mirror of
https://github.com/aws-actions/configure-aws-credentials.git
synced 2026-09-04 06:15:07 +09:00
V3 (#791)
* feat!: v3 release Squashed commit of the following: commit9df144b3aeMerge:19d3f3a131c7b6Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Aug 23 14:41:33 2023 -0700 Merge remote-tracking branch 'origin' into vNext commit131c7b6fd1Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 22 03:12:24 2023 +0000 chore: Bump jest from 29.6.2 to 29.6.3 (#786) Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) from 29.6.2 to 29.6.3. - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v29.6.3/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit6334b403ebAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 22 03:11:45 2023 +0000 chore: Bump aws-sdk from 2.1436.0 to 2.1441.0 (#787) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1436.0 to 2.1441.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1436.0...v2.1441.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit19d3f3a169Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 20:13:39 2023 -0700 chore: update readme and changelog commit4403e8d882Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 17:12:47 2023 -0700 chore: update workflows commit0f1923f1a1Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 17:01:59 2023 -0700 chore: update .github with current commit60a9bf1676Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 17:00:14 2023 -0700 chore: update .github with current commitd3464b25f8Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 16:58:01 2023 -0700 chore: add examples to vNext branch commit7cd050ca4dAuthor: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 16:54:12 2023 -0700 chore: update readme commit0e32a13775Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 16:19:17 2023 -0700 chore: update readme commit2625b45d56Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 18 15:12:36 2023 -0700 chore: update readme commit19eb4df27eAuthor: peterwoodworth <woodwoop@amazon.com> Date: Thu Aug 17 17:22:20 2023 -0700 chore: update readme commit71ff793a0fAuthor: peterwoodworth <woodwoop@amazon.com> Date: Thu Aug 17 17:18:42 2023 -0700 chore: update readme commita272f95336Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Aug 16 17:05:42 2023 -0700 chore: update readme commit360ea313a7Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 15 03:33:37 2023 +0000 chore: Bump aws-sdk from 2.1431.0 to 2.1436.0 (#783) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1431.0 to 2.1436.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1431.0...v2.1436.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commitde93b00c9fAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 15 03:32:58 2023 +0000 chore: Bump eslint from 8.46.0 to 8.47.0 (#784) Bumps [eslint](https://github.com/eslint/eslint) from 8.46.0 to 8.47.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.46.0...v8.47.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit4dd1aeed85Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 11 16:41:44 2023 -0700 chore: remove unused dependency, fixing vulnerability commit7f4507af3cAuthor: peterwoodworth <woodwoop@amazon.com> Date: Fri Aug 11 16:24:09 2023 -0700 fix: maxRetry hit infinite loop with negative input commit746d33e7c1Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 8 03:23:17 2023 +0000 chore: Bump aws-sdk from 2.1426.0 to 2.1431.0 (#782) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1426.0 to 2.1431.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1426.0...v2.1431.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit706fc9ae3dAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 1 03:41:00 2023 +0000 chore: Bump eslint from 8.45.0 to 8.46.0 (#780) Bumps [eslint](https://github.com/eslint/eslint) from 8.45.0 to 8.46.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.45.0...v8.46.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit9918371ad5Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 1 03:39:16 2023 +0000 chore: Bump aws-sdk from 2.1421.0 to 2.1426.0 (#781) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1421.0 to 2.1426.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1421.0...v2.1426.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit345462ab9eAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Aug 1 03:38:28 2023 +0000 chore: Bump jest from 29.6.1 to 29.6.2 (#779) Bumps [jest](https://github.com/facebook/jest/tree/HEAD/packages/jest) from 29.6.1 to 29.6.2. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v29.6.2/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit80a7a6c2a2Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jul 25 03:22:02 2023 +0000 chore: Bump aws-sdk from 2.1416.0 to 2.1421.0 (#778) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1416.0 to 2.1421.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1416.0...v2.1421.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit385d7e1d64Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jul 18 03:25:33 2023 +0000 chore: Bump aws-sdk from 2.1413.0 to 2.1416.0 (#774) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1413.0 to 2.1416.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1413.0...v2.1416.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit48560b5d49Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jul 18 03:24:46 2023 +0000 chore: Bump eslint from 8.44.0 to 8.45.0 (#773) Bumps [eslint](https://github.com/eslint/eslint) from 8.44.0 to 8.45.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.44.0...v8.45.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit35d8f9588bAuthor: Shailja Khurana <117320115+khushail@users.noreply.github.com> Date: Fri Jul 14 15:14:02 2023 -0700 added workflow for handling answerable discussions (#772) commit86df881b31Author: Tom Keller <1083460+kellertk@users.noreply.github.com> Date: Wed Jul 12 14:51:43 2023 -0700 chore: add link to CF template in README (#771) commita621db3279Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jul 11 03:16:22 2023 +0000 chore: Bump jest from 29.5.0 to 29.6.1 (#768) Bumps [jest](https://github.com/facebook/jest/tree/HEAD/packages/jest) from 29.5.0 to 29.6.1. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v29.6.1/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit90858a2e70Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jul 11 03:15:36 2023 +0000 chore: Bump aws-sdk from 2.1410.0 to 2.1413.0 (#767) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1410.0 to 2.1413.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1410.0...v2.1413.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit228a9916eeAuthor: Tom Keller <1083460+kellertk@users.noreply.github.com> Date: Fri Jul 7 16:49:10 2023 -0700 Update README.md for OIDC changes (#764) commit65c2143642Author: peterwoodworth <woodwoop@amazon.com> Date: Thu Jul 6 15:19:05 2023 -0700 chore: add final tests, add outputs to action.yml commit7b893ba14bAuthor: peterwoodworth <woodwoop@amazon.com> Date: Wed Jul 5 18:55:04 2023 -0700 feat: getIDToken retry, feat: special character in key retry commit3c981da079Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jul 4 03:30:19 2023 +0000 chore: Bump eslint from 8.43.0 to 8.44.0 (#761) Bumps [eslint](https://github.com/eslint/eslint) from 8.43.0 to 8.44.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.43.0...v8.44.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit222080786bAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jul 4 03:29:03 2023 +0000 chore: Bump aws-sdk from 2.1405.0 to 2.1410.0 (#760) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1405.0 to 2.1410.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1405.0...v2.1410.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commitaa2675f083Author: peterwoodworth <woodwoop@amazon.com> Date: Mon Jul 3 16:13:19 2023 -0700 implement last changes for vNext commit256d740e71Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Jun 30 16:20:47 2023 -0700 chore: remove unnecessary step in unit test job commitcd5cd29d7fAuthor: peterwoodworth <woodwoop@amazon.com> Date: Fri Jun 30 16:17:47 2023 -0700 chore: declare eol in gitattributes commit7b90497500Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Jun 30 16:11:12 2023 -0700 chore: disable auto crlf in unit tests commitfb67439785Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Jun 30 15:48:15 2023 -0700 fix boolean input commit2b32a8f2c6Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Jun 30 15:40:41 2023 -0700 fix webIdentityTokenFile option, rearrange validation logic commit7526948ef9Author: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Thu Jun 29 17:29:11 2023 -0700 chore: vnext unit tests (#758) * fix: unit tests * get unit tests running commit0270d0bcecAuthor: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Tue Jun 27 14:22:02 2023 -0700 chore: update readme with new thumbprint (#755) commit4b8efb08dbAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jun 27 03:58:21 2023 +0000 chore: Bump aws-sdk from 2.1400.0 to 2.1405.0 (#754) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1400.0 to 2.1405.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1400.0...v2.1405.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commitd26f2d03f8Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Jun 21 16:45:34 2023 -0700 feat: role-chaining commit20f59875feAuthor: peterwoodworth <woodwoop@amazon.com> Date: Wed Jun 21 15:13:42 2023 -0700 feat: optional policy inputs when assuming role commit10024331f6Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Jun 21 15:08:37 2023 -0700 feat: optional policy inputs when assuming role commit2cee35f9a9Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Jun 21 14:51:50 2023 -0700 feat: optional policy inputs when assuming role commit8aa25a5cb6Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Jun 21 14:50:04 2023 -0700 feat: optional policy inputs when assuming role commite849bae717Author: peterwoodworth <woodwoop@amazon.com> Date: Tue Jun 20 18:02:34 2023 -0700 chore: remove windows self-hosted runner commit8a5ae330ddAuthor: peterwoodworth <woodwoop@amazon.com> Date: Tue Jun 20 16:10:30 2023 -0700 chore: expand integ tests commit819a6d1c74Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jun 20 03:58:58 2023 +0000 chore: Bump eslint from 8.42.0 to 8.43.0 (#750) Bumps [eslint](https://github.com/eslint/eslint) from 8.42.0 to 8.43.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.42.0...v8.43.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commite57babb541Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jun 20 03:58:19 2023 +0000 chore: Bump aws-sdk from 2.1396.0 to 2.1400.0 (#749) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1396.0 to 2.1400.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1396.0...v2.1400.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commitc613996f9aAuthor: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 18:38:44 2023 -0700 chore: attempting to get to minimal integ test success commitc13a9c8ef3Author: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 18:36:40 2023 -0700 chore: attempting to get to minimal integ test success commitb98e10c776Author: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 18:25:03 2023 -0700 chore: set failing configuration on integ workflow matrix commit6d193465aeAuthor: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 16:32:19 2023 -0700 chore: remove push workflow trigger commita8f18666dbAuthor: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 16:29:33 2023 -0700 chore: fix workflow file indentation commit7dec5a88ceAuthor: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 16:28:05 2023 -0700 chore: update workflow to be able to trigger commit0a8178a52aAuthor: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 16:21:45 2023 -0700 chore: update workflow to be able to trigger commit506b27277dAuthor: peterwoodworth <woodwoop@amazon.com> Date: Mon Jun 19 16:17:53 2023 -0700 chore: update workflow to be able to trigger commit5fd3084fc3Author: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Wed Jun 14 15:02:32 2023 -0700 chore: update changelog for release (#745) commitd00f6c6f41Author: Dimitar <dimitarshr@gmail.com> Date: Wed Jun 14 22:43:04 2023 +0100 Allow inline session policies for assuming role (#739) * Allow to pass inline session policy as a parameter Update the action file Regenerate the dist/ content Add test * Fix typos * Fix stylistic error * Move the inline policy logic to allow assumeRole to use it as well; Update and add tests * Add an option for managed policies * Regenerate the dist/ files * Use multiline input for managed policies * Update readme * Update readme --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commitae734070a0Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Jun 13 04:55:26 2023 +0000 chore: Update dist commit3d528c5f7dAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jun 13 04:54:37 2023 +0000 chore: Bump aws-sdk from 2.1391.0 to 2.1396.0 (#744) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1391.0 to 2.1396.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1391.0...v2.1396.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commite7aae61719Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Jun 6 03:59:43 2023 +0000 chore: Update dist commit979ee1f6f4Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jun 6 03:59:04 2023 +0000 chore: Bump aws-sdk from 2.1386.0 to 2.1391.0 (#742) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1386.0 to 2.1391.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1386.0...v2.1391.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit184acc09eaAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jun 6 03:58:21 2023 +0000 chore: Bump eslint from 8.41.0 to 8.42.0 (#741) Bumps [eslint](https://github.com/eslint/eslint) from 8.41.0 to 8.42.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.41.0...v8.42.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit375a690dc0Author: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Wed May 31 14:43:39 2023 -0700 chore: update changelog for v2.1.0 (#738) * chore: update changelog for v2.1.0 * chore: update changelog for v2.1.0 --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit8337ca3433Author: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Wed May 31 14:38:06 2023 -0700 update time to ancient (#729) Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit5727f247b6Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue May 30 03:59:04 2023 +0000 chore: Update dist commitde3676366fAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 30 03:58:14 2023 +0000 chore: Bump aws-sdk from 2.1382.0 to 2.1386.0 (#736) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1382.0 to 2.1386.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1382.0...v2.1386.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit81fba9ea6aAuthor: escudero89 <532828+escudero89@users.noreply.github.com> Date: Fri May 26 00:10:40 2023 +0200 Update README.md with v2 instead of v1 (#733) commit8815b6557cAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 23 03:59:25 2023 +0000 chore: Bump eslint from 8.40.0 to 8.41.0 (#732) Bumps [eslint](https://github.com/eslint/eslint) from 8.40.0 to 8.41.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.40.0...v8.41.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit3d77523f10Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue May 23 03:58:44 2023 +0000 chore: Update dist commit4eb7afece4Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 23 03:58:06 2023 +0000 chore: Bump aws-sdk from 2.1378.0 to 2.1382.0 (#731) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1378.0 to 2.1382.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1378.0...v2.1382.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commitd713a182c5Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue May 16 03:58:29 2023 +0000 chore: Update dist commit1910078421Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 16 03:57:45 2023 +0000 chore: Bump aws-sdk from 2.1374.0 to 2.1378.0 (#726) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1374.0 to 2.1378.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1374.0...v2.1378.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit580afbba80Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue May 9 03:59:53 2023 +0000 chore: Update dist commit1daf2a1967Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 9 03:59:14 2023 +0000 chore: Bump aws-sdk from 2.1369.0 to 2.1374.0 (#723) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1369.0 to 2.1374.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1369.0...v2.1374.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit76ad093bd5Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 9 03:57:57 2023 +0000 chore: Bump eslint from 8.39.0 to 8.40.0 (#722) Bumps [eslint](https://github.com/eslint/eslint) from 8.39.0 to 8.40.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.39.0...v8.40.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit6fbd316fd1Author: Milo Hyson <siggimoo@users.noreply.github.com> Date: Fri May 5 18:27:52 2023 -0700 Add role-chaining support (#688) * Add role-chaining support * fix version in readme * minor readme adjustment --------- Co-authored-by: Milo Hyson <mhyson@tunein.com> Co-authored-by: peterwoodworth <woodwoop@amazon.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit19f3a6d67fAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 2 03:59:57 2023 +0000 chore: Bump axios from 1.3.6 to 1.4.0 (#720) Bumps [axios](https://github.com/axios/axios) from 1.3.6 to 1.4.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.3.6...v1.4.0) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit96aac45bfcAuthor: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue May 2 03:58:25 2023 +0000 chore: Update dist commit5e6a264592Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue May 2 03:57:46 2023 +0000 chore: Bump aws-sdk from 2.1364.0 to 2.1369.0 (#719) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1364.0 to 2.1369.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1364.0...v2.1369.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit82ea2d2853Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Apr 25 04:01:50 2023 +0000 chore: Bump axios from 1.3.5 to 1.3.6 (#716) Bumps [axios](https://github.com/axios/axios) from 1.3.5 to 1.3.6. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.3.5...v1.3.6) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commite0213bba7aAuthor: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Apr 25 03:59:31 2023 +0000 chore: Update dist commit2beda2fb7cAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Apr 25 03:58:42 2023 +0000 chore: Bump aws-sdk from 2.1360.0 to 2.1364.0 (#715) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1360.0 to 2.1364.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1360.0...v2.1364.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit0afc5d47c7Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Apr 25 03:57:35 2023 +0000 chore: Bump eslint from 8.38.0 to 8.39.0 (#714) Bumps [eslint](https://github.com/eslint/eslint) from 8.38.0 to 8.39.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.38.0...v8.39.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit31bd3ae2dbAuthor: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Apr 18 03:59:23 2023 +0000 chore: Update dist commit46648cb772Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Apr 18 03:58:27 2023 +0000 chore: Bump aws-sdk from 2.1354.0 to 2.1360.0 (#713) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1354.0 to 2.1360.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1354.0...v2.1360.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit60a5c129d0Author: Jonathan Lang <jonathan.lang@tngtech.com> Date: Wed Apr 12 00:46:13 2023 +0200 Fix Typo in README.md (#707) commitf576cc9d9bAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Apr 11 04:00:40 2023 +0000 chore: Bump axios from 1.3.4 to 1.3.5 (#712) Bumps [axios](https://github.com/axios/axios) from 1.3.4 to 1.3.5. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.3.4...v1.3.5) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit9c17403327Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Apr 11 03:59:38 2023 +0000 chore: Bump eslint from 8.35.0 to 8.38.0 (#711) Bumps [eslint](https://github.com/eslint/eslint) from 8.35.0 to 8.38.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.35.0...v8.38.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit9c1a10e79cAuthor: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Apr 11 03:58:34 2023 +0000 chore: Update dist commit9192d9ecb4Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Apr 11 03:57:48 2023 +0000 chore: Bump aws-sdk from 2.1329.0 to 2.1354.0 (#710) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1329.0 to 2.1354.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1329.0...v2.1354.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit26227bfa7dAuthor: peterwoodworth <woodwoop@amazon.com> Date: Wed Mar 22 16:52:04 2023 -0700 chore: adjust cleanup build target commit0d90ddd1f2Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Mar 22 16:51:12 2023 -0700 chore: adjust cleanup build again commitfc80f28dbaAuthor: peterwoodworth <woodwoop@amazon.com> Date: Wed Mar 22 16:37:58 2023 -0700 chore: adjust cleanup build and some imports commit3088522ce8Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Mar 22 16:32:37 2023 -0700 chore: build and set cleanup file commit0181111f1dAuthor: peterwoodworth <woodwoop@amazon.com> Date: Wed Mar 22 15:12:07 2023 -0700 chore: build action commitb723544115Author: peterwoodworth <woodwoop@amazon.com> Date: Wed Mar 22 15:08:39 2023 -0700 fix: branch name is not sanitized, slight refactor commit0e613a0980Author: Adrian Środoń <adriansrodon@tuta.io> Date: Mon Mar 20 23:24:34 2023 +0100 docs: add note about case sensivity to CloudFormation template (#696) * docs: add note about case sensivity to CloudFormation template * Move case-sensivity notes to CloudFormation template commit12d07d4800Author: Tom Keller <kellertk@amazon.com> Date: Fri Mar 17 17:46:57 2023 -0700 feat: update tests commitf6fdf0cdbdAuthor: peterwoodworth <woodwoop@amazon.com> Date: Wed Mar 15 14:12:01 2023 -0700 feat: aws region is optional, use global sts endpoint when not set commitcb1361ade3Author: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Mon Mar 13 14:50:02 2023 -0700 docs: clarify safety of version migration in readme (#692) commitf9f25e69f5Author: peterwoodworth <woodwoop@amazon.com> Date: Fri Mar 10 14:35:59 2023 -0800 refactor, add new major version features and proxy commit83f0e97b2fMerge:7fc5f08f86a0c3Author: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Tue Mar 7 17:36:19 2023 -0800 Merge pull request #687 from fabienfoerster/patch-2 Update README examples to use v2 commitf86a0c30a5Author: Fabien Foerster <f.foerster@bevolta.com> Date: Tue Mar 7 21:29:17 2023 +0100 Update README examples to use v2 commit7fc5f080e5Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Mar 7 01:02:37 2023 +0000 chore: Update dist commitffc08eae73Author: Tom Keller <kellertk@amazon.com> Date: Mon Mar 6 17:01:09 2023 -0800 Rename master to main commite1e17a757eAuthor: Tom Keller <1083460+kellertk@users.noreply.github.com> Date: Mon Mar 6 16:35:37 2023 -0800 Version 2 release (#685) * Update README for v2 * Remove codeql analysis * Version bump checkout action * Tweak closed issue message * Changes for v2 release * Adjust action name * Update CHANGELOG * Update action to use node 16 * Update versions * Typo commitbab55d3830Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 28 04:09:09 2023 +0000 chore: Bump axios from 1.3.3 to 1.3.4 (#679) Bumps [axios](https://github.com/axios/axios) from 1.3.3 to 1.3.4. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.3.3...v1.3.4) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit07b737a14fAuthor: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Feb 28 04:00:33 2023 +0000 chore: Update dist commit26e4efa71fAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 28 03:59:47 2023 +0000 chore: Bump aws-sdk from 2.1320.0 to 2.1324.0 (#677) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1320.0 to 2.1324.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1320.0...v2.1324.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit7e0ecf0346Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 28 03:58:55 2023 +0000 chore: Bump eslint from 8.34.0 to 8.35.0 (#675) Bumps [eslint](https://github.com/eslint/eslint) from 8.34.0 to 8.35.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.34.0...v8.35.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit567d4149d6Merge:32eb1b485ec61bAuthor: Peter Woodworth <44349620+peterwoodworth@users.noreply.github.com> Date: Tue Feb 21 18:49:30 2023 -0800 Merge pull request #563 from russau/docs/readme-role-update Minor: include a role condition test for AUD in sample CFN template commit32eb1b4a66Author: Jackson Welsh <me@jacksonwel.sh> Date: Tue Feb 21 20:36:17 2023 -0600 feat: document mask-aws-account-id input (#606) Closes aws-actions#304 Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit6ca2577643Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Wed Feb 22 02:34:29 2023 +0000 chore: Update dist commitf1de076135Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed Feb 22 02:33:40 2023 +0000 chore: Bump aws-sdk from 2.1273.0 to 2.1320.0 (#666) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1273.0 to 2.1320.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1273.0...v2.1320.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit077fd1fc8fAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 21 04:00:04 2023 +0000 chore: Bump jest from 29.4.2 to 29.4.3 (#663) Bumps [jest](https://github.com/facebook/jest/tree/HEAD/packages/jest) from 29.4.2 to 29.4.3. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v29.4.3/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit1416c559c0Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 14 04:08:31 2023 +0000 chore: Bump eslint from 8.33.0 to 8.34.0 (#653) Bumps [eslint](https://github.com/eslint/eslint) from 8.33.0 to 8.34.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.33.0...v8.34.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commitc3f9f9cde3Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 14 04:02:34 2023 +0000 chore: Bump jest from 29.4.1 to 29.4.2 (#655) Bumps [jest](https://github.com/facebook/jest/tree/HEAD/packages/jest) from 29.4.1 to 29.4.2. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v29.4.2/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit1a61b71d4cAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 14 04:00:54 2023 +0000 chore: Bump axios from 1.3.2 to 1.3.3 (#651) Bumps [axios](https://github.com/axios/axios) from 1.3.2 to 1.3.3. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.3.2...v1.3.3) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit07d5781915Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Feb 7 03:03:40 2023 +0000 chore: Bump axios from 1.2.6 to 1.3.2 (#648) Bumps [axios](https://github.com/axios/axios) from 1.2.6 to 1.3.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.2.6...v1.3.2) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit5ed46d9d6aAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 31 03:10:42 2023 +0000 chore: Bump eslint from 8.32.0 to 8.33.0 (#645) Bumps [eslint](https://github.com/eslint/eslint) from 8.32.0 to 8.33.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.32.0...v8.33.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit0d34112acbAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 31 03:06:27 2023 +0000 chore: Bump jest from 29.3.1 to 29.4.1 (#643) Bumps [jest](https://github.com/facebook/jest/tree/HEAD/packages/jest) from 29.3.1 to 29.4.1. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v29.4.1/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commitfa45146389Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 31 03:05:11 2023 +0000 chore: Bump @vercel/ncc from 0.36.0 to 0.36.1 (#640) Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.36.0 to 0.36.1. - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](https://github.com/vercel/ncc/compare/0.36.0...0.36.1) --- updated-dependencies: - dependency-name: "@vercel/ncc" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commita075dc0410Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 31 03:03:44 2023 +0000 chore: Bump axios from 1.2.3 to 1.2.6 (#639) Bumps [axios](https://github.com/axios/axios) from 1.2.3 to 1.2.6. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.2.3...v1.2.6) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit3e21ee4ae7Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 24 03:04:28 2023 +0000 chore: Bump axios from 1.2.2 to 1.2.3 (#630) Bumps [axios](https://github.com/axios/axios) from 1.2.2 to 1.2.3. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/1.2.2...v1.2.3) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit491cd39cf6Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 17 03:05:35 2023 +0000 chore: Bump eslint from 8.31.0 to 8.32.0 (#625) Bumps [eslint](https://github.com/eslint/eslint) from 8.31.0 to 8.32.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.31.0...v8.32.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit3654529dc6Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 3 03:06:41 2023 +0000 chore: Bump json5 from 2.2.1 to 2.2.3 (#620) Bumps [json5](https://github.com/json5/json5) from 2.2.1 to 2.2.3. - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](https://github.com/json5/json5/compare/v2.2.1...v2.2.3) --- updated-dependencies: - dependency-name: json5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commitaa5a031041Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 3 03:04:46 2023 +0000 chore: Bump eslint from 8.30.0 to 8.31.0 (#619) Bumps [eslint](https://github.com/eslint/eslint) from 8.30.0 to 8.31.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.30.0...v8.31.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit55443b3d5bAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Jan 3 03:03:28 2023 +0000 chore: Bump axios from 1.2.1 to 1.2.2 (#616) Bumps [axios](https://github.com/axios/axios) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.2.1...1.2.2) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit48f0cb7848Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Dec 20 03:04:13 2022 +0000 chore: Bump eslint from 8.29.0 to 8.30.0 (#610) Bumps [eslint](https://github.com/eslint/eslint) from 8.29.0 to 8.30.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.29.0...v8.30.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit90d1b38cb5Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Dec 13 03:05:43 2022 +0000 chore: Update dist commit422c797285Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Dec 13 03:04:51 2022 +0000 chore: Bump aws-sdk from 2.1268.0 to 2.1273.0 (#603) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1268.0 to 2.1273.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1268.0...v2.1273.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit4b942d82b0Author: GitHub Actions <github-aws-sdk-osds-automation@amazon.com> Date: Tue Dec 6 03:10:45 2022 +0000 chore: Update dist commit7437ed192eAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Dec 6 03:09:51 2022 +0000 chore: Bump aws-sdk from 2.1262.0 to 2.1268.0 (#596) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1262.0 to 2.1268.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1262.0...v2.1268.0) --- updated-dependencies: - dependency-name: aws-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commited4ba44f95Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Dec 6 03:08:24 2022 +0000 chore: Bump @vercel/ncc from 0.34.0 to 0.36.0 (#594) Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.34.0 to 0.36.0. - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](https://github.com/vercel/ncc/compare/0.34.0...0.36.0) --- updated-dependencies: - dependency-name: "@vercel/ncc" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> commit10dc6d923aAuthor: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Dec 6 03:05:08 2022 +0000 chore: Bump axios from 1.2.0 to 1.2.1 (#590) Bumps [axios](https://github.… * chore: tweak readme for v3
This commit is contained in:
Tom Keller
@@ -5,43 +5,76 @@ and exports environment variables for your other Actions to use. Environment
|
||||
variable exports are detected by both the AWS SDKs and the AWS CLI for AWS API
|
||||
calls.
|
||||
|
||||
### Recent updates
|
||||
---
|
||||
|
||||
**GitHub OIDC Changes**
|
||||
### News
|
||||
|
||||
In #[357](https://github.com/aws-actions/configure-aws-credentials/issues/357), we
|
||||
observed that GitHub recently started offering one of several intermediate OIDC
|
||||
endpoint thumbprints. Because IAM requires statically configured endpoint
|
||||
thumbprints, AWS customers that had only one thumbprint configured could see
|
||||
intermittent authentication failures. **As of July 6, 2023, AWS has made a change to
|
||||
IAM that will no longer require any particular certificate thumbprint for
|
||||
tokens.actions.githubusercontent.com**, which is the GitHub OIDC endpoint. Instead,
|
||||
AWS secures communication with GitHub OIDC using our library of trusted CAs rather
|
||||
than using a certificate thumbprint to verify the server certificate. The IAM APIs
|
||||
still require that a thumbprint is configured, but those thumbprints will be ignored
|
||||
when authenticating tokens.actions.githubusercontent.com.
|
||||
We have recently released `v3` of Configure AWS Credentials! With this new
|
||||
release we have migrated the code to TypeScript, and have also migrated away
|
||||
from using `v2` of the JavaScript AWS SDK. This should eliminate the warning you
|
||||
have seen in your workflow logs about `v2` deprecation.
|
||||
|
||||
GitHub Enterprise Server customers use a different endpoint so they are not affected by
|
||||
this change.
|
||||
In addition to the refactored codebase, we have also introduced some changes to
|
||||
existing functionality, added some new features, and fixed some bugs. These
|
||||
changes should be backwards compatible with your existing workflows.
|
||||
|
||||
*Original message:*
|
||||
There are now [two possible intermediary certificates](https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/) for the Actions SSL certificate. Previously, the certificate with the thumbprint `6938fd4d98bab03faadb97b34396831e3780aea1` was guaranteed to return. Now, the certificate with the thumbprint `1c58a3a8518e8759bf075b76b750d4f2df264fcd` can also be returned, so you will need to [update your identity provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) with this additional new thumbprint.
|
||||
**Notable changes to existing functionality**
|
||||
|
||||
- By default, the assumed role credentials will only be valid for one hour in
|
||||
_all_ use cases. This is changed from 6 hours in `v2`. You can adjust this value
|
||||
with the `role-duration-seconds` input.
|
||||
- By default, your account ID will not be masked in workflow logs. This was
|
||||
changed from being masked by default in the previous version. AWS does consider
|
||||
account IDs as sensitive information, so this change reflects that stance. You
|
||||
can rever to the old default and mask your account ID in workflow logs by
|
||||
setting the `mask-aws-account-id` input to `true`.
|
||||
|
||||
**New features**
|
||||
|
||||
- You can now configure retry settings in case your STS call fails. By default,
|
||||
we retry with exponential backoff twelve times. You can disable this behavior
|
||||
altogether by setting the `disable-retry` input to `true`, or you can configure
|
||||
the number of times the action will retry with the `retry-max-attempts` input.
|
||||
- You can now set the returned credentials as action step outputs. To do this,
|
||||
you can set the `output-credentials` prop to `true`.
|
||||
- There's now an option to clear the AWS-related environment variables at the
|
||||
start of the action. Clearing these variables is often a workaround for
|
||||
problems, so enabling this can be helpful if existing credentials or environment
|
||||
variables are interfering with the action. You can enable this by setting the
|
||||
`unset-current-credentials` input to `true`.
|
||||
|
||||
**Bug fixes**
|
||||
|
||||
You can find a list of bugs that have been fixed in v3 in the
|
||||
[changelog](./changelog.md).
|
||||
|
||||
---
|
||||
|
||||
### Table of Contents
|
||||
<!-- toc -->
|
||||
- [Usage](#usage)
|
||||
- [Credentials](#credentials)
|
||||
- [Assuming a Role](#assuming-a-role)
|
||||
+ [Session tagging](#session-tagging)
|
||||
- [Overview](#overview)
|
||||
- [Security recommendations](#security-recommendations)
|
||||
- [Using this action](#using-this-action)
|
||||
+ [Credential Lifetime](#credential-lifetime)
|
||||
+ [External ID](#external-id)
|
||||
+ [Session tagging](#session-tagging-and-name)
|
||||
+ [Sample IAM Role Permissions](#sample-iam-role-cloudformation-template)
|
||||
+ [Misc](#misc)
|
||||
- [OIDC](#OIDC)
|
||||
+ [Audience](#audience)
|
||||
+ [Sample IAM OIDC CloudFormation Template](#sample-iam-oidc-cloudformation-template)
|
||||
+ [Claims and scoping permissions](#claims-and-scoping-permissions)
|
||||
+ [Further info](#further-info)
|
||||
- [Self-Hosted Runners](#self-hosted-runners)
|
||||
+ [Proxy Configuration](#proxy-configuration)
|
||||
+ [Use with the AWS CLI](#use-with-the-aws-cli)
|
||||
- [Examples](#examples)
|
||||
- [License Summary](#license-summary)
|
||||
- [Security Disclosures](#security-disclosures)
|
||||
<!-- tocstop -->
|
||||
|
||||
## Usage
|
||||
We support four methods for fetching credentials from AWS, but we recommend that
|
||||
## Overview
|
||||
We support five methods for fetching credentials from AWS, but we recommend that
|
||||
you use GitHub's OIDC provider in conjunction with a configured AWS IAM
|
||||
Identity Provider endpoint.
|
||||
|
||||
@@ -49,14 +82,14 @@ To do that, you would add the following step to your workflow:
|
||||
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
aws-region: us-east-2
|
||||
```
|
||||
This will cause the action to perform an `AssumeRoleWithWebIdentity` call and
|
||||
return temporary security credentials for use by other actions. In order for
|
||||
this to work, you'll need to preconfigure the IAM IdP in your AWS account
|
||||
This will cause the action to perform an [`AssumeRoleWithWebIdentity`](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) call and
|
||||
return temporary security credentials for use by other steps in your workflow. In order for
|
||||
this to work, you'll need to preconfigure the IAM Identity Provider in your AWS account
|
||||
(see [Assuming a Role](#assuming-a-role) for details).
|
||||
|
||||
You can use this action with the AWS CLI available in
|
||||
@@ -78,7 +111,7 @@ jobs:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
- name: Configure AWS credentials from Test account
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
role-to-assume: arn:aws:iam::111111111111:role/my-github-actions-role-test
|
||||
aws-region: us-east-1
|
||||
@@ -86,7 +119,7 @@ jobs:
|
||||
run: |
|
||||
aws s3 sync . s3://my-s3-test-website-bucket
|
||||
- name: Configure AWS credentials from Production account
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
role-to-assume: arn:aws:iam::222222222222:role/my-github-actions-role-prod
|
||||
aws-region: us-west-2
|
||||
@@ -98,7 +131,13 @@ jobs:
|
||||
See [action.yml](action.yml) for the full documentation for this action's inputs
|
||||
and outputs.
|
||||
|
||||
## Credentials
|
||||
### Note about GHES
|
||||
|
||||
Some of this documentation may be inaccurate if you are using GHES (GitHub Enterprise Servers), please take note to review the GitHub documentation when relevant.
|
||||
|
||||
For example, the URL that the OIDC JWT is issued from is different than the usual `tokens.actions.githubusercontent.com`, and will be unique to your enterprise server. As a result, you will need to configure this differently when you create the Identity Provider.
|
||||
|
||||
## Security recommendations
|
||||
|
||||
We recommend following
|
||||
[Amazon IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
|
||||
@@ -109,15 +148,18 @@ for the AWS credentials used in GitHub Actions workflows, including:
|
||||
GitHub Actions workflows.
|
||||
* [Monitor the activity](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#keep-a-log) of the credentials used in GitHub Actions workflows.
|
||||
|
||||
## Assuming a Role
|
||||
There are four different supported ways to retrieve credentials. We recommend
|
||||
using [GitHub's OIDC provider](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
|
||||
to get short-lived credentials needed for your actions. Specifying
|
||||
`role-to-assume` **without** providing an `aws-access-key-id` or a
|
||||
`web-identity-token-file`, or setting `role-chaining`, will signal to the action that you wish to use the
|
||||
OIDC provider. If `role-chaining` is `true`, existing credentials in the environment will be used to assume `role-to-assume`.
|
||||
## Using this action
|
||||
There are five different supported ways to retrieve credentials:
|
||||
|
||||
The following table describes which identity is used based on which values are supplied to the Action:
|
||||
- Using GitHub's OIDC provider (`AssumeRoleWithWebIdentity`)
|
||||
- Proceeding as an IAM user (No STS call is made)
|
||||
- Using access keys as action input (`AssumeRole`)
|
||||
- Using a WebIdentity Token File (`AssumeRoleWithWebIdentity`)
|
||||
- Using existing credentials in your runner (`AssumeRole`)
|
||||
|
||||
We recommend using [GitHub's OIDC provider](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) to get short-lived AWS credentials needed for your actions. See [OIDC](#OIDC) for more information on how to setup your AWS account to assume a role with OIDC.
|
||||
|
||||
The following table describes which method is used based on which values are supplied to the Action:
|
||||
|
||||
| **Identity Used** | `aws-access-key-id` | `role-to-assume` | `web-identity-token-file` | `role-chaining` |
|
||||
| --------------------------------------------------------------- | ------------------- | ---------------- | ------------------------- | - |
|
||||
@@ -128,97 +170,135 @@ The following table describes which identity is used based on which values are s
|
||||
| Assume Role using existing credentials | | ✔ | | ✔ |
|
||||
|
||||
### Credential Lifetime
|
||||
The default session duration is **1 hour** when using the OIDC provider to
|
||||
directly assume an IAM Role or when an `aws-session-token` is directly provided.
|
||||
The default session duration is **6 hours** when using an IAM User to assume an
|
||||
IAM Role (by providing an `aws-access-key-id`, `aws-secret-access-key`, and a
|
||||
`role-to-assume`) .
|
||||
The default session duration is **1 hour**.
|
||||
|
||||
If you would like to adjust this you can pass a duration to `role-duration-seconds`, but the duration cannot exceed the maximum that was defined when the IAM Role was created.
|
||||
The default session name is GitHubActions, and you can modify it by specifying the desired name in `role-session-name`.
|
||||
The default audience is `sts.amazonaws.com` which you can replace by specifying the desired audience name in `audience`.
|
||||
|
||||
### Examples
|
||||
### External ID
|
||||
If your role requires an external ID to assume, you can provide the external ID with the `role-external-id` input
|
||||
|
||||
#### AssumeRoleWithWebIdentity (recommended)
|
||||
### Session tagging and name
|
||||
The default session name is "GitHubActions", and you can modify it by specifying the desired name in `role-session-name`.
|
||||
The session will be tagged with the following tags: (`GITHUB_` environment variable definitions can be
|
||||
[found here](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables#default-environment-variables))
|
||||
|
||||
| Key | Value |
|
||||
| ---------- | ----------------- |
|
||||
| GitHub | "Actions" |
|
||||
| Repository | GITHUB_REPOSITORY |
|
||||
| Workflow | GITHUB_WORKFLOW |
|
||||
| Action | GITHUB_ACTION |
|
||||
| Actor | GITHUB_ACTOR |
|
||||
| Branch | GITHUB_REF |
|
||||
| Commit | GITHUB_SHA |
|
||||
|
||||
_Note: all tag values must conform to
|
||||
[the requirements](https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html).
|
||||
Particularly, `GITHUB_WORKFLOW` will be truncated if it's too long. If
|
||||
`GITHUB_ACTOR` or `GITHUB_WORKFLOW` contain invalid characters, the characters
|
||||
will be replaced with an '*'._
|
||||
|
||||
The action will use session tagging by default during role assumption, unless you are assuming a role with a WebIdentity.
|
||||
For WebIdentity role assumption, the session tags have to be included
|
||||
in the encoded WebIdentity token. This means that Tags can only be supplied by
|
||||
the OIDC provider, and they cannot set during the AssumeRoleWithWebIdentity API call
|
||||
within the Action. See [issue 419](https://github.com/aws-actions/configure-aws-credentials/issues/419) for more info
|
||||
|
||||
You can skip this session tagging by providing
|
||||
`role-skip-session-tagging` as true in the action's inputs:
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
role-session-name: MySessionName
|
||||
role-skip-session-tagging: true
|
||||
```
|
||||
In this example, the Action will load the OIDC token from the GitHub-provided environment variable and use it to assume the role `arn:aws:iam::123456789100:role/my-github-actions-role` with the session name `MySessionName`.
|
||||
|
||||
#### AssumeRole with static IAM credentials in repository secrets
|
||||
### Session policies
|
||||
|
||||
#### Inline session policies
|
||||
An IAM policy in stringified JSON format that you want to use as an inline session policy.
|
||||
Depending on preferences, the JSON could be written on a single line like this:
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
role-session-name: MySessionName
|
||||
- name: Configure other AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::987654321000:role/my-second-role
|
||||
role-session-name: MySessionName
|
||||
role-chaining: true
|
||||
inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
|
||||
```
|
||||
In this two-step example, the first step will use OIDC to assume the role `arn:aws:iam::123456789100:role/my-github-actions-role` just as in the prior example. Following that, a second step will use this role to assume a different role, `arn:aws:iam::987654321000:role/my-second-role`.
|
||||
|
||||
Or we can have a nicely formatted JSON as well:
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||
aws-region: us-east-2
|
||||
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
|
||||
role-external-id: ${{ secrets.AWS_ROLE_EXTERNAL_ID }}
|
||||
role-duration-seconds: 1200
|
||||
role-session-name: MySessionName
|
||||
inline-session-policy: >-
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid":"Stmt1",
|
||||
"Effect":"Allow",
|
||||
"Action":"s3:List*",
|
||||
"Resource":"*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
In this example, the secret `AWS_ROLE_TO_ASSUME` contains a string like `arn:aws:iam::123456789100:role/my-github-actions-role`. To assume a role in the same account as the static credentials, you can simply specify the role name, like `role-to-assume: my-github-actions-role`.
|
||||
|
||||
#### AssumeRoleWithWebIdentity using a custom audience
|
||||
#### Managed session policies
|
||||
The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies.
|
||||
The policies must exist in the same account as the role. You can pass a single managed policy like this:
|
||||
```yaml
|
||||
- name: Configure AWS Credentials for Beta Customers
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
audience: beta-customers
|
||||
managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
|
||||
```
|
||||
And we can pass multiple managed policies likes this:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
managed-session-policies: |
|
||||
arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
|
||||
arn:aws:iam::aws:policy/AmazonS3OutpostsReadOnlyAccess
|
||||
```
|
||||
|
||||
### Misc
|
||||
|
||||
#### Adjust the retry mechanism
|
||||
You can now configure retry settings for when the STS call fails. By default, we retry with exponential backoff `12` times. You can disable this behavior altogether by setting the `disable-retry` input to `true`, or you can configure the number of times it retries with the `retry-max-attempts` input.
|
||||
|
||||
#### Mask account ID
|
||||
Your account ID is not masked by default in workflow logs since it's not considered sensitive information. However, you can set the `mask-aws-account-id` input to `true` to mask your account ID in workflow logs if desired.
|
||||
|
||||
#### Unset current credentials
|
||||
Sometimes, existing credentials in your runner can get in the way of the intended outcome, and the recommended solution is to include another step in your workflow which unsets the environment variables set by this action. Now if you set the `unset-current-credentials` input to `true`, the workaround is made eaiser
|
||||
|
||||
## OIDC
|
||||
|
||||
We recommend using [GitHub's OIDC provider](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) to get short-lived AWS credentials needed for your actions. When using OIDC, this action will create a JWT unique to the workflow run, and it will use this JWT to assume the role. For this action to create the JWT, it is required for your workflow to have the `id-token: write` permission:
|
||||
|
||||
```yaml
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
```
|
||||
|
||||
### Audience
|
||||
|
||||
When the JWT is created, an audience needs to be specified. By default, the audience is `sts.amazon.com` and this will work for most cases. Changing the default audience may be necessary when using non-default AWS partitions. You can specify the audience through the `audience` input:
|
||||
|
||||
```yaml
|
||||
- name: Configure AWS Credentials for China region audience
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
audience: sts.amazonaws.com.cn
|
||||
aws-region: us-east-3
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
role-session-name: MySessionName
|
||||
```
|
||||
In this example, the audience has been changed from the default to use a different audience name `beta-customers`. This can help ensure that the role can only affect those AWS accounts whose GitHub OIDC providers have explicitly opted in to the `beta-customers` label.
|
||||
|
||||
Changing the default audience may be necessary when using non-default [AWS partitions](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
|
||||
|
||||
#### AssumeRoleWithWebIdentity and disable secure Action outputs
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
role-session-name: MySessionName
|
||||
mask-aws-account-id: false
|
||||
```
|
||||
In this example, account ID masking has been disabled. By default, the AWS
|
||||
account ID will be obscured in the action's output. This may be helpful when
|
||||
debugging action failures.
|
||||
|
||||
## Sample IAM OIDC CloudFormation Template
|
||||
If you choose to use GitHub's OIDC provider, you must first set up federation
|
||||
### Sample IAM OIDC CloudFormation Template
|
||||
To use GitHub's OIDC provider, you must first set up federation
|
||||
with the provider in as an IAM IdP. The GitHub OIDC provider only needs to be
|
||||
created once per account (i.e. multiple IAM Roles that can be assumed by the
|
||||
GitHub's OIDC can share a single OIDC Provider).
|
||||
|
||||
Note that the thumbprint has been set to all F's because the thumbprint is not
|
||||
used when authenticating tokens.actions.githubusercontent.com. Instead, IAM
|
||||
used when authenticating `tokens.actions.githubusercontent.com`. Instead, IAM
|
||||
uses its library of trusted CAs to authenticate. However, this value is still
|
||||
required by the API.
|
||||
|
||||
@@ -282,16 +362,14 @@ Outputs:
|
||||
Value: !GetAtt Role.Arn
|
||||
```
|
||||
|
||||
To align with the Amazon IAM best practice of
|
||||
[granting least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege), the assume role policy document should contain a
|
||||
[`Condition`](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) that specifies a subject allowed to assume the role. Without a subject
|
||||
condition, any GitHub user or repository could potentially assume the role. The
|
||||
subject can be scoped to a GitHub organization and repository as shown in the
|
||||
CloudFormation template. Additional claim conditions can be added for higher
|
||||
specificity as explained in the
|
||||
[GitHub documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect).
|
||||
Due to implementation details, not every OIDC claim is presently supported by
|
||||
IAM.
|
||||
### Claims and scoping permissions
|
||||
To align with the Amazon IAM best practice of [granting least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege), the assume role policy document should contain a [`Condition`](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) that specifies a subject (`sub`) allowed to assume the role. [GitHub also recommends](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#defining-trust-conditions-on-cloud-roles-using-oidc-claims) filtering for the correct audience (`aud`). See [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#condition-keys-wif) on which claims you can filter for in your trust policies.
|
||||
|
||||
Without a subject (`sub`) condition, any GitHub user or repository could potentially assume the role. The subject can be scoped to a GitHub organization and repository as shown in the CloudFormation template. However, scoping it down to your org and repo may cause the role assumption to fail in some cases. See [Example subject claims](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims) for specific details on what the subject value will be depending on your workflow. You can also [customize your subject claim](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-token-claims) if you want full control over the information you can filter for in your trust policy. If you aren't sure what your subject (`sub`) key is, you can add the [`actions-oidc-debugger`](https://github.com/github/actions-oidc-debugger) action to your workflow to see the value of the subject (`sub`) key, as well as other claims.
|
||||
|
||||
Additional claim conditions can be added for higher specificity as explained in the [GitHub documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect). Due to implementation details, not every OIDC claim is presently supported by IAM.
|
||||
|
||||
### Further info
|
||||
|
||||
For further information on OIDC and GitHub Actions, please see:
|
||||
|
||||
@@ -301,82 +379,6 @@ For further information on OIDC and GitHub Actions, please see:
|
||||
* [GitHub docs: Configuring OpenID Connect in Amazon Web Services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
|
||||
* [GitHub changelog: GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/)
|
||||
|
||||
### Session tagging
|
||||
The session will have the name "GitHubActions" and be tagged with the following
|
||||
tags: (`GITHUB_` environment variable definitions can be
|
||||
[found here](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables#default-environment-variables))
|
||||
|
||||
| Key | Value |
|
||||
| ---------- | ----------------- |
|
||||
| GitHub | "Actions" |
|
||||
| Repository | GITHUB_REPOSITORY |
|
||||
| Workflow | GITHUB_WORKFLOW |
|
||||
| Action | GITHUB_ACTION |
|
||||
| Actor | GITHUB_ACTOR |
|
||||
| Branch | GITHUB_REF |
|
||||
| Commit | GITHUB_SHA |
|
||||
|
||||
_Note: all tag values must conform to
|
||||
[the requirements](https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html).
|
||||
Particularly, `GITHUB_WORKFLOW` will be truncated if it's too long. If
|
||||
`GITHUB_ACTOR` or `GITHUB_WORKFLOW` contain invalid characters, the characters
|
||||
will be replaced with an '*'._
|
||||
|
||||
The action will use session tagging by default during role assumption.
|
||||
Note that for WebIdentity role assumption, the session tags have to be included
|
||||
in the encoded WebIdentity token. This means that Tags can only be supplied by
|
||||
the OIDC provider and not set during the AssumeRoleWithWebIdentity API call
|
||||
within the Action. You can skip this session tagging by providing
|
||||
`role-skip-session-tagging` as true in the action's inputs:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
with:
|
||||
role-skip-session-tagging: true
|
||||
```
|
||||
|
||||
### Inline session policy
|
||||
An IAM policy in stringified JSON format that you want to use as an inline session policy.
|
||||
Depending on preferences, the JSON could be written on a single line like this:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
with:
|
||||
inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
|
||||
```
|
||||
Or we can have a nicely formatted JSON as well:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
with:
|
||||
inline-session-policy: >-
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid":"Stmt1",
|
||||
"Effect":"Allow",
|
||||
"Action":"s3:List*",
|
||||
"Resource":"*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Managed session policies
|
||||
The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies.
|
||||
The policies must exist in the same account as the role. You can pass a single managed policy like this:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
with:
|
||||
managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
|
||||
```
|
||||
And we can pass multiple managed policies likes this:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
with:
|
||||
managed-session-policies: |
|
||||
arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
|
||||
arn:aws:iam::aws:policy/AmazonS3OutpostsReadOnlyAccess
|
||||
```
|
||||
|
||||
## Self-Hosted Runners
|
||||
|
||||
If you run your GitHub Actions in a
|
||||
@@ -388,13 +390,13 @@ authenticate on your runner, this Action will as well.
|
||||
|
||||
If no access key credentials are given in the action inputs, this action will
|
||||
use credentials from the runner environment using the
|
||||
[default methods for the AWS SDK for Javascript](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/setting-credentials-node.html).
|
||||
[default methods for the AWS SDK for Javascript](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html).
|
||||
|
||||
You can use this action to simply configure the region and account ID in the
|
||||
environment, and then use the runner's credentials for all AWS API calls made by
|
||||
your Actions workflow:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
```
|
||||
@@ -404,7 +406,7 @@ APIs called by your Actions workflow.
|
||||
Or, you can use this action to assume a role, and then use the role credentials
|
||||
for all AWS API calls made by your Actions workflow:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: my-github-actions-role
|
||||
@@ -427,7 +429,7 @@ environment.
|
||||
|
||||
Manually configured proxy:
|
||||
```yaml
|
||||
uses: aws-actions/configure-aws-credentials@v2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: my-github-actions-role
|
||||
@@ -451,6 +453,78 @@ to executing `aws` commands need to have the AWS CLI
|
||||
if it's not already present.
|
||||
Most [GitHub hosted runner environments](https://github.com/actions/virtual-environments)
|
||||
should include the AWS CLI by default.
|
||||
|
||||
## Examples
|
||||
|
||||
### AssumeRoleWithWebIdentity (recommended)
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
role-session-name: MySessionName
|
||||
```
|
||||
In this example, the Action will load the OIDC token from the GitHub-provided environment variable and use it to assume the role `arn:aws:iam::123456789100:role/my-github-actions-role` with the session name `MySessionName`.
|
||||
|
||||
### AssumeRole with role previously assumed by action in same workflow
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
role-session-name: MySessionName
|
||||
- name: Configure other AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::987654321000:role/my-second-role
|
||||
role-session-name: MySessionName
|
||||
role-chaining: true
|
||||
```
|
||||
In this two-step example, the first step will use OIDC to assume the role `arn:aws:iam::123456789100:role/my-github-actions-role` just as in the prior example. Following that, a second step will use this role to assume a different role, `arn:aws:iam::987654321000:role/my-second-role`.
|
||||
|
||||
### AssumeRole with static IAM credentials in repository secrets
|
||||
```yaml
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||
aws-region: us-east-2
|
||||
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
|
||||
role-external-id: ${{ secrets.AWS_ROLE_EXTERNAL_ID }}
|
||||
role-duration-seconds: 1200
|
||||
role-session-name: MySessionName
|
||||
```
|
||||
In this example, the secret `AWS_ROLE_TO_ASSUME` contains a string like `arn:aws:iam::123456789100:role/my-github-actions-role`. To assume a role in the same account as the static credentials, you can simply specify the role name, like `role-to-assume: my-github-actions-role`.
|
||||
|
||||
### Retrieving credentials from step output, AssumeRole with temporary credentials
|
||||
```yaml
|
||||
- name: Configure AWS Credentials 1
|
||||
id: creds
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
|
||||
output-credentials: true
|
||||
- name: get caller identity 1
|
||||
run: |
|
||||
aws sts get-caller-identity
|
||||
- name: Configure AWS Credentials 2
|
||||
uses: aws-actions/configure-aws-credentials@v3
|
||||
with:
|
||||
aws-region: us-east-2
|
||||
aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}
|
||||
aws-secret-access-key: ${{ steps.creds.outputs.aws-secret-access-key }}
|
||||
aws-session-token: ${{ steps.creds.outputs.aws-session-token }}
|
||||
role-to-assume: arn:aws:iam::123456789100:role/my-other-github-actions-role
|
||||
- name: get caller identity2
|
||||
run: |
|
||||
aws sts get-caller-identity
|
||||
```
|
||||
This example shows that you can reference the fetched credentials as outputs if `output-credentials` is set to true. This example also shows that you can use the `aws-session-token` input in a situation where session tokens are fetched and passed to this action.
|
||||
|
||||
## License Summary
|
||||
This code is made available under the MIT license.
|
||||
|
||||
Reference in New Issue
Block a user