aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-04 06:15:07 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: Mask assume role response in debug output (#102)

Browse Source
This commit is contained in:
allisaurus
2020-07-29 10:43:15 -07:00
committed by GitHub
parent ad85e9c2d3
commit df7d846161
3 changed files with 30 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/index.js
Vendored
+4 -4
View File
@@ -231,19 +231,19 @@ function exportCredentials(params){
// AWS_ACCESS_KEY_ID: // AWS_ACCESS_KEY_ID:
// Specifies an AWS access key associated with an IAM user or role // Specifies an AWS access key associated with an IAM user or role
core.exportVariable('AWS_ACCESS_KEY_ID', accessKeyId);
core.setSecret(accessKeyId); core.setSecret(accessKeyId);
core.exportVariable('AWS_ACCESS_KEY_ID', accessKeyId);
// AWS_SECRET_ACCESS_KEY: // AWS_SECRET_ACCESS_KEY:
// Specifies the secret key associated with the access key. This is essentially the "password" for the access key. // Specifies the secret key associated with the access key. This is essentially the "password" for the access key.
core.exportVariable('AWS_SECRET_ACCESS_KEY', secretAccessKey);
core.setSecret(secretAccessKey); core.setSecret(secretAccessKey);
core.exportVariable('AWS_SECRET_ACCESS_KEY', secretAccessKey);
// AWS_SESSION_TOKEN: // AWS_SESSION_TOKEN:
// Specifies the session token value that is required if you are using temporary security credentials. // Specifies the session token value that is required if you are using temporary security credentials.
if (sessionToken) { if (sessionToken) {
core.exportVariable('AWS_SESSION_TOKEN', sessionToken);
core.setSecret(sessionToken); core.setSecret(sessionToken);
core.exportVariable('AWS_SESSION_TOKEN', sessionToken);
} else if (process.env.AWS_SESSION_TOKEN) { } else if (process.env.AWS_SESSION_TOKEN) {
// clear session token from previous credentials action // clear session token from previous credentials action
core.exportVariable('AWS_SESSION_TOKEN', ''); core.exportVariable('AWS_SESSION_TOKEN', '');
@@ -262,10 +262,10 @@ async function exportAccountId(maskAccountId, region) {
const sts = getStsClient(region); const sts = getStsClient(region);
const identity = await sts.getCallerIdentity().promise(); const identity = await sts.getCallerIdentity().promise();
const accountId = identity.Account; const accountId = identity.Account;
core.setOutput('aws-account-id', accountId);
if (!maskAccountId || maskAccountId.toLowerCase() == 'true') { if (!maskAccountId || maskAccountId.toLowerCase() == 'true') {
core.setSecret(accountId); core.setSecret(accountId);
} }
core.setOutput('aws-account-id', accountId);
return accountId; return accountId;
} }
index.js
+4 -4
View File
@@ -98,19 +98,19 @@ function exportCredentials(params){
// AWS_ACCESS_KEY_ID: // AWS_ACCESS_KEY_ID:
// Specifies an AWS access key associated with an IAM user or role // Specifies an AWS access key associated with an IAM user or role
core.exportVariable('AWS_ACCESS_KEY_ID', accessKeyId);
core.setSecret(accessKeyId); core.setSecret(accessKeyId);
core.exportVariable('AWS_ACCESS_KEY_ID', accessKeyId);
// AWS_SECRET_ACCESS_KEY: // AWS_SECRET_ACCESS_KEY:
// Specifies the secret key associated with the access key. This is essentially the "password" for the access key. // Specifies the secret key associated with the access key. This is essentially the "password" for the access key.
core.exportVariable('AWS_SECRET_ACCESS_KEY', secretAccessKey);
core.setSecret(secretAccessKey); core.setSecret(secretAccessKey);
core.exportVariable('AWS_SECRET_ACCESS_KEY', secretAccessKey);
// AWS_SESSION_TOKEN: // AWS_SESSION_TOKEN:
// Specifies the session token value that is required if you are using temporary security credentials. // Specifies the session token value that is required if you are using temporary security credentials.
if (sessionToken) { if (sessionToken) {
core.exportVariable('AWS_SESSION_TOKEN', sessionToken);
core.setSecret(sessionToken); core.setSecret(sessionToken);
core.exportVariable('AWS_SESSION_TOKEN', sessionToken);
} else if (process.env.AWS_SESSION_TOKEN) { } else if (process.env.AWS_SESSION_TOKEN) {
// clear session token from previous credentials action // clear session token from previous credentials action
core.exportVariable('AWS_SESSION_TOKEN', ''); core.exportVariable('AWS_SESSION_TOKEN', '');
@@ -129,10 +129,10 @@ async function exportAccountId(maskAccountId, region) {
const sts = getStsClient(region); const sts = getStsClient(region);
const identity = await sts.getCallerIdentity().promise(); const identity = await sts.getCallerIdentity().promise();
const accountId = identity.Account; const accountId = identity.Account;
core.setOutput('aws-account-id', accountId);
if (!maskAccountId || maskAccountId.toLowerCase() == 'true') { if (!maskAccountId || maskAccountId.toLowerCase() == 'true') {
core.setSecret(accountId); core.setSecret(accountId);
} }
core.setOutput('aws-account-id', accountId);
return accountId; return accountId;
} }
index.test.js
+22
View File
@@ -594,4 +594,26 @@ describe('Configure AWS Credentials', () => {
}) })
}); });
test('masks variables before exporting', async () => {
let maskedValues = [];
const publicFields = ['AWS_REGION', 'AWS_DEFAULT_REGION'];
core.setSecret.mockReset();
core.setSecret.mockImplementation((secret) => {
maskedValues.push(secret);
});
core.exportVariable.mockReset();
core.exportVariable.mockImplementation((name, value) => {
if (!maskedValues.includes(value) && !publicFields.includes(name)) {
throw new Error(value + " for variable " + name + " is not masked yet!");
}
});
core.getInput = jest
.fn()
.mockImplementation(mockGetInput(ASSUME_ROLE_INPUTS));
await run();
});
}); });