mirror of
https://github.com/aws-actions/configure-aws-credentials.git
synced 2026-09-02 05:55:10 +09:00
Allow inline session policies for assuming role (#739)
* Allow to pass inline session policy as a parameter Update the action file Regenerate the dist/ content Add test * Fix typos * Fix stylistic error * Move the inline policy logic to allow assumeRole to use it as well; Update and add tests * Add an option for managed policies * Regenerate the dist/ files * Use multiline input for managed policies * Update readme * Update readme --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
This commit is contained in:
Dimitar
+144
@@ -45,6 +45,7 @@ const DEFAULT_INPUTS = {
|
||||
'aws-region': FAKE_REGION,
|
||||
'mask-aws-account-id': 'TRUE'
|
||||
};
|
||||
const DEFAULT_MULTILINE_INPUTS = {}
|
||||
const ASSUME_ROLE_INPUTS = {...CREDS_INPUTS, 'role-to-assume': ROLE_ARN, 'aws-region': FAKE_REGION};
|
||||
|
||||
const mockStsCallerIdentity = jest.fn();
|
||||
@@ -90,6 +91,10 @@ describe('Configure AWS Credentials', () => {
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput(DEFAULT_INPUTS));
|
||||
|
||||
core.getMultilineInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput(DEFAULT_MULTILINE_INPUTS));
|
||||
|
||||
core.getIDToken = jest
|
||||
.fn()
|
||||
.mockImplementation(() => {
|
||||
@@ -624,6 +629,49 @@ describe('Configure AWS Credentials', () => {
|
||||
})
|
||||
});
|
||||
|
||||
test('Web identity token file with a inline session policy', async () => {
|
||||
const CUSTOM_SESSION_POLICY = "{ super_secure_policy }";
|
||||
core.getInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({'role-to-assume': ROLE_ARN, 'aws-region': FAKE_REGION, 'web-identity-token-file': '/fake/token/file', 'inline-session-policy': CUSTOM_SESSION_POLICY}));
|
||||
|
||||
await run();
|
||||
expect(mockStsAssumeRoleWithWebIdentity).toHaveBeenCalledWith({
|
||||
RoleArn: 'arn:aws:iam::111111111111:role/MY-ROLE',
|
||||
RoleSessionName: 'GitHubActions',
|
||||
DurationSeconds: 6 * 3600,
|
||||
Policy: CUSTOM_SESSION_POLICY,
|
||||
WebIdentityToken: 'testpayload'
|
||||
})
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(1, FAKE_ACCOUNT_ID);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(2, FAKE_STS_ACCESS_KEY_ID);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(3, FAKE_STS_SECRET_ACCESS_KEY);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(4, FAKE_STS_SESSION_TOKEN);
|
||||
});
|
||||
|
||||
test('Web identity token file with a managed session policies', async () => {
|
||||
const MANAGED_SESSION_POLICIES = ["arn:aws:iam::111111111111:policy/foo", "arn:aws:iam::111111111111:policy/bar"];
|
||||
core.getInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({'role-to-assume': ROLE_ARN, 'aws-region': FAKE_REGION, 'web-identity-token-file': '/fake/token/file'}));
|
||||
core.getMultilineInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({'managed-session-policies': MANAGED_SESSION_POLICIES}))
|
||||
|
||||
await run();
|
||||
expect(mockStsAssumeRoleWithWebIdentity).toHaveBeenCalledWith({
|
||||
RoleArn: 'arn:aws:iam::111111111111:role/MY-ROLE',
|
||||
RoleSessionName: 'GitHubActions',
|
||||
DurationSeconds: 6 * 3600,
|
||||
PolicyArns: [{arn: MANAGED_SESSION_POLICIES[0]}, {arn: MANAGED_SESSION_POLICIES[1]}],
|
||||
WebIdentityToken: 'testpayload'
|
||||
})
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(1, FAKE_ACCOUNT_ID);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(2, FAKE_STS_ACCESS_KEY_ID);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(3, FAKE_STS_SECRET_ACCESS_KEY);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(4, FAKE_STS_SESSION_TOKEN);
|
||||
});
|
||||
|
||||
test('only role arn and region provided to use GH OIDC Token', async () => {
|
||||
process.env.GITHUB_ACTIONS = 'true';
|
||||
process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'test-token';
|
||||
@@ -664,6 +712,51 @@ describe('Configure AWS Credentials', () => {
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(3, FAKE_STS_SESSION_TOKEN);
|
||||
});
|
||||
|
||||
test('GH OIDC With inline session policy', async () => {
|
||||
const CUSTOM_SESSION_POLICY = "{ super_secure_policy }";
|
||||
process.env.GITHUB_ACTIONS = 'true';
|
||||
process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'test-token';
|
||||
core.getInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({'role-to-assume': ROLE_ARN, 'aws-region': FAKE_REGION, 'inline-session-policy': CUSTOM_SESSION_POLICY}));
|
||||
|
||||
await run();
|
||||
expect(mockStsAssumeRoleWithWebIdentity).toHaveBeenCalledWith({
|
||||
RoleArn: 'arn:aws:iam::111111111111:role/MY-ROLE',
|
||||
RoleSessionName: 'GitHubActions',
|
||||
DurationSeconds: 3600,
|
||||
Policy: CUSTOM_SESSION_POLICY,
|
||||
WebIdentityToken: 'testtoken'
|
||||
});
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(1, FAKE_STS_ACCESS_KEY_ID);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(2, FAKE_STS_SECRET_ACCESS_KEY);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(3, FAKE_STS_SESSION_TOKEN);
|
||||
});
|
||||
|
||||
test('GH OIDC With managed session policy', async () => {
|
||||
const MANAGED_SESSION_POLICIES = ["arn:aws:iam::111111111111:policy/foo", "arn:aws:iam::111111111111:policy/bar"];
|
||||
process.env.GITHUB_ACTIONS = 'true';
|
||||
process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'test-token';
|
||||
core.getInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({'role-to-assume': ROLE_ARN, 'aws-region': FAKE_REGION}));
|
||||
core.getMultilineInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({'managed-session-policies': MANAGED_SESSION_POLICIES}))
|
||||
|
||||
await run();
|
||||
expect(mockStsAssumeRoleWithWebIdentity).toHaveBeenCalledWith({
|
||||
RoleArn: 'arn:aws:iam::111111111111:role/MY-ROLE',
|
||||
RoleSessionName: 'GitHubActions',
|
||||
DurationSeconds: 3600,
|
||||
PolicyArns: [{arn: MANAGED_SESSION_POLICIES[0]}, {arn: MANAGED_SESSION_POLICIES[1]}],
|
||||
WebIdentityToken: 'testtoken'
|
||||
});
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(1, FAKE_STS_ACCESS_KEY_ID);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(2, FAKE_STS_SECRET_ACCESS_KEY);
|
||||
expect(core.setSecret).toHaveBeenNthCalledWith(3, FAKE_STS_SESSION_TOKEN);
|
||||
});
|
||||
|
||||
test('role assumption fails after maximun trials using OIDC Provider', async () => {
|
||||
process.env.GITHUB_ACTIONS = 'true';
|
||||
process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'test-token';
|
||||
@@ -704,6 +797,57 @@ describe('Configure AWS Credentials', () => {
|
||||
})
|
||||
});
|
||||
|
||||
test('inline session policy provided', async () => {
|
||||
const CUSTOM_SESSION_POLICY = "{ super_secure_policy }";
|
||||
core.getInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({...ASSUME_ROLE_INPUTS, 'inline-session-policy': CUSTOM_SESSION_POLICY}));
|
||||
|
||||
await run();
|
||||
expect(mockStsAssumeRole).toHaveBeenCalledWith({
|
||||
RoleArn: ROLE_ARN,
|
||||
RoleSessionName: 'GitHubActions',
|
||||
DurationSeconds: 6 * 3600,
|
||||
Tags: [
|
||||
{Key: 'GitHub', Value: 'Actions'},
|
||||
{Key: 'Repository', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_REPOSITORY},
|
||||
{Key: 'Workflow', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_WORKFLOW},
|
||||
{Key: 'Action', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_ACTION},
|
||||
{Key: 'Actor', Value: GITHUB_ACTOR_SANITIZED},
|
||||
{Key: 'Commit', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_SHA},
|
||||
{Key: 'Branch', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_REF},
|
||||
],
|
||||
Policy: CUSTOM_SESSION_POLICY
|
||||
})
|
||||
});
|
||||
|
||||
test('managed session policy provided', async () => {
|
||||
const MANAGED_SESSION_POLICIES = ["arn:aws:iam::111111111111:policy/foo", "arn:aws:iam::111111111111:policy/bar"];
|
||||
core.getInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({...ASSUME_ROLE_INPUTS}));
|
||||
core.getMultilineInput = jest
|
||||
.fn()
|
||||
.mockImplementation(mockGetInput({'managed-session-policies': MANAGED_SESSION_POLICIES}))
|
||||
|
||||
await run();
|
||||
expect(mockStsAssumeRole).toHaveBeenCalledWith({
|
||||
RoleArn: ROLE_ARN,
|
||||
RoleSessionName: 'GitHubActions',
|
||||
DurationSeconds: 6 * 3600,
|
||||
Tags: [
|
||||
{Key: 'GitHub', Value: 'Actions'},
|
||||
{Key: 'Repository', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_REPOSITORY},
|
||||
{Key: 'Workflow', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_WORKFLOW},
|
||||
{Key: 'Action', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_ACTION},
|
||||
{Key: 'Actor', Value: GITHUB_ACTOR_SANITIZED},
|
||||
{Key: 'Commit', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_SHA},
|
||||
{Key: 'Branch', Value: ENVIRONMENT_VARIABLE_OVERRIDES.GITHUB_REF},
|
||||
],
|
||||
PolicyArns: [{arn: MANAGED_SESSION_POLICIES[0]}, {arn: MANAGED_SESSION_POLICIES[1]}],
|
||||
})
|
||||
});
|
||||
|
||||
test('workflow name sanitized in role assumption tags', async () => {
|
||||
core.getInput = jest
|
||||
.fn()
|
||||
|
||||
Reference in New Issue
Block a user