1"
"aws-sdk": "^2.1319.0",
"axios": "^1.3.3"
},
"devDependencies": {
"@vercel/ncc": "^0.36.0",
"eslint": "^8.31.0",
"jest": "^29.3.1"
"@vercel/ncc": "^0.36.1",
"eslint": "^8.34.0",
"jest": "^29.4.3"
}
}