aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-02 05:55:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

refactor, add new major version features and proxy

Browse Source
This commit is contained in:
peterwoodworth
2023-03-10 14:35:59 -08:00
parent 0037a686cc
commit f9f25e69f5
9 changed files with 333 additions and 212 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/helpers.ts
+55 -13
View File
@@ -1,20 +1,11 @@
import { STSClient } from '@aws-sdk/client-sts';
import * as core from '@actions/core';
import type { Credentials } from '@aws-sdk/client-sts';
import { GetCallerIdentityCommand } from '@aws-sdk/client-sts';
import type { CredentialsClient } from './CredentialsClient';
const MAX_TAG_VALUE_LENGTH = 256;
const SANITIZATION_CHARACTER = '_';
let stsclient: STSClient | undefined;
export function getStsClient(region: string, customUserAgent?: string) {
if (!stsclient) {
stsclient = new STSClient({
region,
...(customUserAgent ? { customUserAgent } : {}),
});
}
return stsclient;
}
export function sanitizeGithubActor(actor: string) {
// In some circumstances the actor may contain square brackets. For example, if they're a bot ('[bot]')
// Square brackets are not allowed in AWS session tags
@@ -74,3 +65,54 @@ export async function retryAndBackoff<T>(
return await retryAndBackoff(fn, isRetryable, retries, maxRetries, base);
}
}
export function exportCredentials(creds?: Partial<Credentials>) {
// Configure the AWS CLI and AWS SDKs using environment variables and set them as secrets.
// Setting the credentials as secrets masks them in Github Actions logs
// AWS_ACCESS_KEY_ID:
// Specifies an AWS access key associated with an IAM user or role
if (creds?.AccessKeyId) {
core.setSecret(creds.AccessKeyId);
core.exportVariable('AWS_ACCESS_KEY_ID', creds.AccessKeyId);
}
// AWS_SECRET_ACCESS_KEY:
// Specifies the secret key associated with the access key. This is essentially the "password" for the access key.
if (creds?.SecretAccessKey) {
core.setSecret(creds.SecretAccessKey);
core.exportVariable('AWS_SECRET_ACCESS_KEY', creds.SecretAccessKey);
}
// AWS_SESSION_TOKEN:
// Specifies the session token value that is required if you are using temporary security credentials.
if (creds?.SessionToken) {
core.setSecret(creds.SessionToken);
core.exportVariable('AWS_SESSION_TOKEN', creds.SessionToken);
} else if (process.env['AWS_SESSION_TOKEN']) {
// clear session token from previous credentials action
core.exportVariable('AWS_SESSION_TOKEN', '');
}
}
export function exportRegion(region: string) {
// AWS_DEFAULT_REGION and AWS_REGION:
// Specifies the AWS Region to send requests to
core.exportVariable('AWS_DEFAULT_REGION', region);
core.exportVariable('AWS_REGION', region);
}
export async function exportAccountId(credentialsClient: CredentialsClient, maskAccountId?: string) {
// Get the AWS account ID
const client = credentialsClient.getStsClient();
const identity = await client.send(new GetCallerIdentityCommand({}));
const accountId = identity.Account;
if (!accountId) {
throw new Error('Could not get Account ID from STS. Did you set credentials?');
}
if (maskAccountId) {
core.setSecret(accountId);
}
core.setOutput('aws-account-id', accountId);
return accountId;
}