* Allow to pass inline session policy as a parameter
Update the action file
Regenerate the dist/ content
Add test
* Fix typos
* Fix stylistic error
* Move the inline policy logic to allow assumeRole to use it as well; Update and add tests
* Add an option for managed policies
* Regenerate the dist/ files
* Use multiline input for managed policies
* Update readme
* Update readme
---------
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
* fix: packaging test failure
The tests fail if there are credentials available in the env, so
we need to get the AWS credentials *after* the package step.
* chore: remove unnecessary environment manipulation
* fix: packaging fixes
* fix: packaging test failure
The tests fail if there are credentials available in the env, so
we need to get the AWS credentials *after* the package step.
* chore: remove unnecessary environment manipulation
The default audience for the GitHub OIDC uses sts.amazonaws.com, but there are
situations when it would be desirable to allow different audience names to be
used instead. Allow this to be specified as an argument to the action.
* Revert "chore: Update dist"
This reverts commit 9815921334.
* Revert "fix: Updated token retrieval to use new API (#270)"
This reverts commit 20ce4e5ba1.
* feat: Add the ability to use a web identity token file
* mark web identity token file as not required
* fix indentation
* better docs and added support for relative vs absolute paths
* bind sts context and adjust fs calls
* exclude tags if using web identity token file
* fix readme aand adjust tag removal logic
* undo re-ordering of lines
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
description:What is the problem? A clear and concise description of the bug.
validations:
required:true
- type:textarea
id:expected
attributes:
label:Expected Behavior
description:|
What did you expect to happen?
validations:
required:true
- type:textarea
id:current
attributes:
label:Current Behavior
description:|
What actually happened?
Please include full errors, uncaught exceptions, stack traces, and relevant logs.
If service responses are relevant, please include wire logs.
validations:
required:true
- type:textarea
id:reproduction
attributes:
label:Reproduction Steps
description:|
Provide a self-contained, concise snippet of code that can be used to reproduce the issue.
For more complex issues provide a repo with the smallest sample that reproduces the bug.
Avoid including business logic or unrelated code, it makes diagnosis more difficult.
The code sample should be an SSCCE. See http://sscce.org/ for details. In short, please provide a code sample that we can copy/paste, run and reproduce.
validations:
required:true
- type:textarea
id:solution
attributes:
label:Possible Solution
description:|
Suggest a fix/reason for the bug
validations:
required:false
- type:textarea
id:context
attributes:
label:Additional Information/Context
description:|
Anything else that might be relevant for troubleshooting this bug. Providing context helps us come up with a solution that is most useful in the real world.
* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws-actions/configure-aws-credentials/blob/main/CONTRIBUTING.md)
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
# Setting messages to an empty string will cause the automation to skip
# that category
ancient-issue-message:This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
stale-issue-message:This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
stale-pr-message:This PR has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
# These labels are required
stale-issue-label:closing-soon
exempt-issue-labels:no-autoclose
stale-pr-label:closing-soon
exempt-pr-labels:no-autoclose
response-requested-label:response-requested
# Don't set closed-for-staleness label to skip closing very old issues
# regardless of label
closed-for-staleness-label:closed-for-staleness
# Issue timing
days-before-stale:5
days-before-close:2
days-before-ancient:36500
# If you don't want to mark a issue as being ancient based on a
# threshold of "upvotes", you can set this here. An "upvote" is
# the total number of +1, heart, hooray, and rocket reactions
# on an issue.
minimum-upvotes-to-exempt:5
repo-token:${{ secrets.GITHUB_TOKEN }}
loglevel:DEBUG
# Set dry-run to true to not perform label or close actions.
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
*`inline-session-policy` prop enables assuming a role with inline session policies ([d00f6c6](https://github.com/aws-actions/configure-aws-credentials/commit/d00f6c6f41fde02a9fd0d469040be6ed0df69e73))
*`managed-session-policies` prop enables assuming a role with managed policy arns ([d00f6c6](https://github.com/aws-actions/configure-aws-credentials/commit/d00f6c6f41fde02a9fd0d469040be6ed0df69e73))
*`role-chaining` prop enables role chaining use case ([6fbd316](https://github.com/aws-actions/configure-aws-credentials/commit/6fbd316fd15f52c3d9f68e7aa06eae4f5699a518))
* Allow audience to be explicitly specified ([2f8dfd0](https://github.com/aws-actions/configure-aws-credentials/commit/2f8dfd0ed43d880f85b57f0c8727b497af2037de))
* Add the ability to use a web identity token file ([#240](https://github.com/aws-actions/configure-aws-credentials/issues/240)) ([8053174](https://github.com/aws-actions/configure-aws-credentials/commit/8053174404968575ac1dd102dcb1109d2fe6d9ea))
* upgraded to new GH OIDC API ([#284](https://github.com/aws-actions/configure-aws-credentials/issues/284)) ([036a4a1](https://github.com/aws-actions/configure-aws-credentials/commit/036a4a1ddf2c0e7a782dca6e083c6c53e5d90321))
### Bug Fixes
* reverting update to use new API ([#274](https://github.com/aws-actions/configure-aws-credentials/issues/274)) ([a78fcb0](https://github.com/aws-actions/configure-aws-credentials/commit/a78fcb01f76c8c5c3b05ab82718a6f7919fc0269)), closes [#270](https://github.com/aws-actions/configure-aws-credentials/issues/270)
* typo "charcters" in README.md ([#241](https://github.com/aws-actions/configure-aws-credentials/issues/241)) ([c48e1b5](https://github.com/aws-actions/configure-aws-credentials/commit/c48e1b578416f3457ccf757c47385df5c054d23f))
* Updated token retrieval to use new API ([#270](https://github.com/aws-actions/configure-aws-credentials/issues/270)) ([20ce4e5](https://github.com/aws-actions/configure-aws-credentials/commit/20ce4e5ba1de2e753d034b5415075a8767d64d4d))
@@ -23,7 +23,7 @@ reported the issue. Please try to include as much information as you can. Detail
## Contributing via Pull Requests
## Contributing via Pull Requests
Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
1. You are working against the latest source on the *master* branch.
1. You are working against the latest source on the *main* branch.
2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
@@ -56,6 +56,6 @@ If you discover a potential security issue in this project we ask that you notif
## Licensing
## Licensing
See the [LICENSE](https://github.com/aws-actions/configure-aws-credentials/blob/master/LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.
See the [LICENSE](https://github.com/aws-actions/configure-aws-credentials/blob/main/LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.
We may ask you to sign a [Contributor License Agreement (CLA)](http://en.wikipedia.org/wiki/Contributor_License_Agreement) for larger changes.
We may ask you to sign a [Contributor License Agreement (CLA)](http://en.wikipedia.org/wiki/Contributor_License_Agreement) for larger changes.
## "Configure AWS Credentials" Action For GitHub Actions
## Configure AWS Credentials for GitHub Actions
Configure your AWS credentials and region environment variables for use in other
GitHub Actions. This action implements the AWS SDK credential resolution chain
and exports environment variables for your other Actions to use. Environment
variable exports are detected by both the AWS SDKs and the AWS CLI for AWS API
calls.
Configure AWS credential and region environment variables for use in other GitHub Actions. The environment variables will be detected by both the AWS SDKs and the AWS CLI to determine the credentials and region to use for AWS API calls.
### Recent updates
We've recently released a `v2` of this action that uses the Node 16 runtime by
default. You should update your action references to `v2`. We intend `v2` to be
the new default for this action and will no longer be providing updates to the
`v1` tag.
**Table of Contents**
When migrating to `v2`, you don't have to consider any changes other than the node version.
There are no breaking changes between versions; As of release of v2, the node version is the only change.
As is usual for GitHub Actions, we provide release tags for you to reference in
your repository's workflow files. The `v2` tag is a moving tag that will always
apply to the lastest version 2 train release. We will also provide minor version
tags on every release, and create a `v3` tag when we are ready for a new major
release. If you had been following the development of this action so far, this
is a change to previous states release policy.
### Table of Contents
<!-- toc -->
<!-- toc -->
- [Usage](#usage)
- [Usage](#usage)
- [Credentials](#credentials)
- [Credentials](#credentials)
- [Assuming a Role](#assuming-a-role)
- [Assuming a Role](#assuming-a-role)
+ [Permissions for assuming a role](#permissions-for-assuming-a-role)
+ [Session tagging](#session-tagging)
+ [Session tagging](#session-tagging)
+ [Sample IAM Role Permissions](#sample-iam-role-cloudformation-template)
- [Self-Hosted Runners](#self-hosted-runners)
- [Self-Hosted Runners](#self-hosted-runners)
+ [Proxy Configuration](#proxy-configuration)
- [License Summary](#license-summary)
- [License Summary](#license-summary)
- [Security Disclosures](#security-disclosures)
- [Security Disclosures](#security-disclosures)
<!-- tocstop -->
<!-- tocstop -->
## Usage
## Usage
We support four methods for fetching credentials from AWS, but we recommend that
you use GitHub's OIDC provider in conjunction with a configured AWS IAM
Identity Provider endpoint.
Add the following step to your workflow:
To do that, you would add the following step to your workflow:
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region:us-east-2
aws-region:us-east-2
```
```
This will cause the action to perform an `AssumeRoleWithWebIdentity` call and
return temporary security credentials for use by other actions. In order for
this to work, you'll need to preconfigure the IAM IdP in your AWS account
(see [Assuming a Role](#assuming-a-role) for details).
For example, you can use this action with the AWS CLI available in [GitHub's hosted virtual environments](https://help.github.com/en/actions/reference/software-installed-on-github-hosted-runners).
You can use this action with the AWS CLI available in
You can also run this action multiple times to use different AWS accounts, regions, or IAM roles in the same GitHub Actions workflow job.
[GitHub's hosted virtual environments](https://help.github.com/en/actions/reference/software-installed-on-github-hosted-runners) or run this action multiple times
to use different AWS accounts, regions, or IAM roles in the same GitHub Actions
workflow. As an example, here is a complete workflow file that uploads artifacts
to Amazon S3.
```yaml
```yaml
jobs:
jobs:
deploy:
deploy:
name:Upload to Amazon S3
name:Upload to Amazon S3
runs-on:ubuntu-latest
runs-on:ubuntu-latest
# These permissions are needed to interact with GitHub's OIDC Token endpoint.
permissions:
id-token:write
contents:read
steps:
steps:
- name:Checkout
- name:Checkout
uses:actions/checkout@v2
uses:actions/checkout@v3
- name:Configure AWS credentials from Test account
- name:Configure AWS credentials from Test account
- name:Copy files to the production website with the AWS CLI
- name:Copy files to the production website with the AWS CLI
run:|
run:|
aws s3 sync . s3://my-s3-prod-website-bucket
aws s3 sync . s3://my-s3-prod-website-bucket
```
```
See [action.yml](action.yml) for the full documentation for this action's inputs and outputs.
See [action.yml](action.yml) for the full documentation for this action's inputs
and outputs.
## Credentials
## Credentials
We recommend following [Amazon IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) for the AWS credentials used in GitHub Actions workflows, including:
We recommend following
* Do not store credentials in your repository's code. You may use [GitHub Actions secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets) to store credentials and redact credentials from GitHub Actions workflow logs.
[Amazon IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
* [Create an individual IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users) with an access key for use in GitHub Actions workflows, preferably one per repository. Do not use the AWS account root user access key.
for the AWS credentials used in GitHub Actions workflows, including:
*[Grant least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege) to the credentials used in GitHub Actions workflows. Grant only the permissions required to perform the actions in your GitHub Actions workflows.
*Do not store credentials in your repository's code.
* [Rotate the credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials) used in GitHub Actions workflows regularly.
* [Grant least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege) to the credentials used in GitHub Actions
* [Monitor the activity](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#keep-a-log) of the credentials used in GitHub Actions workflows.
workflows. Grant only the permissions required to perform the actions in your
GitHub Actions workflows.
* [Monitor the activity](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#keep-a-log) of the credentials used in GitHub Actions workflows.
## Assuming a Role
## Assuming a Role
If you would like to use the static credentials you provide to this action to assume a role, you can do so by specifying the role ARN in `role-to-assume`.
There are four different supported ways to retrieve credentials. We recommend
The role credentials will then be configured in the Actions environment instead of the static credentials you have provided.
using [GitHub's OIDC provider](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
The default session duration is 6 hours, but if you would like to adjust this you can pass a duration to `role-duration-seconds`.
to get short-lived credentials needed for your actions. Specifying
The default session name is GitHubActions, and you can modify it by specifying the desired name in `role-session-name`.
`role-to-assume`**without** providing an `aws-access-key-id` or a
`web-identity-token-file`, or setting `role-chaining`, will signal to the action that you wish to use the
OIDC provider. If `role-chaining` is `true`, existing credentials in the environment will be used to assume `role-to-assume`.
Example:
The following table describes which identity is used based on which values are supplied to the Action:
| [✅ Recommended] Assume Role directly using GitHub OIDC provider | | ✔ | | |
| IAM User | ✔ | | | |
| Assume Role using IAM User credentials | ✔ | ✔ | | |
| Assume Role using WebIdentity Token File credentials | | ✔ | ✔ | |
| Assume Role using existing credentials | | ✔ | | ✔ |
### Credential Lifetime
The default session duration is **1 hour** when using the OIDC provider to
directly assume an IAM Role or when an `aws-session-token` is directly provided.
The default session duration is **6 hours** when using an IAM User to assume an
IAM Role (by providing an `aws-access-key-id`, `aws-secret-access-key`, and a
`role-to-assume`) .
If you would like to adjust this you can pass a duration to `role-duration-seconds`, but the duration cannot exceed the maximum that was defined when the IAM Role was created.
The default session name is GitHubActions, and you can modify it by specifying the desired name in `role-session-name`.
The default audience is `sts.amazonaws.com` which you can replace by specifying the desired audience name in `audience`.
In this example, the Action will load the OIDC token from the GitHub-provided environment variable and use it to assume the role `arn:aws:iam::123456789100:role/my-github-actions-role` with the session name `MySessionName`.
#### AssumeRole with static IAM credentials in repository secrets
In this two-step example, the first step will use OIDC to assume the role `arn:aws:iam::123456789100:role/my-github-actions-role` just as in the prior example. Following that, a second step will use this role to assume a different role, `arn:aws:iam::987654321000:role/my-second-role`.
In this example, the secret `AWS_ROLE_TO_ASSUME` contains a string like `arn:aws:iam::123456789100:role/my-github-actions-role`. To assume a role in the same account as the static credentials, you can simply specify the role name, like `role-to-assume: my-github-actions-role`.
In this example, the secret `AWS_ROLE_TO_ASSUME` contains a string like `arn:aws:iam::123456789100:role/my-github-actions-role`. To assume a role in the same account as the static credentials, you can simply specify the role name, like `role-to-assume: my-github-actions-role`.
### Permissions for assuming a role
#### AssumeRoleWithWebIdentity using a custom audience
```yaml
- name:Configure AWS Credentials for Beta Customers
In this example, the audience has been changed from the default to use a different audience name `beta-customers`. This can help ensure that the role can only affect those AWS accounts whose GitHub OIDC providers have explicitly opted in to the `beta-customers` label.
In order to assume a role, the IAM user for the static credentials must have the following permissions:
Changing the default audience may be necessary when using non-default [AWS partitions](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
```json
{
#### AssumeRoleWithWebIdentity and disable secure Action outputs
The role's trust policy must allow the IAM user to assume the role:
To align with the Amazon IAM best practice of
```json
[granting least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege), the assume role policy document should contain a
{
[`Condition`](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) that specifies a subject allowed to assume the role. Without a subject
"Version":"2012-10-17",
condition, any GitHub user or repository could potentially assume the role. The
"Statement":[
subject can be scoped to a GitHub organization and repository as shown in the
{
CloudFormation template. Additional claim conditions can be added for higher
* [AWS docs: IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)
"Sid":"AllowPassSessionTags",
* [GitHub docs: About security hardening with OpenID Connect](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
"Effect":"Allow",
* [GitHub docs: Configuring OpenID Connect in Amazon Web Services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
The session will have the name "GitHubActions" and be tagged with the following tags:
The session will have the name "GitHubActions" and be tagged with the following
(`GITHUB_` environment variable definitions can be [found here](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables#default-environment-variables))
tags: (`GITHUB_` environment variable definitions can be
_Note: all tag values must conform to [the requirements](https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html). Particularly, `GITHUB_WORKFLOW` will be truncated if it's too long. If `GITHUB_ACTOR` or `GITHUB_WORKFLOW` contain invalid charcters, the characters will be replaced with an '*'._
The action will use session tagging by default during role assumption. You can skip this session tagging by providing `role-skip-session-tagging` as true in the action's inputs:
Particularly, `GITHUB_WORKFLOW` will be truncated if it's too long. If
`GITHUB_ACTOR` or `GITHUB_WORKFLOW` contain invalid characters, the characters
will be replaced with an '*'._
The action will use session tagging by default during role assumption.
Note that for WebIdentity role assumption, the session tags have to be included
in the encoded WebIdentity token. This means that Tags can only be supplied by
the OIDC provider and not set during the AssumeRoleWithWebIdentity API call
within the Action. You can skip this session tagging by providing
`role-skip-session-tagging` as true in the action's inputs:
```yaml
```yaml
uses:aws-actions/configure-aws-credentials@v1
uses:aws-actions/configure-aws-credentials@v2
with:
with:
role-skip-session-tagging:true
role-skip-session-tagging:true
```
```
### Inline session policy
An IAM policy in stringified JSON format that you want to use as an inline session policy.
Depending on preferences, the JSON could be written on a single line like this:
If you run your GitHub Actions in a [self-hosted runner](https://help.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners) that already has access to AWS credentials, such as an EC2 instance, then you do not need to provide IAM user access key credentials to this action.
If you run your GitHub Actions in a
[self-hosted runner](https://help.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners) that already has access to AWS credentials, such as
an EC2 instance, then you do not need to provide IAM user access key credentials
to this action. We will use the standard AWS JavaScript SDK credential
resolution methods to find your credentials, so if the AWS JS SDK can
authenticate on your runner, this Action will as well.
If no access key credentials are given in the action inputs, this action will use credentials from the runner environment using the [default methods for the AWS SDK for Javascript](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/setting-credentials-node.html).
If no access key credentials are given in the action inputs, this action will
use credentials from the runner environment using the
[default methods for the AWS SDK for Javascript](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/setting-credentials-node.html).
You can use this action to simply configure the region and account ID in the environment, and then use the runner's credentials for all AWS API calls made by your Actions workflow:
You can use this action to simply configure the region and account ID in the
environment, and then use the runner's credentials for all AWS API calls made by
your Actions workflow:
```yaml
```yaml
uses:aws-actions/configure-aws-credentials@v1
uses:aws-actions/configure-aws-credentials@v2
with:
with:
aws-region:us-east-2
aws-region:us-east-2
```
```
In this case, your runner's credentials must have permissions to call any AWS APIs called by your Actions workflow.
In this case, your runner's credentials must have permissions to call any AWS
APIs called by your Actions workflow.
Or, you can use this action to assume a role, and then use the role credentials for all AWS API calls made by your Actions workflow:
Or, you can use this action to assume a role, and then use the role credentials
for all AWS API calls made by your Actions workflow:
```yaml
```yaml
uses:aws-actions/configure-aws-credentials@v1
uses:aws-actions/configure-aws-credentials@v2
with:
with:
aws-region:us-east-2
aws-region:us-east-2
role-to-assume:my-github-actions-role
role-to-assume:my-github-actions-role
```
```
In this case, your runner's credentials must have permissions to assume the role.
In this case, your runner's credentials must have permissions to assume the
role.
You can also assume a role using a web identity token file, such as if using
[Amazon EKS IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html). Pods running in EKS
worker nodes that do not run as root can use this file to assume a role with a
web identity.
### Proxy Configuration
If you run in self-hosted environments and in secured environment where you need
use a specific proxy you can set it in the action manually.
Additionally this action will always consider already configured proxy in the
environment.
Manually configured proxy:
```yaml
uses:aws-actions/configure-aws-credentials@v2
with:
aws-region:us-east-2
role-to-assume:my-github-actions-role
http-proxy:"http://companydomain.com:3128"
```
Proxy configured in the environment variable:
```bash
# Your environment configuration
HTTP_PROXY="http://companydomain.com:3128"
```
The action will read the underlying proxy configuration from the environment and
you don't need to configure it in the action.
### Use with the AWS CLI
### Use with the AWS CLI
This workflow does _not_ install the [AWS CLI](https://aws.amazon.com/cli/)
This workflow does _not_ install the [AWS CLI](https://aws.amazon.com/cli/) into your environment. Self-hosted runners that intend to run this action prior to executing `aws` commands need to have the AWS CLI [installed](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) if it's not already present.
into your environment. Self-hosted runners that intend to run this action prior
Most [GitHub hosted runner environments](https://github.com/actions/virtual-environments) should include the AWS CLI by default.
to executing `aws` commands need to have the AWS CLI
Most [GitHub hosted runner environments](https://github.com/actions/virtual-environments)
should include the AWS CLI by default.
## License Summary
## License Summary
This code is made available under the MIT license.
This code is made available under the MIT license.
## Security Disclosures
## Security Disclosures
If you would like to report a potential security issue in this project, please do not create a GitHub issue. Instead, please follow the instructions [here](https://aws.amazon.com/security/vulnerability-reporting/) or [email AWS security directly](mailto:aws-security@amazon.com).
If you would like to report a potential security issue in this project, please do not create a GitHub issue. Instead, please follow the instructions [here](https://aws.amazon.com/security/vulnerability-reporting/) or [email AWS security directly](mailto:aws-security@amazon.com).
The directory contains templates for setting up the `configure-aws-credentials` federation between your GitHub Organization/repository and your AWS account.
Repository example uses aws-action `configure-aws-credentials` with OIDC federation template [github-actions-oidc-federation-and-role](./github-actions-oidc-federation-and-role.yml). Example demonstrates a repository that deploys AWS CloudFormation template using cfn-deploy GitHub Action.
Example uses aws-action `configure-aws-credentials` with OIDC federation. Prior to using this example project, the user needs to deploy the [github-actions-oidc-federation-and-role](../federated-setup/github-actions-oidc-federation-and-role.yml) template in the AWS account they want to deploy the CloudFormation template into. Specify the GitHub Organization name, repository name, and the specific branch you want to deploy on.
Within the [github/workflows](./.github/workflows/) directory there is a [compliance.yml](./.github/workflows/compliance.yml) and a [deploy.yml](./.github/workflows/deploy.yml). The deploy.yml file leverages the aws-action `configure-aws-credentials` and accesses GitHub Action Secrets for some of the variables. The compliance.yml runs static application security testing using cfn-guard.
To use the example you will need to set the following GitHub Action Secrets:
| Secret Key | Used With | Description |
| --------- | -------- | -----------|
| AWS_ACCOUNT_ID | configure-aws-credentials | The AWS account ID |
| AWS_DEPLOY_ROLE | configure-aws-credentials | The name of the IAM role |
| VPC_ID | aws-cloudformation-github-deploy | VPC ID the EC2 Bastion is deployed to |
| SUBNET_ID | aws-cloudformation-github-deploy | Subnet ID the EC2 Bastion is deployed to |
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Peter Woodworth