chore(release): 1.4.1

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.686.0 to 2.692.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.686.0...v2.692.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [1.4.1](https://github.com/aws-actions/configure-aws-credentials/compare/v1.4.0...v1.4.1) (2020-06-09)
+
+## [1.4.0](https://github.com/aws-actions/configure-aws-credentials/compare/v1.3.5...v1.4.0) (2020-06-03)
+
+
+### Features
+
+* Refresh and validate credentials after setting env var creds ([#71](https://github.com/aws-actions/configure-aws-credentials/issues/71)) ([472e549](https://github.com/aws-actions/configure-aws-credentials/commit/472e549195ba1f153e9fb72e39dc2a094e5de13e))
+
 ### [1.3.5](https://github.com/aws-actions/configure-aws-credentials/compare/v1.3.4...v1.3.5) (2020-05-27)
 
 

index.js

@@ -132,6 +132,50 @@ async function exportAccountId(maskAccountId, region) {
   return accountId;
 }
 
+function loadCredentials() {
+  // Force the SDK to re-resolve credentials with the default provider chain.
+  //
+  // This action typically sets credentials in the environment via environment variables.
+  // The SDK never refreshes those env-var-based credentials after initial load.
+  // In case there were already env-var creds set in the actions environment when this action
+  // loaded, this action needs to refresh the SDK creds after overwriting those environment variables.
+  //
+  // The credentials object needs to be entirely recreated (instead of simply refreshed),
+  // because the credential object type could change when this action writes env var creds.
+  // For example, the first load could return EC2 instance metadata credentials
+  // in a self-hosted runner, and the second load could return environment credentials
+  // from an assume-role call in this action.
+  aws.config.credentials = null;
+
+  return new Promise((resolve, reject) => {
+    aws.config.getCredentials((err) => {
+      if (err) {
+        reject(err);
+      }
+      resolve(aws.config.credentials);
+    })
+  });
+}
+
+async function validateCredentials(expectedAccessKeyId) {
+  let credentials;
+  try {
+    credentials = await loadCredentials();
+
+    if (!credentials.accessKeyId) {
+      throw new Error('Access key ID empty after loading credentials');
+    }
+  } catch (error) {
+    throw new Error(`Credentials could not be loaded, please check your action inputs: ${error.message}`);
+  }
+
+  const actualAccessKeyId = credentials.accessKeyId;
+
+  if (expectedAccessKeyId && expectedAccessKeyId != actualAccessKeyId) {
+    throw new Error('Unexpected failure: Credentials loaded by the SDK do not match the access key ID configured by the action');
+  }
+}
+
 function getStsClient(region) {
   return new aws.STS({
     region,
@@ -172,6 +216,13 @@ async function run() {
       exportCredentials({accessKeyId, secretAccessKey, sessionToken});
     }
 
+    // Regardless of whether any source credentials were provided as inputs,
+    // validate that the SDK can actually pick up credentials.  This validates
+    // cases where this action is on a self-hosted runner that doesn't have credentials
+    // configured correctly, and cases where the user intended to provide input
+    // credentials but the secrets inputs resolved to empty strings.
+    await validateCredentials(accessKeyId);
+
     const sourceAccountId = await exportAccountId(maskAccountId, region);
 
     // Get role credentials if configured to do so
@@ -185,6 +236,7 @@ async function run() {
         roleSessionName
       });
       exportCredentials(roleCredentials);
+      await validateCredentials(roleCredentials.accessKeyId);
       await exportAccountId(maskAccountId, region);
     }
   }

index.test.js

@@ -1,6 +1,6 @@
 const core = require('@actions/core');
 const assert = require('assert');
-
+const aws = require('aws-sdk');
 const run = require('.');
 
 jest.mock('@actions/core');
@@ -49,6 +49,9 @@ const mockStsAssumeRole = jest.fn();
 
 jest.mock('aws-sdk', () => {
     return {
+        config: {
+            getCredentials: jest.fn()
+        },
         STS: jest.fn(() => ({
             getCallerIdentity: mockStsCallerIdentity,
             assumeRole: mockStsAssumeRole,
@@ -82,6 +85,27 @@ describe('Configure AWS Credentials', () => {
                 }
             });
 
+        aws.config.getCredentials.mockReset();
+        aws.config.getCredentials
+            .mockImplementationOnce(callback => {
+                if (!aws.config.credentials) {
+                    aws.config.credentials = {
+                        accessKeyId: FAKE_ACCESS_KEY_ID,
+                        secretAccessKey: FAKE_SECRET_ACCESS_KEY
+                    }
+                }
+                callback(null);
+            })
+            .mockImplementationOnce(callback => {
+                if (!aws.config.credentials) {
+                    aws.config.credentials = {
+                        accessKeyId: FAKE_STS_ACCESS_KEY_ID,
+                        secretAccessKey: FAKE_STS_SECRET_ACCESS_KEY
+                    }
+                }
+                callback(null);
+            });
+
         mockStsAssumeRole.mockImplementation(() => {
             return {
                 promise() {
@@ -134,6 +158,59 @@ describe('Configure AWS Credentials', () => {
         expect(core.setSecret).toHaveBeenCalledWith(FAKE_ACCOUNT_ID);
     });
 
+    test('action with no accessible credentials fails', async () => {
+        process.env.SHOW_STACK_TRACE = 'false';
+        const mockInputs = {'aws-region': FAKE_REGION};
+        core.getInput = jest
+            .fn()
+            .mockImplementation(mockGetInput(mockInputs));
+        aws.config.getCredentials.mockReset();
+        aws.config.getCredentials.mockImplementation(callback => {
+            callback(new Error('No credentials to load'));
+        });
+
+        await run();
+
+        expect(core.setFailed).toHaveBeenCalledWith("Credentials could not be loaded, please check your action inputs: No credentials to load");
+    });
+
+    test('action with empty credentials fails', async () => {
+        process.env.SHOW_STACK_TRACE = 'false';
+        const mockInputs = {'aws-region': FAKE_REGION};
+        core.getInput = jest
+            .fn()
+            .mockImplementation(mockGetInput(mockInputs));
+        aws.config.getCredentials.mockReset();
+        aws.config.getCredentials.mockImplementation(callback => {
+            aws.config.credentials = {
+                accessKeyId: ''
+            }
+            callback(null);
+        });
+
+        await run();
+
+        expect(core.setFailed).toHaveBeenCalledWith("Credentials could not be loaded, please check your action inputs: Access key ID empty after loading credentials");
+    });
+
+    test('action fails when credentials are not set in the SDK correctly', async () => {
+        process.env.SHOW_STACK_TRACE = 'false';
+        core.getInput = jest
+            .fn()
+            .mockImplementation(mockGetInput(ASSUME_ROLE_INPUTS));
+        aws.config.getCredentials.mockReset();
+        aws.config.getCredentials.mockImplementation(callback => {
+            aws.config.credentials = {
+                accessKeyId: FAKE_ACCESS_KEY_ID
+            }
+            callback(null);
+        });
+
+        await run();
+
+        expect(core.setFailed).toHaveBeenCalledWith("Unexpected failure: Credentials loaded by the SDK do not match the access key ID configured by the action");
+    });
+
     test('session token is optional', async () => {
         const mockInputs = {...CREDS_INPUTS, 'aws-region': 'eu-west-1'};
         core.getInput = jest
@@ -154,12 +231,19 @@ describe('Configure AWS Credentials', () => {
         expect(core.setSecret).toHaveBeenCalledWith(FAKE_ACCOUNT_ID);
     });
 
-    test('session token is cleared if necessary', async () => {
+    test('existing env var creds are cleared', async () => {
         const mockInputs = {...CREDS_INPUTS, 'aws-region': 'eu-west-1'};
         core.getInput = jest
             .fn()
             .mockImplementation(mockGetInput(mockInputs));
+        process.env.AWS_ACCESS_KEY_ID = 'foo';
+        process.env.AWS_SECRET_ACCESS_KEY = 'bar';
         process.env.AWS_SESSION_TOKEN = 'helloworld';
+        aws.config.credentials = {
+            accessKeyId: 'foo',
+            secretAccessKey: 'bar',
+            sessionToken: 'helloworld'
+        };
 
         await run();
         expect(mockStsAssumeRole).toHaveBeenCalledTimes(0);
@@ -174,6 +258,9 @@ describe('Configure AWS Credentials', () => {
         expect(core.exportVariable).toHaveBeenCalledWith('AWS_REGION', 'eu-west-1');
         expect(core.setOutput).toHaveBeenCalledWith('aws-account-id', FAKE_ACCOUNT_ID);
         expect(core.setSecret).toHaveBeenCalledWith(FAKE_ACCOUNT_ID);
+        expect(aws.config.credentials.accessKeyId).toBe(FAKE_ACCESS_KEY_ID);
+        expect(aws.config.credentials.secretAccessKey).toBe(FAKE_SECRET_ACCESS_KEY);
+        expect(aws.config.credentials.sessionToken).toBeUndefined();
     });
 
     test('validates region name', async () => {

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-actions-configure-aws-credentials",
-  "version": "1.3.5",
+  "version": "1.4.1",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -1203,11 +1203,11 @@
       "dev": true
     },
     "aws-sdk": {
-      "version": "2.684.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.684.0.tgz",
-      "integrity": "sha512-OkSMKIbRTBd3YV5iAklJxZFyLg0jRO2XW6+WhMuDBHMEs8aRbZw4iAD85wFC8tG7X9o0kcjnWfZUDq7MK1dcDg==",
+      "version": "2.692.0",
+      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.692.0.tgz",
+      "integrity": "sha512-fQRbZq+urzE4VjciEr6KNY7vbzougcVg7UqbHKGcgBT7EPtSbog9C2i9YY9Yum8PRuP1GAmfvC2Vthlw6dVTGw==",
       "requires": {
-        "buffer": "4.9.1",
+        "buffer": "4.9.2",
         "events": "1.1.1",
         "ieee754": "1.1.13",
         "jmespath": "0.15.0",
@@ -1467,9 +1467,9 @@
       }
     },
     "buffer": {
-      "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-4.9.1.tgz",
-      "integrity": "sha1-bRu2AbB6TvztlwlBMgkwJ8lbwpg=",
+      "version": "4.9.2",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-4.9.2.tgz",
+      "integrity": "sha512-xq+q3SRMOxGivLhBNaUdC64hDTQwejJ+H0T/NB1XMtTVEwNTrfFF3gAxiyW0Bu/xWEGhjVKgUcMhCrUy2+uCWg==",
       "requires": {
         "base64-js": "^1.0.2",
         "ieee754": "^1.1.4",
@@ -1951,9 +1951,9 @@
       }
     },
     "eslint": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.1.0.tgz",
-      "integrity": "sha512-DfS3b8iHMK5z/YLSme8K5cge168I8j8o1uiVmFCgnnjxZQbCGyraF8bMl7Ju4yfBmCuxD7shOF7eqGkcuIHfsA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.2.0.tgz",
+      "integrity": "sha512-B3BtEyaDKC5MlfDa2Ha8/D6DsS4fju95zs0hjS3HdGazw+LNayai38A25qMppK37wWGWNYSPOR6oYzlz5MHsRQ==",
       "dev": true,
       "requires": {
         "@babel/code-frame": "^7.0.0",
@@ -1962,10 +1962,10 @@
         "cross-spawn": "^7.0.2",
         "debug": "^4.0.1",
         "doctrine": "^3.0.0",
-        "eslint-scope": "^5.0.0",
+        "eslint-scope": "^5.1.0",
         "eslint-utils": "^2.0.0",
-        "eslint-visitor-keys": "^1.1.0",
-        "espree": "^7.0.0",
+        "eslint-visitor-keys": "^1.2.0",
+        "espree": "^7.1.0",
         "esquery": "^1.2.0",
         "esutils": "^2.0.2",
         "file-entry-cache": "^5.0.1",
@@ -2133,9 +2133,9 @@
       }
     },
     "eslint-scope": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.0.0.tgz",
-      "integrity": "sha512-oYrhJW7S0bxAFDvWqzvMPRm6pcgcnWc4QnofCAqRTRfQC0JcwenzGglTtsLyIuuWFfkqDG9vz67cnttSd53djw==",
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.0.tgz",
+      "integrity": "sha512-iiGRvtxWqgtx5m8EyQUJihBloE4EnYeGE/bz1wSPwJE6tZuJUtHlhqDM4Xj2ukE8Dyy1+HCZ4hE0fzIVMzb58w==",
       "dev": true,
       "requires": {
         "esrecurse": "^4.1.0",
@@ -2152,20 +2152,28 @@
       }
     },
     "eslint-visitor-keys": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.1.0.tgz",
-      "integrity": "sha512-8y9YjtM1JBJU/A9Kc+SbaOV4y29sSWckBwMHa+FGtVj5gN/sbnKDf6xJUl+8g7FAij9LVaP8C24DUiH/f/2Z9A==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.2.0.tgz",
+      "integrity": "sha512-WFb4ihckKil6hu3Dp798xdzSfddwKKU3+nGniKF6HfeW6OLd2OUDEPP7TcHtB5+QXOKg2s6B2DaMPE1Nn/kxKQ==",
       "dev": true
     },
     "espree": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-7.0.0.tgz",
-      "integrity": "sha512-/r2XEx5Mw4pgKdyb7GNLQNsu++asx/dltf/CI8RFi9oGHxmQFgvLbc5Op4U6i8Oaj+kdslhJtVlEZeAqH5qOTw==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-7.1.0.tgz",
+      "integrity": "sha512-dcorZSyfmm4WTuTnE5Y7MEN1DyoPYy1ZR783QW1FJoenn7RailyWFsq/UL6ZAAA7uXurN9FIpYyUs3OfiIW+Qw==",
       "dev": true,
       "requires": {
-        "acorn": "^7.1.1",
+        "acorn": "^7.2.0",
         "acorn-jsx": "^5.2.0",
-        "eslint-visitor-keys": "^1.1.0"
+        "eslint-visitor-keys": "^1.2.0"
+      },
+      "dependencies": {
+        "acorn": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.2.0.tgz",
+          "integrity": "sha512-apwXVmYVpQ34m/i71vrApRrRKCWQnZZF1+npOD0WV5xZFfwWOmKGQ2RWlfdy9vWITsenisM8M0Qeq8agcFHNiQ==",
+          "dev": true
+        }
       }
     },
     "esprima": {
@@ -6396,9 +6404,9 @@
       "optional": true
     },
     "v8-compile-cache": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.1.0.tgz",
-      "integrity": "sha512-usZBT3PW+LOjM25wbqIlZwPeJV+3OSz3M1k1Ws8snlW39dZyYL9lOGC5FgPVHfk0jKmjiDV8Z0mIbVQPiwFs7g==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.1.1.tgz",
+      "integrity": "sha512-8OQ9CL+VWyt3JStj7HX7/ciTL2V3Rl1Wf5OL+SNTm0yK1KvtReVulksyeRnCANHHuUxHlQig+JJDlUhBt1NQDQ==",
       "dev": true
     },
     "v8-to-istanbul": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-actions-configure-aws-credentials",
-  "version": "1.3.5",
+  "version": "1.4.1",
   "description": "Configure AWS Credentials",
   "main": "index.js",
   "scripts": {
@@ -26,11 +26,11 @@
   "homepage": "https://github.com/aws-actions/configure-aws-credentials#readme",
   "dependencies": {
     "@actions/core": "^1.2.4",
-    "aws-sdk": "^2.684.0"
+    "aws-sdk": "^2.692.0"
   },
   "devDependencies": {
     "@zeit/ncc": "^0.22.3",
-    "eslint": "^7.1.0",
+    "eslint": "^7.2.0",
     "jest": "^26.0.1"
   }
 }