From ed5da29eb9f25fad81264770e5f65b9d0ce4b1b4 Mon Sep 17 00:00:00 2001
From: Tom Keller <kellertk@amazon.com>
Date: Mon, 31 Aug 2026 11:57:50 -0700
Subject: [PATCH] fix: enforce allowed-account-ids when the list contains empty
 entries

An empty first element previously short-circuited the allowed account
check. Empty entries are now filtered out and validation applies
whenever any non-empty entry exists.
---
 src/helpers.ts       |  7 ++++---
 test/helpers.test.ts | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/helpers.ts b/src/helpers.ts
index 468a12d..f0b2b5c 100644
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -167,14 +167,15 @@ export function exportAccountId(identity: { Account: string; Arn: string }, mask
 // Validates that the account of the already-resolved caller identity is in the allow-list provided via the
 // `allowed-account-ids` input.
 export function validateAccountId(expectedAccountIds: string[] | undefined, account: string | undefined): void {
-  if (!expectedAccountIds || expectedAccountIds.length === 0 || expectedAccountIds[0] === '') {
+  const allowedAccountIds = expectedAccountIds?.filter((id) => id !== '') ?? [];
+  if (allowedAccountIds.length === 0) {
     return;
   }
-  if (!account || !expectedAccountIds.includes(account)) {
+  if (!account || !allowedAccountIds.includes(account)) {
     throw new Error(
       `The account ID of the provided credentials (${
         account ?? 'unknown'
-      }) does not match any of the expected account IDs: ${expectedAccountIds.join(', ')}`,
+      }) does not match any of the expected account IDs: ${allowedAccountIds.join(', ')}`,
     );
   }
 }
diff --git a/test/helpers.test.ts b/test/helpers.test.ts
index eefca3c..eef1eb9 100644
--- a/test/helpers.test.ts
+++ b/test/helpers.test.ts
@@ -126,6 +126,22 @@ describe('Configure AWS Credentials helpers', {}, () => {
     expect(core.exportVariable).toHaveBeenCalledWith('AWS_SESSION_TOKEN', '');
   });
 
+  describe('validateAccountId', {}, () => {
+    it('enforces the allow-list even when the first element is empty', {}, () => {
+      expect(() => helpers.validateAccountId(['', '999999999999'], '111111111111')).toThrow(/does not match/);
+    });
+
+    it('passes an allowed account despite empty entries in the list', {}, () => {
+      expect(() => helpers.validateAccountId(['', '111111111111'], '111111111111')).not.toThrow();
+    });
+
+    it('skips validation only when no non-empty entries exist', {}, () => {
+      expect(() => helpers.validateAccountId(undefined, '111111111111')).not.toThrow();
+      expect(() => helpers.validateAccountId([], '111111111111')).not.toThrow();
+      expect(() => helpers.validateAccountId([''], '111111111111')).not.toThrow();
+    });
+  });
+
   describe('filesystem helpers', {}, () => {
     describe('isSymlink', {}, () => {
       it('returns true for a symlink', {}, () => {