Merge branch 'master' into v1-node16

.github/workflows/package.yml

@@ -42,10 +42,10 @@ jobs:
             OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp
       - name: Commit
         run: |
-          echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}}"
+          echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
           git config user.name "GitHub Actions"
           git config user.email "github-aws-sdk-osds-automation@amazon.com"
-          git remote set-url origin https://x-access-token:${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
+          git remote set-url origin https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
           git add dist
           git commit -m "chore: Update dist" || echo "No changes to commit"
           git push origin

README.md

@@ -15,6 +15,7 @@ GitHub actions has recently started throwing warning messages regarding the depr
     + [Session tagging](#session-tagging)
     + [Sample IAM Role Permissions](#sample-iam-role-cloudformation-template)
 - [Self-Hosted Runners](#self-hosted-runners)
+    + [Proxy Configuration](#proxy-configuration)
 - [License Summary](#license-summary)
 - [Security Disclosures](#security-disclosures)
 
@@ -92,12 +93,12 @@ The default audience is `sts.amazonaws.com` which you can replace by specifying
 
 The following table describes which identity is used based on which values are supplied to the Action:
 
-| **Identity Used**                                                | `aws-access-key-id` | `role-to-assume` | `web-identity-token-file` |
-|------------------------------------------------------------------|---------------------|------------------|---------------------------|
+| **Identity Used**                                               | `aws-access-key-id` | `role-to-assume` | `web-identity-token-file` |
+| --------------------------------------------------------------- | ------------------- | ---------------- | ------------------------- |
 | [✅ Recommended] Assume Role directly using GitHub OIDC provider |                     | ✔                |                           |
-| IAM User                                                         | ✔                   |                  |                           |
-| Assume Role using IAM User credentials                           | ✔                   | ✔                |                           |
-| Assume Role using WebIdentity Token File credentials             |                     | ✔                | ✔                         |
+| IAM User                                                        | ✔                   |                  |                           |
+| Assume Role using IAM User credentials                          | ✔                   | ✔                |                           |
+| Assume Role using WebIdentity Token File credentials            |                     | ✔                | ✔                         |
 
 ### Examples
 
@@ -203,15 +204,15 @@ For further information on OIDC and GitHub Actions, please see:
 The session will have the name "GitHubActions" and be tagged with the following tags:
 (`GITHUB_` environment variable definitions can be [found here](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables#default-environment-variables))
 
-| Key | Value|
-| --- | --- |
-| GitHub | "Actions" |
+| Key        | Value             |
+| ---------- | ----------------- |
+| GitHub     | "Actions"         |
 | Repository | GITHUB_REPOSITORY |
-| Workflow | GITHUB_WORKFLOW |
-| Action | GITHUB_ACTION |
-| Actor | GITHUB_ACTOR |
-| Branch | GITHUB_REF |
-| Commit | GITHUB_SHA |
+| Workflow   | GITHUB_WORKFLOW   |
+| Action     | GITHUB_ACTION     |
+| Actor      | GITHUB_ACTOR      |
+| Branch     | GITHUB_REF        |
+| Commit     | GITHUB_SHA        |
 
 _Note: all tag values must conform to [the requirements](https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html). Particularly, `GITHUB_WORKFLOW` will be truncated if it's too long. If `GITHUB_ACTOR` or `GITHUB_WORKFLOW` contain invalid characters, the characters will be replaced with an '*'._
 
@@ -261,6 +262,30 @@ with:
   web-identity-token-file: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
 ```
 
+### Proxy Configuration
+
+If you run in self-hosted environments and in secured environment where you need use a specific proxy you can set it in the action manually.
+
+Additionally this action will always consider already configured proxy in the environment.
+
+Manually configured proxy:
+```yaml
+uses: aws-actions/configure-aws-credentials@v1
+with:
+  aws-region: us-east-2
+  role-to-assume: my-github-actions-role
+  http-proxy: "http://companydomain.com:3128"
+```
+
+Proxy configured in the environment variable:
+
+```bash
+# Your environment configuration
+HTTP_PROXY="http://companydomain.com:3128"
+```
+
+The action will read the underlying proxy configuration from the environment and you don't need to configure it in the action.
+
 ### Use with the AWS CLI
 
 This workflow does _not_ install the [AWS CLI](https://aws.amazon.com/cli/) into your environment. Self-hosted runners that intend to run this action prior to executing `aws` commands need to have the AWS CLI [installed](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) if it's not already present. 

action.yml

@@ -55,6 +55,9 @@ inputs:
   role-skip-session-tagging:
     description: 'Skip session tagging during role assumption'
     required: false
+  http-proxy:
+    description: 'Proxy to use for the AWS SDK agent'
+    required: false
 outputs:
   aws-account-id:
     description: 'The AWS account ID for the provided credentials'

index.js

@@ -3,6 +3,7 @@ const aws = require('aws-sdk');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const proxy = require('https-proxy-agent');
 
 // Use 1hr as role duration when using session token or OIDC
 // Otherwise, use the max duration of GitHub action (6hr)
@@ -260,6 +261,26 @@ const retryAndBackoff = async (fn, isRetryable, retries = 0, maxRetries = 12, ba
   }
 }
 
+function configureProxy(proxyServer) {
+  const proxyFromEnv = process.env.HTTP_PROXY || process.env.http_proxy;
+
+  if (proxyFromEnv || proxyServer) {
+    let proxyToSet = null;
+
+    if (proxyServer){
+      console.log(`Setting proxy from actions input: ${proxyServer}`);
+      proxyToSet = proxyServer;
+    } else {
+      console.log(`Setting proxy from environment: ${proxyFromEnv}`);
+      proxyToSet = proxyFromEnv;
+    }
+
+    aws.config.update({
+      httpOptions: { agent: proxy(proxyToSet) }
+    });
+  }
+}
+
 async function run() {
   try {
     // Get inputs
@@ -278,6 +299,7 @@ async function run() {
     const roleSkipSessionTaggingInput = core.getInput('role-skip-session-tagging', { required: false })|| 'false';
     const roleSkipSessionTagging = roleSkipSessionTaggingInput.toLowerCase() === 'true';
     const webIdentityTokenFile = core.getInput('web-identity-token-file', { required: false });
+    const proxyServer = core.getInput('http-proxy', { required: false });
 
     if (!region.match(REGION_REGEX)) {
       throw new Error(`Region is not valid: ${region}`);
@@ -307,6 +329,9 @@ async function run() {
 
       exportCredentials({accessKeyId, secretAccessKey, sessionToken});
     }
+    
+    // Configures proxy
+    configureProxy(proxyServer);
 
     // Attempt to load credentials from the GitHub OIDC provider.
     // If a user provides an IAM Role Arn and DOESN'T provide an Access Key Id

index.test.js

@@ -2,6 +2,7 @@ const core = require('@actions/core');
 const assert = require('assert');
 const aws = require('aws-sdk');
 const { run, withSleep, reset }  = require('./index.js');
+const proxy = require('https-proxy-agent');
 
 jest.mock('@actions/core');
 
@@ -33,6 +34,7 @@ function mockGetInput(requestResponse) {
         return requestResponse[name]
     }
 }
+
 const CREDS_INPUTS = {
     'aws-access-key-id': FAKE_ACCESS_KEY_ID,
     'aws-secret-access-key': FAKE_SECRET_ACCESS_KEY
@@ -52,7 +54,8 @@ const mockStsAssumeRoleWithWebIdentity = jest.fn();
 jest.mock('aws-sdk', () => {
     return {
         config: {
-            getCredentials: jest.fn()
+            getCredentials: jest.fn(),
+            update: jest.fn(),
         },
         STS: jest.fn(() => ({
             getCallerIdentity: mockStsCallerIdentity,
@@ -127,6 +130,9 @@ describe('Configure AWS Credentials', () => {
                 callback(null);
             });
 
+            aws.config.update.mockReset();
+            aws.config.update.mockImplementationOnce();
+
         mockStsAssumeRole.mockImplementation(() => {
             return {
                 promise() {
@@ -804,4 +810,68 @@ describe('Configure AWS Credentials', () => {
         await run();
     });
 
+    describe('proxy settings', () => {
+
+        test('setting proxy with actions input', async () => {
+            const EXPECTED_PROXY = 'http://test.me'
+            core.getInput = jest
+                .fn()
+                .mockImplementation(
+                    mockGetInput({ ...DEFAULT_INPUTS, 'http-proxy': EXPECTED_PROXY })
+                );
+
+            await run();
+
+            expect(aws.config.update).toHaveBeenCalledTimes(1);
+            expect(aws.config.update).toHaveBeenCalledWith({
+                httpOptions: { agent: proxy(EXPECTED_PROXY) }
+              });
+        });
+        test('setting proxy from environment vars', async () => {
+            const EXPECTED_PROXY = 'http://test.me'
+            process.env.HTTP_PROXY = EXPECTED_PROXY;
+            core.getInput = jest
+                .fn()
+                .mockImplementation(
+                    mockGetInput({ ...DEFAULT_INPUTS })
+                );
+
+            await run();
+
+            expect(aws.config.update).toHaveBeenCalledTimes(1);
+            expect(aws.config.update).toHaveBeenCalledWith({
+                httpOptions: { agent: proxy(EXPECTED_PROXY) }
+              });
+        });
+
+        test('setting proxy - prefer action input', async () => {
+            const EXPECTED_PROXY = 'http://test.me'
+            const FALSE_PROXY = 'http://env.me'
+            process.env.HTTP_PROXY = FALSE_PROXY;
+            core.getInput = jest
+                .fn()
+                .mockImplementation(
+                    mockGetInput({ ...DEFAULT_INPUTS, 'http-proxy': EXPECTED_PROXY })
+                );
+
+            await run();
+
+            expect(aws.config.update).toHaveBeenCalledTimes(1);
+            expect(aws.config.update).toHaveBeenCalledWith({
+                httpOptions: { agent: proxy(EXPECTED_PROXY) }
+              });
+        });
+
+        test('ignoring proxy - without anything set', async () => {
+            core.getInput = jest
+                .fn()
+                .mockImplementation(
+                    mockGetInput({ ...DEFAULT_INPUTS})
+                );
+
+            await run();
+
+            expect(aws.config.update).toHaveBeenCalledTimes(0);
+        });
+    });
 });

package.json

@@ -26,12 +26,13 @@
   "homepage": "https://github.com/aws-actions/configure-aws-credentials#readme",
   "dependencies": {
     "@actions/core": "^1.10.0",
-    "aws-sdk": "^2.1319.0",
-    "axios": "^1.3.3"
+    "aws-sdk": "^2.1273.0",
+    "axios": "^1.2.2",
+    "https-proxy-agent": "^5.0.1"
   },
   "devDependencies": {
-    "@vercel/ncc": "^0.36.1",
-    "eslint": "^8.34.0",
-    "jest": "^29.4.3"
+    "@vercel/ncc": "^0.36.0",
+    "eslint": "^8.31.0",
+    "jest": "^29.3.1"
   }
 }