chore(main): release 6.2.0 (#1806)

* chore(main): release 6.1.4

* chore: fix broken stuff from release-please improperly handling revert commits

---------

Co-authored-by: Michael Lehmann <lehmanmj@amazon.com>

.github/codeql/codeql-config.yml

@@ -0,0 +1,5 @@
+name: "CodeQL config"
+
+paths-ignore:
+  - dist
+  - node_modules

.github/workflows/release-please.yml

@@ -36,10 +36,41 @@
               ${{ secrets.OSDS_PACKAGING_ROLE }}
 
         - name: Run release-please
+          id: release
           uses: googleapis/release-please-action@v4
           with:
             release-type: node
             token: ${{ env.OSDS_ACCESS_TOKEN }}
             config-file: release-please-config.json
             manifest-file: .release-please-manifest.json
-            
+
+        - name: Checkout Again
+          uses: actions/checkout@v5
+          with:
+            fetch-depth: 0
+
+        - name: Tag Major Version
+          if: ${{ steps.release.outputs.release_created }}
+          run: |
+            git config user.name "GitHub Actions"
+            git config user.email "github-aws-sdk-osds-automation@amazon.com"
+            if git rev-parse "v${{ steps.release.outputs.major }}" >/dev/null 2>&1; then
+              git tag -d "v${{ steps.release.outputs.major }}"
+              git push origin ":v${{ steps.release.outputs.major }}"
+            fi
+            git tag -a "v${{ steps.release.outputs.major }}" -m "Release v${{ steps.release.outputs.major }}"
+            git push origin "v${{ steps.release.outputs.major }}"
+
+        - name: Update README version references
+          if: ${{ steps.release.outputs.release_created }}
+          run: |
+            sed -i 's|configure-aws-credentials@v[0-9]*\.[0-9]*\.[0-9]*|configure-aws-credentials@${{ steps.release.outputs.tag_name }}|g' README.md
+            if git diff --quiet README.md; then
+              echo "README already up to date"
+            else
+              echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
+              git remote set-url origin https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
+              git add README.md
+              git commit -m "docs: update README version references to ${{ steps.release.outputs.tag_name }}"
+              git push --force origin
+            fi

.github/workflows/tests-unit.yml

@@ -18,9 +18,9 @@ jobs:
       - name: "Checkout repository"
         uses: actions/checkout@v5
       - name: "Setup node"
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.4.0
         with:
-          node-version: 20
+          node-version: 24
       - name: "Install dependencies"
         run: npm ci
       - name: "Run tests"

.gitignore

@@ -1,3 +1,4 @@
+.history
 node_modules
 coverage
 .DS_Store

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
   ".release-please-manifest.json": "4.0.2",
   "package.json": "6.0.0",
-  ".": "6.1.2"
+  ".": "6.2.0"
 }

CHANGELOG.md

@@ -2,8 +2,7 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-## [6.1.2](https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.1...v6.1.2) (2026-05-26)
+## [6.2.0](https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.3...v6.2.0) (2026-06-01)
-
 
 ### Features
 
@@ -14,11 +13,22 @@ All notable changes to this project will be documented in this file. See [standa
 * expose run id in STS client user-agent ([#1774](https://github.com/aws-actions/configure-aws-credentials/issues/1774)) ([29d1be3](https://github.com/aws-actions/configure-aws-credentials/commit/29d1be30273e7ef371d59fccf6ec54572c64ec89))
 * support custom STS endpoints ([#1762](https://github.com/aws-actions/configure-aws-credentials/issues/1762)) ([8d52d05](https://github.com/aws-actions/configure-aws-credentials/commit/8d52d05d7a4521fa52b39de50cb6114b12e5c332))
 
+### Bug Fixes
+
+* skip credential check on output-env-credentials: false ([#1778](https://github.com/aws-actions/configure-aws-credentials/issues/1778)) ([58e7c47](https://github.com/aws-actions/configure-aws-credentials/commit/58e7c47adf77846879008deadfeeef8a6969fe6c))
+* assumeRole failing from session tag size too large ([#1808](https://github.com/aws-actions/configure-aws-credentials/issues/1808)) ([d6f5dc3](https://github.com/aws-actions/configure-aws-credentials/commit/d6f5dc331b44474b19a52caaf85fa4d637b13c8e))
+
+## [6.1.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.2...v6.1.3) (2026-05-28)
+
+### Bug Fixes
+
+* fix: allow kubelet token symlink in [#1805](https://github.com/aws-actions/configure-aws-credentials/issues/1805)
+
+## [6.1.2](https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.1...v6.1.2) (2026-05-26)
 
 ### Bug Fixes
 
 * additional filesystem checks ([#1799](https://github.com/aws-actions/configure-aws-credentials/issues/1799)) ([c39f282](https://github.com/aws-actions/configure-aws-credentials/commit/c39f282697aca8a78c522ecf1f7da9899a31432c))
-* skip credential check on output-env-credentials: false ([#1778](https://github.com/aws-actions/configure-aws-credentials/issues/1778)) ([58e7c47](https://github.com/aws-actions/configure-aws-credentials/commit/58e7c47adf77846879008deadfeeef8a6969fe6c))
 
 ## [6.1.1](https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.0...v6.1.1) (2026-05-05)
 

README.md

@@ -1,71 +1,76 @@
 # Configure AWS Credentials
 
-Authenticate to AWS in GitHub Actions! Works especially well with
+Authenticate to AWS in GitHub Actions (and others)! Works especially well with
 [AWS Secrets Manager][secretsmanager].
 
-[secretsmanager]:
+[secretsmanager]: https://github.com/aws-actions/aws-secretsmanager-get-secrets
-  https://github.com/aws-actions/aws-secretsmanager-get-secrets
 
 ## Quick Start (OIDC, recommended)
 
 1. Create an IAM Identity Provider in your AWS account for GitHub OIDC. (See
    [OIDC configuration](#oidc-configuration-details) below for details.)
-2. Create an IAM Role in your AWS account with a trust policy that allows
+2. Create an IAM Role in your AWS account with a trust policy that allows GitHub
-    GitHub Actions to assume it. (Expand the sections below) <details>
+   Actions to assume it. (Expand the sections below) <details>
-    <summary>GitHub OIDC Trust Policy</summary>
+   <summary>GitHub OIDC Trust Policy</summary>
 
-    ```json
+   ```json
-    {
+   {
-      "Version": "2012-10-17",
+     "Version": "2012-10-17",
-      "Statement": [
+     "Statement": [
-        {
+       {
-          "Effect": "Allow",
+         "Effect": "Allow",
-          "Principal": {
+         "Principal": {
-            "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com"
+           "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com"
-          },
+         },
-          "Action": "sts:AssumeRoleWithWebIdentity",
+         "Action": "sts:AssumeRoleWithWebIdentity",
-          "Condition": {
+         "Condition": {
-            "StringEquals": {
+           "StringEquals": {
-              "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+             "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-              "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>"
+             "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>"
-            }
+           }
-          }
+         }
-        }
+       }
-      ]
+     ]
-    }
+   }
-    ```
+   ```
 
-    </details>
+   </details>
+
+   Note: if you are running in a GitHub environment based workflow, the value
+   for the Sub claim will be different, in the form of
+   `repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:environment:<ENVIRONMENT_NAME>`.
+   Adjust the trust policy accordingly if you are using environment-based
+   workflows.
 
 3. Attach permissions to the IAM Role that allow it to access the AWS resources
-    you need.
+   you need.
 4. Add the following to your GitHub Actions workflow: <details>
-    <summary>Example Workflow</summary>
+   <summary>Example Workflow</summary>
 
-    ```yaml
+   ```yaml
-    # Need ID token write permission to use OIDC
+   # Need ID token write permission to use OIDC
-    permissions:
+   permissions:
-      id-token: write
+     id-token: write
-    jobs:
+   jobs:
-      run_job_with_aws:
+     run_job_with_aws:
-        runs-on: ubuntu-latest
+       runs-on: ubuntu-latest
-        steps:
+       steps:
-          - name: Configure AWS Credentials
+         - name: Configure AWS Credentials
-            uses: aws-actions/configure-aws-credentials@v6.1.0
+           uses: aws-actions/configure-aws-credentials@v6.1.0
-            with:
+           with:
-              role-to-assume: <Role ARN you created in step 2>
+             role-to-assume: <Role ARN you created in step 2>
-              aws-region: <AWS Region you want to use>
+             aws-region: <AWS Region you want to use>
-          - name: Additional steps
+         - name: Additional steps
-            run: |
+           run: |
-              # Your commands that require AWS credentials
+             # Your commands that require AWS credentials
-              aws sts get-caller-identity
+             aws sts get-caller-identity
-    ```
+   ```
 
-    </details>
+   </details>
 
-  That's it! Your GitHub Actions workflow can now access AWS resources using
+That's it! Your GitHub Actions workflow can now access AWS resources using the
-    the IAM Role you created. Other authentication scenarios are also supported
+IAM Role you created. Other authentication scenarios are also supported (see
-    (see below).
+below).
 
 ## Security Recommendations
 
@@ -81,8 +86,8 @@ Authenticate to AWS in GitHub Actions! Works especially well with
   of the credentials used in workflows.
 - Periodically rotate any long-lived credentials that you use.
 - Store sensitive information in a secure way, such as using
-  [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or
+  [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or [GitHub
-  [GitHub Secrets][gh-secrets].
+  Secrets][gh-secrets].
 - Be especially careful about running Actions in non-ephemeral environments, or
   [triggering workflows on `pull_request_target`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target)
   events.
@@ -105,11 +110,12 @@ by specifying different inputs.
 5. Use credentials stored in the Action environment to fetch temporary
    credentials via STS AssumeRole.
 
-Because we use the AWS JavaScript SDK, we always will use the
+Because we use the AWS JavaScript SDK, we always will use the [credential
-[credential resolution flow for Node.js][cred-resolution].
+resolution flow for Node.js][cred-resolution].
 
 [cred-resolution]:
   https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html
+
 Depending on your inputs, the action might override parts of this flow.
 
 <details>
@@ -131,8 +137,8 @@ enabling this option._
 
 Additionally, **`aws-region`** is always required.
 
-_Note: If you use GitHub Enterprise Server, you may need to adjust examples
+_Note: If you use GitHub Enterprise Server, you may need to adjust examples here
-here to match your environment._
+to match your environment._
 
 ## Additional Options
 
@@ -144,36 +150,39 @@ detail.
 <details>
 <summary>Options list and descriptions</summary>
 
-| Option                        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Required |
+| Option                        | Description                                                                                                                                                                                                                                                                                                                                                                                                                             | Required |
-| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
-| aws-region                    | Which AWS region to use                                                                                                                                                                                                                                                                                                                                                                                                                                          | Yes      |
+| aws-region                    | Which AWS region to use                                                                                                                                                                                                                                                                                                                                                                                                                 | Yes      |
-| aws-profile                   | Name of the AWS profile to configure. When provided, credentials are written to `~/.aws/credentials` and `~/.aws/config` files. This enables configuring multiple profiles in a single workflow. Name cannot contain whitespace, square brackets, or slashes. When set, credentials will not be exported as environment variables unless `output-env-credentials` is manually set to true.                                                                       | No       |
+| aws-profile                   | Name of the AWS profile to configure. When provided, credentials are written to `~/.aws/credentials` and `~/.aws/config` files. This enables configuring multiple profiles in a single workflow. Name cannot contain whitespace, square brackets, or slashes. When set, credentials will not be exported as environment variables unless `output-env-credentials` is manually set to true.                                              | No       |
-| overwrite-aws-profile         | Overwrite the given AWS profile if it already exists. When set to false or not set, an error will be thrown if the profile already exists.                                                                                                                                                                                                                                                                                                                       | No       |
+| overwrite-aws-profile         | Overwrite the given AWS profile if it already exists. When set to false or not set, an error will be thrown if the profile already exists.                                                                                                                                                                                                                                                                                              | No       |
-| role-to-assume                | Role for which to fetch credentials. Only required for some authentication types.                                                                                                                                                                                                                                                                                                                                                                                | No       |
+| role-to-assume                | Role for which to fetch credentials. Only required for some authentication types.                                                                                                                                                                                                                                                                                                                                                       | No       |
-| aws-access-key-id             | AWS access key to use. Only required for some authentication types.                                                                                                                                                                                                                                                                                                                                                                                              | No       |
+| aws-access-key-id             | AWS access key to use. Only required for some authentication types.                                                                                                                                                                                                                                                                                                                                                                     | No       |
-| aws-secret-access-key         | AWS secret key to use. Only required for some authentication types.                                                                                                                                                                                                                                                                                                                                                                                              | No       |
+| aws-secret-access-key         | AWS secret key to use. Only required for some authentication types.                                                                                                                                                                                                                                                                                                                                                                     | No       |
-| aws-session-token             | AWS session token to use. Used in uncommon authentication scenarios.                                                                                                                                                                                                                                                                                                                                                                                             | No       |
+| aws-session-token             | AWS session token to use. Used in uncommon authentication scenarios.                                                                                                                                                                                                                                                                                                                                                                    | No       |
-| role-chaining                 | Use existing credentials from the environment to assume a new role.                                                                                                                                                                                                                                                                                                                                                                                              | No       |
+| role-chaining                 | Use existing credentials from the environment to assume a new role.                                                                                                                                                                                                                                                                                                                                                                     | No       |
-| audience                      | The JWT audience when using OIDC. Used in non-default AWS partitions, like China regions.                                                                                                                                                                                                                                                                                                                                                                        | No       |
+| audience                      | The JWT audience when using OIDC. Used in non-default AWS partitions, like China regions.                                                                                                                                                                                                                                                                                                                                               | No       |
-| http-proxy                    | An HTTP proxy to use for API calls.                                                                                                                                                                                                                                                                                                                                                                                                                              | No       |
+| http-proxy                    | An HTTP proxy to use for API calls.                                                                                                                                                                                                                                                                                                                                                                                                     | No       |
-| mask-aws-account-id           | AWS account IDs are not considered secret. Setting this will hide account IDs from output anyway.                                                                                                                                                                                                                                                                                                                                                                | No       |
+| mask-aws-account-id           | AWS account IDs are not considered secret. Setting this will hide account IDs from output anyway.                                                                                                                                                                                                                                                                                                                                       | No       |
-| role-duration-seconds         | The assumed role duration in seconds, if assuming a role. Defaults to 1 hour (3600 seconds). Acceptable values range from 15 minutes (900 seconds) to 12 hours (43200 seconds).                                                                                                                                                                                                                                                                                  | No       |
+| role-duration-seconds         | The assumed role duration in seconds, if assuming a role. Defaults to 1 hour (3600 seconds). Acceptable values range from 15 minutes (900 seconds) to 12 hours (43200 seconds).                                                                                                                                                                                                                                                         | No       |
-| role-external-id              | The external ID of the role to assume. Only needed if your role requires it.                                                                                                                                                                                                                                                                                                                                                                                     | No       |
+| role-external-id              | The external ID of the role to assume. Only needed if your role requires it.                                                                                                                                                                                                                                                                                                                                                            | No       |
-| role-session-name             | Defaults to "GitHubActions", but may be changed if required.                                                                                                                                                                                                                                                                                                                                                                                                     | No       |
+| role-session-name             | Defaults to "GitHubActions", but may be changed if required.                                                                                                                                                                                                                                                                                                                                                                            | No       |
-| role-skip-session-tagging     | Skips session tagging if set.                                                                                                                                                                                                                                                                                                                                                                                                                                    | No       |
+| role-skip-session-tagging     | Skips session tagging if set.                                                                                                                                                                                                                                                                                                                                                                                                           | No       |
-| transitive-tag-keys           | Define a list of transitive tag keys to pass when assuming a role.                                                                                                                                                                                                                                                                                                                                                                                               | No       |
+| transitive-tag-keys           | Define a list of transitive tag keys to pass when assuming a role.                                                                                                                                                                                                                                                                                                                                                                      | No       |
-| inline-session-policy         | You may further restrict the assumed role policy by defining an inline policy here.                                                                                                                                                                                                                                                                                                                                                                              | No       |
+| custom-tags                   | Additional tags to apply to the assumed role session. Must be a JSON object provided as a string. Custom tags are not usable with OIDC or web identity token authentication.                                                                                                                                                                                                                                                            | No       |
-| managed-session-policies      | You may further restrict the assumed role policy by specifying a managed policy here.                                                                                                                                                                                                                                                                                                                                                                            | No       |
+| inline-session-policy         | You may further restrict the assumed role policy by defining an inline policy here.                                                                                                                                                                                                                                                                                                                                                     | No       |
-| output-credentials            | When set, outputs fetched credentials as action step output. (Outputs aws-access-key-id, aws-secret-access-key, aws-session-token, aws-account-id, authenticated-arn, and aws-expiration). Defaults to false.                                                                                                                                                                                                                                                    | No       |
+| managed-session-policies      | You may further restrict the assumed role policy by specifying a managed policy here.                                                                                                                                                                                                                                                                                                                                                   | No       |
-| output-env-credentials        | When set, outputs fetched credentials as environment variables (AWS_REGION, AWS_DEFAULT_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and AWS_PROFILE (if profile option is used)). Defaults to true when `aws-profile` is not set, and false when `aws-profile` is set. Set to false to avoid setting env variables. (NOTE: Setting to false will prevent aws-account-id from being exported as a step output).                          | No       |
+| output-credentials            | When set, outputs fetched credentials as action step output. (Outputs aws-access-key-id, aws-secret-access-key, aws-session-token, aws-account-id, authenticated-arn, and aws-expiration). Defaults to false.                                                                                                                                                                                                                           | No       |
-| unset-current-credentials     | When set, attempts to unset any existing credentials in your action runner.                                                                                                                                                                                                                                                                                                                                                                                      | No       |
+| output-env-credentials        | When set, outputs fetched credentials as environment variables (AWS_REGION, AWS_DEFAULT_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and AWS_PROFILE (if profile option is used)). Defaults to true when `aws-profile` is not set, and false when `aws-profile` is set. Set to false to avoid setting env variables. (NOTE: Setting to false will prevent aws-account-id from being exported as a step output). | No       |
-| disable-retry                 | Disabled retry/backoff logic for assume role calls. By default, retries are enabled.                                                                                                                                                                                                                                                                                                                                                                             | No       |
+| unset-current-credentials     | When set, attempts to unset any existing credentials in your action runner.                                                                                                                                                                                                                                                                                                                                                             | No       |
-| retry-max-attempts            | Limits the number of retry attempts before giving up. Defaults to 12.                                                                                                                                                                                                                                                                                                                                                                                            | No       |
+| disable-retry                 | Disabled retry/backoff logic for assume role calls. By default, retries are enabled.                                                                                                                                                                                                                                                                                                                                                    | No       |
-| special-characters-workaround | Uncommonly, some environments cannot tolerate special characters in a secret key. This option will retry fetching credentials until the secret access key does not contain special characters. This option overrides disable-retry and retry-max-attempts.                                                                                                                                                                                                       | No       |
+| retry-max-attempts            | Limits the number of retry attempts before giving up. Defaults to 12.                                                                                                                                                                                                                                                                                                                                                                   | No       |
-| use-existing-credentials      | When set, the action will check if existing credentials are valid and exit if they are. Defaults to false.                                                                                                                                                                                                                                                                                                                                                       | No       |
+| special-characters-workaround | Uncommonly, some environments cannot tolerate special characters in a secret key. This option will retry fetching credentials until the secret access key does not contain special characters. This option overrides disable-retry and retry-max-attempts.                                                                                                                                                                              | No       |
-| allowed-account-ids           | A comma-delimited list of expected AWS account IDs. The action will fail if we receive credentials for the wrong account.                                                                                                                                                                                                                                                                                                                                        | No       |
+| use-existing-credentials      | When set, the action will check if existing credentials are valid and exit if they are. Defaults to false.                                                                                                                                                                                                                                                                                                                              | No       |
-| force-skip-oidc               | When set, the action will skip using GitHub OIDC provider even if the id-token permission is set.                                                                                                                                                                                                                                                                                                                                                                | No       |
+| allowed-account-ids           | A comma-delimited list of expected AWS account IDs. The action will fail if we receive credentials for the wrong account.                                                                                                                                                                                                                                                                                                               | No       |
-| action-timeout-s              | Global timeout for the action in seconds. If set to a value greater than 0, the action will fail if it takes longer than this time to complete.                                                                                                                                                                                                                                                                                                                  | No       |
+| force-skip-oidc               | When set, the action will skip using GitHub OIDC provider even if the id-token permission is set.                                                                                                                                                                                                                                                                                                                                       | No       |
+| action-timeout-s              | Global timeout for the action in seconds. If set to a value greater than 0, the action will fail if it takes longer than this time to complete.                                                                                                                                                                                                                                                                                         | No       |
+| no-proxy                      |  Hosts to skip for the proxy configuration.                                                                                                                                                                                                                                                                                                                                                                                             | No       |
+| sts-endpoint                  | Custom STS endpoint URL. Use this to point to an STS-compatible API (e.g. MinIO, LocalStack) instead of the default AWS STS endpoint for the region.                                                                                                                                                                                                                                                                                    | No       |
 
 </details>
 
@@ -210,8 +219,8 @@ Profile names may not contain whitespace, square brackets, or forward or
 backslashes.
 
 Writing to a profile will prevent credentials being written to the environment
-by default. Use `output-env-credentials: true` if you would like the
+by default. Use `output-env-credentials: true` if you would like the credentials
-credentials to also be exported as environment variables.
+to also be exported as environment variables.
 
 By default, the action will not overwrite existing profiles. If you would like
 to overwrite a profile, set the `overwrite-aws-profile` input to `true`.
@@ -226,8 +235,8 @@ extreme care to ensure that this is safe in your environment and you do not leak
 valid credentials unintentionally. Writing to configuration files is intended
 for unusual authentication scenarios._
 
-For using profiles with static IAM User Credentials or when using one
+For using profiles with static IAM User Credentials or when using one role to
-role to assume another, role chaining is needed:
+assume another, role chaining is needed:
 
 <details>
 
@@ -237,7 +246,7 @@ specify the profile name as an environment variable in the job step:
 ```yaml
 - name: Configure AWS Credentials
   uses: aws-actions/configure-aws-credentials@v6.1.0
-  with: 
+  with:
     aws-region: us-east-1
     role-to-assume: arn:aws:iam::123456789100:role/my-role
     aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -248,9 +257,9 @@ specify the profile name as an environment variable in the job step:
     AWS_PROFILE: MyProfile1
 ```
 
-If you are using one role to assume another while using profiles, the
+If you are using one role to assume another while using profiles, the subsequent
-subsequent steps must set `role-chaining: true` and specify the prior profile's
+steps must set `role-chaining: true` and specify the prior profile's name as
-name as step environment variables:
+step environment variables:
 
 ```yaml
 - name: Configure AWS credentials
@@ -282,8 +291,8 @@ from the environment. To skip this step, set the `AWS_SKIP_CLEANUP_STEP`
 environment variable to `true`:
 
 ```yaml
-    env:
+env:
-      AWS_SKIP_CLEANUP_STEP: 'true'
+  AWS_SKIP_CLEANUP_STEP: "true"
 ```
 
 #### Use an HTTP proxy
@@ -316,11 +325,12 @@ HTTP_PROXY="http://companydomain.com:3128"
 #### Special characters in AWS_SECRET_ACCESS_KEY
 
 Some edge cases are unable to properly parse an `AWS_SECRET_ACCESS_KEY` if it
-contains special characters. For more information, please see the
+contains special characters. For more information, please see the [AWS CLI
-[AWS CLI documentation][aws-cli-troubleshooting].
+documentation][aws-cli-troubleshooting].
 
 [aws-cli-troubleshooting]:
   https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html#tshoot-signature-does-not-match
+
 If you set the `special-characters-workaround` option, this action will
 continually retry fetching credentials until we get one that does not have
 special characters. This option overrides the `disable-retry` and
@@ -337,13 +347,14 @@ _Note: you might find it helpful to set the `role-session-name` to
 `${{ github.run_id }}` so as to clarify in audit logs which AWS actions were
 performed by which workflow run._
 
-The session will be tagged with the following tags: (Refer to
+The session will be tagged with the following tags: (Refer to [GitHub's
-[GitHub's documentation for `GITHUB_` environment variable
+documentation for `GITHUB_` environment variable definitions][gh-env-vars])
-definitions][gh-env-vars])
 
 [gh-env-vars]:
   https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables
 
+**Default tags** are always emitted when session tags are used.
+
 | Key        | Value             |
 | ---------- | ----------------- |
 | GitHub     | "Actions"         |
@@ -351,23 +362,48 @@ definitions][gh-env-vars])
 | Workflow   | GITHUB_WORKFLOW   |
 | Action     | GITHUB_ACTION     |
 | Actor      | GITHUB_ACTOR      |
-| Branch     | GITHUB_REF        |
 | Commit     | GITHUB_SHA        |
+| Branch     | GITHUB_REF        |
+
+**Droppable tags** are automatically added to the set of default session tags.
+If the session tags exceed the [packed size limit][packed-size-limit], these
+tags will be dropped, and the AssumeRole call will be retried. If it still
+fails, the action will error out. (It is difficult to predict the packed size
+before making the call, as session tags and session policies are compressed into
+a binary format as part of the call.)
+
+[packed-size-limit]:
+  https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_know
+
+| Key             | Value                   |
+| --------------- | ----------------------- |
+| EventName       | GITHUB_EVENT_NAME       |
+| BaseRef         | GITHUB_BASE_REF         |
+| HeadRef         | GITHUB_HEAD_REF         |
+| RunId           | GITHUB_RUN_ID           |
+| Job             | GITHUB_JOB              |
+| TriggeringActor | GITHUB_TRIGGERING_ACTOR |
+
+Tags whose source environment variable is unset are omitted (e.g., `BaseRef` and
+`HeadRef` are only set on `pull_request` events).
 
 _Note: all tag values must conform to
-[the tag requirements](https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html).
+[the tag requirements][sts-tag-requirements].
-Particularly, `GITHUB_WORKFLOW` will be truncated if it's too long. If
+Values longer than 256 characters will be truncated, and characters outside the
-`GITHUB_ACTOR` or `GITHUB_WORKFLOW` contain invalid characters, the characters
+allowed set will be replaced with an underscore (`_`)._
-will be replaced with an '\*'._
 
-The action will use session tagging by default unless you are using OIDC.
+[sts-tag-requirements]:
+  https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html
+
+The action will use session tagging by default unless you are using OIDC or a
+Web Identify Token File.
 
 To [forward session tags to subsequent sessions in a role
-chain][session-tag-chaining], you can use
+chain][session-tag-chaining], you can use the `transitive-tag-keys` input to
+specify the keys of the tags to be passed.
 
-[session-tag-chaining]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining
+[session-tag-chaining]:
-
+  https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining
-the `transitive-tag-keys` input to specify the keys of the tags to be passed.
 
 _Note that all subsequent roles in the chain must have
 `role-skip-session-tagging` set to `true`_
@@ -382,6 +418,24 @@ with:
     Actor
 ```
 
+### Custom session tags
+
+You can add custom session tags using the `custom-tags` input, which accepts a
+JSON object. Custom tags cannot override existing tags. Note that AWS allows a
+maximum of 50 tags (so you can supply a maximum of 43 custom tags), although it
+is likely that you will exceed the [packed size limit][packed-size-limit]
+before you exceed the maximum number of tags.
+
+```yaml
+uses: aws-actions/configure-aws-credentials@v6
+with:
+  custom-tags: '{"Environment": "Production", "Team": "Platform"}'
+```
+
+_Note: custom tags are not supported when using OIDC or web identity token
+authentication. In those flows, session tags are controlled by the identity
+provider's token claims._
+
 ### Session policies
 
 Session policies are not required, but they allow you to limit the scope of the
@@ -452,6 +506,12 @@ with:
 
 </details>
 
+### Custom STS endpoint
+
+Use the `sts-endpoint` input to override the AWS STS endpoint URL. Most users
+should not set this option and instead let the SDK derive the correct endpoint
+from the specified region.
+
 ## OIDC Configuration Details
 
 We recommend using
@@ -516,41 +576,42 @@ aws iam create-open-id-connect-provider \
 
 ### Claims and scoping permissions
 
-To align with the Amazon IAM best practice of
+To align with the Amazon IAM best practice of [granting least
-[granting least privilege][least-privilege],
+privilege][least-privilege], the assume role policy document should contain a
+[`Condition`](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)
+that restricts which workflows can assume the role. Without any condition, any
+GitHub user or repository could potentially assume the role.
+
+GitHub provides a number of additional claims in the OIDC token that you can use
+in your IAM policies to scope down permissions. Early versions of this action
+only supported the `sub` and `aud` claims, but AWS IAM and GitHub have since
+added support for `sub` claim customization and a variety of additional
+claims ([1][gh-blog-oidc], [2][sub-claim-custom]).
+
+> **Warning:** Avoid `ForAllValues:` in `Allow` statements. These operators
+> return true when the claim is absent or misspelled, which can lead to
+> unintended access. Instead, use `StringEquals` or `StringLike` operators to
+> check for specific claim values.
 
 [least-privilege]:
   https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege
-the assume role policy document should contain a
+[gh-blog-oidc]:
-[`Condition`](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)
+  https://aws.amazon.com/about-aws/whats-new/2026/01/aws-sts-supports-validation-identity-provider-claims/
-that specifies a subject (`sub`) allowed to assume the role.
+[sub-claim-custom]:
-[GitHub also recommends](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#defining-trust-conditions-on-cloud-roles-using-oidc-claims)
+  https://docs.github.com/en/rest/actions/oidc?apiVersion=2026-03-10
-filtering for the correct audience (`aud`). See
-[AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#condition-keys-wif)
-on which claims you can filter for in your trust policies.
 
-Without a subject (`sub`) condition, any GitHub user or repository could
+#### Inspecting the token
-potentially assume the role. The subject can be scoped to a GitHub organization
+
-and repository as shown in the CloudFormation template. However, scoping it down
+If you aren't sure what claim values your workflow is producing, the
-to your org and repo may cause the role assumption to fail in some cases. See
-[Example subject claims](https://docs.github.com/en/actions/reference/security/oidc#example-subject-claims)
-for specific details on what the subject value will be depending on your
-workflow. You can also
-[customize your subject claim](https://docs.github.com/en/actions/reference/security/oidc#customizing-the-token-claims)
-if you want full control over the information you can filter for in your trust
-policy. If you aren't sure what your subject (`sub`) key is, you can add the
 [`actions-oidc-debugger`](https://github.com/github/actions-oidc-debugger)
-action to your workflow to see the value of the subject (`sub`) key, as well as
+action will print the decoded JWT payload. Run it in a private repository
-other claims.
+only — the token itself is short-lived but the claim values may be sensitive.
 
-Additional claim conditions can be added for higher specificity as explained in
+See the GitHub [security-hardening guide][gh-oidc-hardening] for further
-the
+discussion of trust conditions and threat modeling.
-[GitHub documentation][gh-oidc-hardening].
 
 [gh-oidc-hardening]:
   https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect
-Due to implementation details, not every OIDC claim is presently supported by
-IAM.
 
 ### Further information about OIDC
 
@@ -562,6 +623,57 @@ For further information on OIDC and GitHub Actions, please see:
 - [GitHub docs: Configuring OpenID Connect in Amazon Web Services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
 - [GitHub changelog: GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/)
 
+## Getting Credentials in AWS Self-Hosted Runners
+
+If you are running GitHub Actions in a self-hosted runner using an AWS Service
+(such as Codebuild or EKS) and you have properly configured the service,
+credentials should be available by default; the AWS CLI will fetch credentials
+using the AWS_CONTAINER_CREDENTIALS_FULL_URI or
+AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables. However, you may
+still want to use this action if you need to export those credentials for use
+with other tools in your workflow. You may also want to use this action in
+scenarios where you need to use that 'default' role to assume another role.
+
+To export credentials, simply run the action with `role-to-assume` set to the
+default role of the container.
+
+To assume another role from the container's default role, use the
+`role-chaining: true` flag, so that the action fetches the default credentials
+from the environment before assuming the other role.
+
+If you are using EKS Pod Identities and encountering an error related to the
+packed size of session tags, you must either run the action with
+`role-skip-session-tagging: true` to disable the tags set by the action, or
+[disable EKS session tagging][eks-disable-session-tagging] in the EKS settings
+to disable the tags that are automatically set by the EKS Pod Identity Service.
+Check the values of the action's session tags and the session tags that are
+added by EKS so you can keep the set of tags which is more useful to you.
+
+[eks-disable-session-tagging]:
+  https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-tags
+
+## Compatibility with non-GitHub Actions environments
+
+This action has been sucessfully tested with
+Codeberg/[Forgejo Actions](https://forgejo.org/docs/next/user/actions/overview/)
+and should be generally compatible with any CI/CD environment that sets the
+correct `GITHUB_` environment variables. For use with Foregejo, please review
+the
+[runner differences with GitHub's action runners][forgejo-gh-differences].
+
+[forgejo-gh-differences]:
+  https://forgejo.org/docs/next/user/actions/github-actions/#known-list-of-differences
+The main difference to be aware of is that Forgejo uses the
+`enable-openid-connect` flag to enable OIDC instad of GitHub's `id-token: write`
+permission. Forgejo also uses a slightly different syntax for the workflow
+definition file, omitting some subkeys.
+
+For OIDC use, the issuer name for the IAM IdP for GitHub Actions is
+`token.actions.githubusercontent.com`. For Forgejo Actions it is
+`[foregejo instance url]/api/actions`. As an example, Codeberg would use
+`codeberg.org/api/actions` as the issuer URL when configuring the IAM Identity
+Provider. The audience would still be `sts.amazonaws.com` by default.
+
 ## Examples
 
 ### AssumeRoleWithWebIdentity
@@ -659,6 +771,13 @@ This example shows that you can reference the fetched credentials as outputs if
 the `aws-session-token` input in a situation where session tokens are fetched
 and passed to this action.
 
+If you only want the credentials available as _step outputs_ and not exported to
+the environment (for example, on a self-hosted runner where you do not want the
+assumed-role credentials to shadow an existing EC2 instance profile), pair
+`output-credentials: true` with `output-env-credentials: false`. In that mode,
+the action does not run its post-credential SDK-pickup validation step, since
+the credentials were never written to the environment.
+
 ### Configure multiple AWS profiles in a single workflow
 
 ```yaml
@@ -691,8 +810,8 @@ and passed to this action.
 This example shows how to configure multiple named AWS profiles in a single
 workflow. When using the `aws-profile` input, credentials are written to
 `~/.aws/credentials` and `~/.aws/config` files, allowing you to reference
-different profiles using the `--profile` flag with AWS CLI, SDKs, CDK, and
+different profiles using the `--profile` flag with AWS CLI, SDKs, CDK, and other
-other tools.
+tools.
 
 Each profile is independent and can authenticate to different AWS accounts or
 use different roles. This is particularly useful for multi-account deployments
@@ -705,6 +824,7 @@ Starting with version 5.0.0, this action uses semantic-style release tags and
 
 [immutable-releases]:
   https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
+
 A floating version tag (vN) is also provided for convenience: this tag will move
 to the latest major version (vN -> vN.2.1, vM -> vM.0.0, etc.).
 

THIRD-PARTY

@@ -644,7 +644,7 @@ Apache License
 
 The following npm package may be included in this product:
 
- - @aws-sdk/client-sts@3.1053.0
+ - @aws-sdk/client-sts@3.1049.0
 
 This package contains the following license:
 
@@ -854,8 +854,8 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/signature-v4-multi-region@3.996.28
+ - @aws-sdk/signature-v4-multi-region@3.996.27
- - @smithy/core@3.24.4
+ - @smithy/core@3.24.5
  - @smithy/types@4.14.2
 
 These packages each contain the following license:
@@ -1224,7 +1224,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - @actions/http-client@3.0.2
+ - @actions/http-client@4.0.1
 
 This package contains the following license:
 
@@ -1254,7 +1254,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - @aws-sdk/core@3.974.13
+ - @aws-sdk/core@3.974.15
 
 This package contains the following license:
 
@@ -1674,18 +1674,18 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-env@3.972.39
+ - @aws-sdk/credential-provider-env@3.972.41
- - @aws-sdk/credential-provider-ini@3.972.43
+ - @aws-sdk/credential-provider-ini@3.972.42
- - @aws-sdk/credential-provider-node@3.972.44
+ - @aws-sdk/credential-provider-node@3.972.43
- - @aws-sdk/token-providers@3.1052.0
+ - @aws-sdk/token-providers@3.1049.0
  - @aws-sdk/types@3.973.9
  - @aws-sdk/util-locate-window@3.965.5
- - @aws-sdk/xml-builder@3.972.25
+ - @aws-sdk/xml-builder@3.972.26
- - @smithy/credential-provider-imds@4.3.4
+ - @smithy/credential-provider-imds@4.3.3
- - @smithy/fetch-http-handler@5.4.4
+ - @smithy/fetch-http-handler@5.4.3
  - @smithy/is-array-buffer@2.2.0
- - @smithy/node-http-handler@4.7.4
+ - @smithy/node-http-handler@4.7.3
- - @smithy/signature-v4@5.4.4
+ - @smithy/signature-v4@5.4.5
  - @smithy/util-buffer-from@2.2.0
  - @smithy/util-utf8@2.3.0
 
@@ -1897,9 +1897,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-process@3.972.39
+ - @aws-sdk/credential-provider-process@3.972.38
- - @aws-sdk/credential-provider-sso@3.972.43
+ - @aws-sdk/credential-provider-sso@3.972.42
- - @aws-sdk/credential-provider-web-identity@3.972.43
+ - @aws-sdk/credential-provider-web-identity@3.972.42
 
 These packages each contain the following license:
 
@@ -2109,9 +2109,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-http@3.972.41
+ - @aws-sdk/credential-provider-http@3.972.40
- - @aws-sdk/credential-provider-login@3.972.43
+ - @aws-sdk/credential-provider-login@3.972.42
- - @aws-sdk/nested-clients@3.997.11
+ - @aws-sdk/nested-clients@3.997.10
 
 These packages each contain the following license:
 
@@ -2335,8 +2335,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 The following npm packages may be included in this product:
 
- - @nodable/entities@2.1.0
+ - @nodable/entities@2.1.1
- - netmask@2.1.0
  - quickjs-wasi@2.2.0
  - xml-naming@0.1.0
 
@@ -2346,6 +2345,36 @@ MIT
 
 -----------
 
+The following npm package may be included in this product:
+
+ - netmask@2.1.1
+
+This package contains the following license:
+
+MIT License
+
+Copyright (c) 2011 Olivier Poitrey rs@rhapsodyk.net
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+-----------
+
 The following npm package may be included in this product:
 
  - fast-xml-parser@5.7.3
@@ -2468,7 +2497,7 @@ SOFTWARE.
 
 The following npm package may be included in this product:
 
- - undici@6.24.0
+ - undici@6.25.0
 
 This package contains the following license:
 
@@ -2610,7 +2639,7 @@ THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - socks@2.8.7
+ - socks@2.8.8
 
 This package contains the following license:
 
@@ -2698,9 +2727,9 @@ SOFTWARE.
 
 The following npm packages may be included in this product:
 
- - @actions/core@2.0.2
+ - @actions/core@3.0.1
- - @actions/exec@2.0.0
+ - @actions/exec@3.0.0
- - @actions/io@2.0.0
+ - @actions/io@3.0.2
 
 These packages each contain the following license:
 

action.yml

@@ -1,4 +1,3 @@
-
 name: '"Configure AWS Credentials" Action for GitHub Actions'
 description: Configures AWS credentials for use in subsequent steps in a GitHub Action workflow
 runs:
@@ -101,6 +100,12 @@ inputs:
   action-timeout-s:
     required: false
     description: A global timeout in seconds for the action. When the timeout is reached, the action immediately exits. The default is to run without a timeout.
+  custom-tags:
+    description: Additional tags to apply to the assumed role session. Must be a JSON object provided as a string.
+    required: false
+  sts-endpoint:
+    description: Custom STS endpoint URL. Use this to point to an STS-compatible API (e.g. MinIO, LocalStack) instead of the default AWS STS endpoint for the region.
+    required: false
 
 outputs:
   aws-account-id:

package.json

@@ -1,11 +1,11 @@
 {
   "name": "configure-aws-credentials",
   "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.1.2",
+  "version": "6.2.0",
   "scripts": {
     "build": "tsc",
-    "lint": "biome check --error-on-warnings ./src && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
+    "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
-    "lint:fix": "biome check --write ./src && markdownlint -i node_modules -i CHANGELOG.md -f '**/*.md'",
+    "lint:fix": "biome check --write ./src ./test && markdownlint -i node_modules -i CHANGELOG.md -f '**/*.md'",
     "package": "esbuild src/index.ts --bundle --platform=node --target=node24 --outfile=dist/index.js && esbuild src/cleanup/index.ts --bundle --platform=node --target=node24 --outfile=dist/cleanup/index.js && npm run license",
     "test": "npm run lint && vitest run && npm run build",
     "clean": "del-cli coverage test-reports node_modules",
@@ -18,24 +18,24 @@
   },
   "devDependencies": {
     "@aws-sdk/credential-provider-env": "^3.972.39",
-    "@biomejs/biome": "2.4.13",
+    "@biomejs/biome": "2.4.15",
     "@smithy/property-provider": "^4.3.4",
     "@types/node": "^25.9.1",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@vitest/coverage-v8": "4.1.5",
     "aws-sdk-client-mock": "^4.1.0",
     "esbuild": "^0.28.0",
-    "generate-license-file": "^4.2.1",
+    "generate-license-file": "^4.1.1",
     "json-schema": "^0.4.0",
     "markdownlint-cli": "^0.48.0",
     "memfs": "^4.57.2",
     "standard-version": "^9.5.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "4.1.5"
   },
   "dependencies": {
-    "@actions/core": "^2.0.2",
+    "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1053.0",
+    "@aws-sdk/client-sts": "^3.1049.0",
-    "@smithy/node-http-handler": "^4.6.1",
+    "@smithy/node-http-handler": "^4.7.3",
     "proxy-agent": "^8.0.1"
   },
   "keywords": [

src/CredentialsClient.ts

@@ -3,15 +3,18 @@ import { STSClient } from '@aws-sdk/client-sts';
 import type { AwsCredentialIdentity } from '@aws-sdk/types';
 import { NodeHttpHandler } from '@smithy/node-http-handler';
 import { ProxyAgent } from 'proxy-agent';
-import { errorMessage, getCallerIdentity } from './helpers';
+import { buildCustomUserAgent, errorMessage, getCallerIdentity } from './helpers';
 import { ProxyResolver } from './ProxyResolver';
 
-const USER_AGENT = 'configure-aws-credentials-for-github-actions';
+if (!process.env.AWS_EXECUTION_ENV) {
+  process.env.AWS_EXECUTION_ENV = 'GitHubActions';
+}
 
 export interface CredentialsClientProps {
   region?: string;
   proxyServer?: string;
   noProxy?: string;
+  stsEndpoint?: string;
   roleChaining: boolean;
 }
 
@@ -19,6 +22,7 @@ export class CredentialsClient {
   public region?: string;
   private _stsClient?: STSClient;
   private readonly requestHandler?: NodeHttpHandler;
+  private readonly stsEndpoint?: string;
   private roleChaining?: boolean;
 
   constructor(props: CredentialsClientProps) {
@@ -41,19 +45,20 @@ export class CredentialsClient {
         httpAgent: handler,
       });
     }
+    if (props.stsEndpoint) {
+      this.stsEndpoint = props.stsEndpoint;
+    }
     this.roleChaining = props.roleChaining;
   }
 
   public get stsClient(): STSClient {
     if (!this._stsClient || this.roleChaining) {
-      const config = { customUserAgent: USER_AGENT } as {
+      this._stsClient = new STSClient({
-        customUserAgent: string;
+        customUserAgent: buildCustomUserAgent(),
-        region?: string;
+        ...(this.region !== undefined && { region: this.region }),
-        requestHandler?: NodeHttpHandler;
+        ...(this.stsEndpoint !== undefined && { endpoint: this.stsEndpoint }),
-      };
+        ...(this.requestHandler !== undefined && { requestHandler: this.requestHandler }),
-      if (this.region !== undefined) config.region = this.region;
+      });
-      if (this.requestHandler !== undefined) config.requestHandler = this.requestHandler;
-      this._stsClient = new STSClient(config);
     }
     return this._stsClient;
   }

src/assumeRole.ts

@@ -2,7 +2,11 @@ import assert from 'node:assert';
 import path from 'node:path';
 import * as core from '@actions/core';
 import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts';
-import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
+import {
+  AssumeRoleCommand,
+  AssumeRoleWithWebIdentityCommand,
+  PackedPolicyTooLargeException,
+} from '@aws-sdk/client-sts';
 import type { CredentialsClient } from './CredentialsClient';
 import { errorMessage, isDefined, readFileUtf8, sanitizeGitHubVariables } from './helpers';
 
@@ -42,6 +46,7 @@ async function assumeRoleWithWebIdentityTokenFile(
   core.info('Assuming role with web identity token file');
   try {
     delete params.Tags;
+    delete params.TransitiveTagKeys;
     const creds = await client.send(
       new AssumeRoleWithWebIdentityCommand({
         ...params,
@@ -60,6 +65,13 @@ async function assumeRoleWithCredentials(params: AssumeRoleCommandInput, client:
     const creds = await client.send(new AssumeRoleCommand({ ...params }));
     return creds;
   } catch (error) {
+    if (error instanceof PackedPolicyTooLargeException) {
+      core.info('Session tag size is too large; dropping droppable tags and retrying.');
+      const droppableKeys = new Set(DROPPABLE_TAG_SOURCES.map((s) => s.key));
+      params.Tags = params.Tags?.filter((tag) => !droppableKeys.has(tag.Key ?? ''));
+      const creds = await client.send(new AssumeRoleCommand({ ...params }));
+      return creds;
+    }
     throw new Error(`Could not assume role with user credentials: ${errorMessage(error)}`);
   }
 }
@@ -77,6 +89,99 @@ export interface assumeRoleParams {
   webIdentityToken?: string;
   inlineSessionPolicy?: string;
   managedSessionPolicies?: { arn: string }[];
+  customTags?: string;
+}
+
+const TAG_KEY_REGEX = /^[\p{L}\p{Z}\p{N}_.:/=+\-@]+$/u;
+const TAG_VALUE_REGEX = /^[\p{L}\p{Z}\p{N}_.:/=+\-@]*$/u;
+const MAX_TAG_KEY_LENGTH = 128;
+const MAX_TAG_VALUE_LENGTH = 256;
+const MAX_SESSION_TAGS = 50;
+
+// Identity/audit primitives. Always emitted and cannot be dropped.
+const NON_DROPPABLE_TAG_SOURCES: ReadonlyArray<{ key: string; envVar: string }> = [
+  { key: 'Repository', envVar: 'GITHUB_REPOSITORY' },
+  { key: 'Workflow', envVar: 'GITHUB_WORKFLOW' },
+  { key: 'Action', envVar: 'GITHUB_ACTION' },
+  { key: 'Actor', envVar: 'GITHUB_ACTOR' },
+  { key: 'Commit', envVar: 'GITHUB_SHA' },
+  { key: 'Branch', envVar: 'GITHUB_REF' },
+];
+
+// Convenience metadata. If the AssumeRole call fails due to compressed size of
+// session tags being too large, we will drop these tags and retry once.
+const DROPPABLE_TAG_SOURCES: ReadonlyArray<{ key: string; envVar: string }> = [
+  { key: 'EventName', envVar: 'GITHUB_EVENT_NAME' },
+  { key: 'BaseRef', envVar: 'GITHUB_BASE_REF' },
+  { key: 'HeadRef', envVar: 'GITHUB_HEAD_REF' },
+  { key: 'RunId', envVar: 'GITHUB_RUN_ID' },
+  { key: 'Job', envVar: 'GITHUB_JOB' },
+  { key: 'TriggeringActor', envVar: 'GITHUB_TRIGGERING_ACTOR' },
+];
+
+const PROTECTED_TAG_KEYS = new Set<string>([
+  'GitHub',
+  ...NON_DROPPABLE_TAG_SOURCES.map((s) => s.key),
+  ...DROPPABLE_TAG_SOURCES.map((s) => s.key),
+]);
+
+export function parseAndValidateCustomTags(customTags: string, existingTags: Tag[]): Tag[] {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(customTags);
+  } catch {
+    throw new Error('custom-tags: input is not valid JSON');
+  }
+
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    throw new Error('custom-tags: input must be a JSON object (not an array or primitive)');
+  }
+
+  const newTags: Tag[] = [];
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value === 'object') {
+      throw new Error(
+        `custom-tags: value for key '${key}' must be a string, number, or boolean (not an object or array)`,
+      );
+    }
+
+    const stringValue = String(value);
+
+    if (key.length === 0 || key.length > MAX_TAG_KEY_LENGTH) {
+      throw new Error(`custom-tags: key '${key}' must be between 1 and ${MAX_TAG_KEY_LENGTH} characters`);
+    }
+    if (stringValue.length > MAX_TAG_VALUE_LENGTH) {
+      throw new Error(
+        `custom-tags: value for key '${key}' exceeds maximum length of ${MAX_TAG_VALUE_LENGTH} characters`,
+      );
+    }
+    if (!TAG_KEY_REGEX.test(key)) {
+      throw new Error(
+        `custom-tags: key '${key}' contains invalid characters. Allowed: unicode letters, digits, spaces, and _.:/=+-@`,
+      );
+    }
+    if (stringValue.length > 0 && !TAG_VALUE_REGEX.test(stringValue)) {
+      throw new Error(
+        `custom-tags: value for key '${key}' contains invalid characters. Allowed: unicode letters, digits, spaces, and _.:/=+-@`,
+      );
+    }
+    if (PROTECTED_TAG_KEYS.has(key)) {
+      throw new Error(
+        `custom-tags: key '${key}' conflicts with a protected session tag set by this action and cannot be overridden`,
+      );
+    }
+
+    newTags.push({ Key: key, Value: stringValue });
+  }
+
+  if (existingTags.length + newTags.length > MAX_SESSION_TAGS) {
+    throw new Error(
+      `custom-tags: total session tags (${existingTags.length + newTags.length}) would exceed the AWS limit of ${MAX_SESSION_TAGS}`,
+    );
+  }
+
+  return newTags;
 }
 
 export async function assumeRole(params: assumeRoleParams) {
@@ -93,6 +198,7 @@ export async function assumeRole(params: assumeRoleParams) {
     webIdentityToken,
     inlineSessionPolicy,
     managedSessionPolicies,
+    customTags,
   } = { ...params };
 
   // Load GitHub environment variables
@@ -101,26 +207,32 @@ export async function assumeRole(params: assumeRoleParams) {
     throw new Error('Missing required environment variables. Are you running in GitHub Actions?');
   }
 
-  // Load role session tags
+  // Build session tags. Values are sanitized because the AWS tag value spec is more
-  const tagArray: Tag[] = [
+  // restrictive than permissible characters in environment variables.
-    { Key: 'GitHub', Value: 'Actions' },
+  const protectedTags: Tag[] = [{ Key: 'GitHub', Value: 'Actions' }];
-    { Key: 'Repository', Value: GITHUB_REPOSITORY },
+  for (const { key, envVar } of NON_DROPPABLE_TAG_SOURCES) {
-    { Key: 'Workflow', Value: sanitizeGitHubVariables(GITHUB_WORKFLOW) },
+    const value = process.env[envVar];
-    { Key: 'Action', Value: GITHUB_ACTION },
+    if (value) {
-    { Key: 'Actor', Value: sanitizeGitHubVariables(GITHUB_ACTOR) },
+      protectedTags.push({ Key: key, Value: sanitizeGitHubVariables(value) });
-    { Key: 'Commit', Value: GITHUB_SHA },
+    }
-  ];
-  if (process.env.GITHUB_REF) {
-    tagArray.push({
-      Key: 'Branch',
-      Value: sanitizeGitHubVariables(process.env.GITHUB_REF),
-    });
   }
+  for (const { key, envVar } of DROPPABLE_TAG_SOURCES) {
+    const value = process.env[envVar];
+    if (value) {
+      protectedTags.push({ Key: key, Value: sanitizeGitHubVariables(value) });
+    }
+  }
+
+  const parsedCustomTags: Tag[] = customTags ? parseAndValidateCustomTags(customTags, protectedTags) : [];
+
+  const tagArray: Tag[] = [...protectedTags, ...parsedCustomTags];
+
   const tags = roleSkipSessionTagging ? undefined : tagArray;
   if (!tags) {
     core.debug('Role session tagging has been skipped.');
   } else {
-    core.debug(`${tags.length} role session tags are being used.`);
+    core.debug(`${tags.length} role session tags are being used:`);
+    core.debug(JSON.stringify(tagArray));
   }
 
   //only populate transitiveTagKeys array if user is actually using session tagging

src/helpers.ts

@@ -3,11 +3,32 @@ import * as path from 'node:path';
 import * as core from '@actions/core';
 import type { Credentials, STSClient } from '@aws-sdk/client-sts';
 import { GetCallerIdentityCommand } from '@aws-sdk/client-sts';
+import type { UserAgent } from '@smithy/types';
 import type { CredentialsClient } from './CredentialsClient';
 
 const MAX_TAG_VALUE_LENGTH = 256;
 const SANITIZATION_CHARACTER = '_';
 const SPECIAL_CHARS_REGEX = /[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]+/;
+const USER_AGENT_PREFIX = 'configure-aws-credentials-for-github-actions';
+const UA_FIELDS: ReadonlyArray<{ env: string; label: string; pattern: RegExp }> = [
+  { env: 'GITHUB_ACTION', label: 'action', pattern: /^[A-Za-z0-9_-]{1,128}$/ },
+  { env: 'GITHUB_RUN_ID', label: 'run_id', pattern: /^[0-9]{1,20}$/ },
+  { env: 'GITHUB_RUN_ATTEMPT', label: 'attempt', pattern: /^[0-9]{1,10}$/ },
+];
+
+export function buildCustomUserAgent(): UserAgent {
+  const tokens: UserAgent = [[USER_AGENT_PREFIX]];
+  for (const { env, label, pattern } of UA_FIELDS) {
+    const value = process.env[env];
+    if (value === undefined) continue;
+    if (pattern.test(value)) {
+      tokens.push(['md', `${label}#${value}`]);
+    } else {
+      core.warning(`${env} has unexpected format; omitting from User-Agent`);
+    }
+  }
+  return tokens;
+}
 
 export function translateEnvVariables() {
   const envVars = [
@@ -191,6 +212,7 @@ export async function retryAndBackoff<T>(
   maxRetries = 12,
   retries = 0,
   base = 50,
+  label?: string,
 ): Promise<T> {
   try {
     return await fn();
@@ -202,20 +224,21 @@ export async function retryAndBackoff<T>(
     // It's retryable, so sleep and retry.
     const delay = Math.random() * (2 ** retries * base);
     const nextRetry = retries + 1;
+    const opName = label ? ` ${label}` : '';
 
-    core.debug(
+    core.info(
-      `retryAndBackoff: attempt ${nextRetry} of ${maxRetries} failed: ${errorMessage(err)}. ` +
+      `Retry${opName}: attempt ${nextRetry} of ${maxRetries} failed: ${errorMessage(err)}. ` +
         `Retrying after ${Math.floor(delay)}ms.`,
     );
 
     await sleep(delay);
 
     if (nextRetry >= maxRetries) {
-      core.debug('retryAndBackoff: reached max retries; giving up.');
+      core.info(`Retry${opName}: reached max retries (${maxRetries}); giving up.`);
       throw err;
     }
 
-    return await retryAndBackoff(fn, isRetryable, maxRetries, nextRetry, base);
+    return await retryAndBackoff(fn, isRetryable, maxRetries, nextRetry, base, label);
   }
 }
 
@@ -274,6 +297,20 @@ export function getBooleanInput(name: string, options?: core.InputOptions & { de
 // O_NOFOLLOW is undefined on Windows. This sets it to 0 if it's not defined.
 const O_NOFOLLOW: number = (fs.constants as { O_NOFOLLOW?: number }).O_NOFOLLOW ?? 0;
 
+export function isAllowListed(filePath: string): boolean {
+  // Kubelet projects service-account tokens through a symlink chain
+  // (token -> ..data/token, ..data -> ..<timestamp>/). The containing path is
+  // kubelet-controlled, so we allow symlink-following reads of this fixed
+  // location only.
+  const KUBERNETES_TOKEN_PATH_REGEX = /^\/var\/run\/secrets\/[^/]+\/serviceaccount\/token$/;
+
+  if (process.platform !== 'win32') {
+    // No Kubernetes token paths on Windows
+    return KUBERNETES_TOKEN_PATH_REGEX.test(path.posix.normalize(filePath));
+  }
+  return false;
+}
+
 export function isSymlink(filePath: string): boolean {
   try {
     return fs.lstatSync(filePath).isSymbolicLink();
@@ -305,10 +342,14 @@ function assertRegularFile(fd: number, filePath: string): void {
 // ELOOP: too many symbolic links (from NOFOLLOW)
 
 export function readFileUtf8(filePath: string): string | null {
-  refuseSymlinkOnPath(filePath);
+  const allowSymlink = isAllowListed(filePath);
+  if (!allowSymlink) {
+    refuseSymlinkOnPath(filePath);
+  }
+  const openFlags = fs.constants.O_RDONLY | (allowSymlink ? 0 : O_NOFOLLOW);
   let fd: number;
   try {
-    fd = fs.openSync(filePath, fs.constants.O_RDONLY | O_NOFOLLOW);
+    fd = fs.openSync(filePath, openFlags);
   } catch (err) {
     const code = (err as NodeJS.ErrnoException).code;
     if (code === 'ENOENT') return null;

src/index.ts

@@ -19,6 +19,7 @@ import { writeProfileFiles } from './profileManager';
 const DEFAULT_ROLE_DURATION = 3600; // One hour (seconds)
 const ROLE_SESSION_NAME = 'GitHubActions';
 const REGION_REGEX = /^[a-z0-9-]+$/g;
+const ROLE_SESSION_NAME_REGEX = /^[\w+=,.@-]*$/;
 
 export async function run() {
   try {
@@ -43,6 +44,7 @@ export async function run() {
     const roleSkipSessionTagging = getBooleanInput('role-skip-session-tagging', { required: false });
     const transitiveTagKeys = core.getMultilineInput('transitive-tag-keys', { required: false });
     const proxyServer = core.getInput('http-proxy', { required: false }) || process.env.HTTP_PROXY;
+    const customTags = core.getInput('custom-tags', { required: false });
     const inlineSessionPolicy = core.getInput('inline-session-policy', { required: false });
     const managedSessionPolicies = core.getMultilineInput('managed-session-policies', { required: false }).map((p) => {
       return { arn: p };
@@ -63,6 +65,7 @@ export async function run() {
       .map((s) => s.trim());
     const forceSkipOidc = getBooleanInput('force-skip-oidc', { required: false });
     const noProxy = core.getInput('no-proxy', { required: false });
+    const stsEndpoint = core.getInput('sts-endpoint', { required: false });
     const globalTimeout = Number.parseInt(core.getInput('action-timeout-s', { required: false })) || 0;
 
     let timeoutId: NodeJS.Timeout | undefined;
@@ -88,6 +91,9 @@ export async function run() {
       maxRetries = 1;
     }
 
+    const withRetry = <T>(fn: () => Promise<T>, label: string): Promise<T> =>
+      retryAndBackoff(fn, !disableRetry, maxRetries, 0, 50, label);
+
     // Logic to decide whether to attempt to use OIDC or not
     const useGitHubOIDCProvider = () => {
       if (forceSkipOidc) return false;
@@ -124,15 +130,33 @@ export async function run() {
       throw new Error(`Region is not valid: ${region}`);
     }
 
+    if (roleSessionName.length < 2 || roleSessionName.length > 64) {
+      throw new Error(
+        `Role session name must be between 2 and 64 characters, got ${roleSessionName.length}: '${roleSessionName}'`,
+      );
+    }
+    if (!roleSessionName.match(ROLE_SESSION_NAME_REGEX)) {
+      throw new Error(
+        `Role session name is not valid: '${roleSessionName}'. Must satisfy regular expression pattern: [\\w+=,.@-]*`,
+      );
+    }
+
     exportRegion(region, outputEnvCredentials);
 
     // Instantiate credentials client
-    const clientProps: { region: string; proxyServer?: string; noProxy?: string; roleChaining: boolean } = {
+    const clientProps: {
+      region: string;
+      proxyServer?: string;
+      noProxy?: string;
+      stsEndpoint?: string;
+      roleChaining: boolean;
+    } = {
       region,
       roleChaining,
     };
     if (proxyServer) clientProps.proxyServer = proxyServer;
     if (noProxy) clientProps.noProxy = noProxy;
+    if (stsEndpoint) clientProps.stsEndpoint = stsEndpoint;
     const credentialsClient = new CredentialsClient(clientProps);
     let sourceAccountId: string;
     let webIdentityToken: string;
@@ -152,13 +176,9 @@ export async function run() {
     // Else, export credentials provided as input
     if (useGitHubOIDCProvider()) {
       try {
-        webIdentityToken = await retryAndBackoff(
+        webIdentityToken = await withRetry(async () => {
-          async () => {
+          return core.getIDToken(audience);
-            return core.getIDToken(audience);
+        }, 'getIDToken');
-          },
-          !disableRetry,
-          maxRetries,
-        );
       } catch (error) {
         throw new Error(`getIDToken call failed: ${errorMessage(error)}`);
       }
@@ -179,59 +199,77 @@ export async function run() {
       }
     } else if (!webIdentityTokenFile && !roleChaining) {
       // Proceed only if credentials can be picked up
-      await credentialsClient.validateCredentials(undefined, roleChaining, expectedAccountIds);
+      await withRetry(
-      sourceAccountId = await exportAccountId(credentialsClient, maskAccountId);
+        () => credentialsClient.validateCredentials(undefined, roleChaining, expectedAccountIds),
+        'validateCredentials',
+      );
+      sourceAccountId = await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
     }
 
     if (AccessKeyId || roleChaining) {
       // Validate that the SDK can actually pick up credentials.
       // This validates cases where this action is using existing environment credentials,
       // and cases where the user intended to provide input credentials but the secrets inputs resolved to empty strings.
-      await credentialsClient.validateCredentials(AccessKeyId, roleChaining, expectedAccountIds);
+      // Skip when output-env-credentials is false: input IAM keys were not written to env, so
-      sourceAccountId = await exportAccountId(credentialsClient, maskAccountId);
+      // the default chain would resolve to ambient runner credentials and the access-key check
+      // would spuriously fail (see #1554).
+      if (outputEnvCredentials) {
+        await withRetry(
+          () => credentialsClient.validateCredentials(AccessKeyId, roleChaining, expectedAccountIds),
+          'validateCredentials',
+        );
+        sourceAccountId = await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
+      }
     }
+    if (customTags && (useGitHubOIDCProvider() || webIdentityTokenFile)) {
+      core.warning(
+        "'custom-tags' is set but will be ignored because session tags cannot be applied when using OIDC or web identity token authentication. " +
+          'Tags are controlled by the identity provider token claims in these authentication flows.',
+      );
+    }
+
     // Get role credentials if configured to do so
     if (roleToAssume) {
       let roleCredentials: AssumeRoleCommandOutput;
       do {
-        roleCredentials = await retryAndBackoff(
+        roleCredentials = await withRetry(async () => {
-          async () => {
+          return assumeRole({
-            return assumeRole({
+            credentialsClient,
-              credentialsClient,
+            sourceAccountId,
-              sourceAccountId,
+            roleToAssume,
-              roleToAssume,
+            roleExternalId,
-              roleExternalId,
+            roleDuration,
-              roleDuration,
+            roleSessionName,
-              roleSessionName,
+            roleSkipSessionTagging,
-              roleSkipSessionTagging,
+            transitiveTagKeys,
-              transitiveTagKeys,
+            webIdentityTokenFile,
-              webIdentityTokenFile,
+            webIdentityToken,
-              webIdentityToken,
+            inlineSessionPolicy,
-              inlineSessionPolicy,
+            managedSessionPolicies,
-              managedSessionPolicies,
+            customTags,
-            });
+          });
-          },
+        }, 'AssumeRole');
-          !disableRetry,
-          maxRetries,
-        );
       } while (specialCharacterWorkaround && !verifyKeys(roleCredentials.Credentials));
       core.info(`Authenticated as assumedRoleId ${roleCredentials.AssumedRoleUser?.AssumedRoleId}`);
       exportCredentials(roleCredentials.Credentials, outputCredentials, outputEnvCredentials);
-      // We need to validate the credentials in 2 of our use-cases
+      // Validate that the SDK can pick up the assumed-role credentials from the environment.
-      // First: self-hosted runners. If the GITHUB_ACTIONS environment variable
+      // Skip when output-env-credentials is false: the credentials were never written to env,
-      //  is set to `true` then we are NOT in a self-hosted runner.
+      // so the default credential provider chain would resolve to ambient runner credentials
-      // Second: Customer provided credentials manually (IAM User keys stored in GH Secrets)
+      // (e.g. an EC2 instance profile) and the access-key-id check would spuriously fail.
-      // If we are using a profile, don't validate credentials yet (since they most likely won't be in the environment).
+      // Skip when using a profile: validation runs after the profile file is written below.
-      // Wait until after creds are written to the profile file to try validation.
+      if ((!process.env.GITHUB_ACTIONS || AccessKeyId) && !awsProfile && outputEnvCredentials) {
-      if ((!process.env.GITHUB_ACTIONS || AccessKeyId) && !awsProfile) {
+        await withRetry(
-        await credentialsClient.validateCredentials(
+          () =>
-          roleCredentials.Credentials?.AccessKeyId,
+            credentialsClient.validateCredentials(
-          roleChaining,
+              roleCredentials.Credentials?.AccessKeyId,
-          expectedAccountIds,
+              roleChaining,
+              expectedAccountIds,
+            ),
+          'validateCredentials',
         );
       }
       if (outputEnvCredentials) {
-        await exportAccountId(credentialsClient, maskAccountId);
+        await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
       }
 
       // Write profile files if profile mode is enabled
@@ -244,10 +282,14 @@ export async function run() {
         // We then validate the credentials to make sure they work.
         if (AccessKeyId || !process.env.GITHUB_ACTIONS) {
           writeProfileFiles(awsProfile, roleCredentials.Credentials, region, true);
-          await credentialsClient.validateCredentials(
+          await withRetry(
-            roleCredentials.Credentials.AccessKeyId,
+            () =>
-            roleChaining,
+              credentialsClient.validateCredentials(
-            expectedAccountIds,
+                roleCredentials.Credentials?.AccessKeyId,
+                roleChaining,
+                expectedAccountIds,
+              ),
+            'validateCredentials',
           );
         } else {
           writeProfileFiles(awsProfile, roleCredentials.Credentials, region, overwriteAwsProfile);

test/assumeRole.test.ts

@@ -1,9 +1,5 @@
 import * as core from '@actions/core';
-import {
+import { AssumeRoleWithWebIdentityCommand, GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
-  AssumeRoleWithWebIdentityCommand,
-  GetCallerIdentityCommand,
-  STSClient,
-} from '@aws-sdk/client-sts';
 import { mockClient } from 'aws-sdk-client-mock';
 import { fs, vol } from 'memfs';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

test/cleanup.test.ts

@@ -5,20 +5,15 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { cleanup } from '../src/cleanup';
 import mocks from './mockinputs.test';
 
+vi.mock('@actions/core');
+
 const mockedSTSClient = mockClient(STSClient);
 
 describe('Configure AWS Credentials cleanup', {}, () => {
   beforeEach(() => {
-    // Reset mock state
+    vi.resetAllMocks();
-    vi.restoreAllMocks();
     mockedSTSClient.reset();
-    // Mock GitHub Actions core functions
+    vi.mocked(core.getInput).mockReturnValue('');
-    vi.spyOn(core, 'exportVariable').mockImplementation((_n, _v) => {});
-    vi.spyOn(core, 'setSecret').mockImplementation((_s) => {});
-    vi.spyOn(core, 'setFailed').mockImplementation((_m) => {});
-    vi.spyOn(core, 'setOutput').mockImplementation((_n, _v) => {});
-    vi.spyOn(core, 'debug').mockImplementation((_m) => {});
-    vi.spyOn(core, 'info').mockImplementation((_m) => {});
     process.env = {
       ...mocks.envs,
       AWS_ACCESS_KEY_ID: 'CLEANUPTEST',
@@ -39,7 +34,7 @@ describe('Configure AWS Credentials cleanup', {}, () => {
     expect(core.exportVariable).toHaveBeenCalledWith('AWS_REGION', '');
   });
   it('also clears AWS_PROFILE when aws-profile was set', {}, () => {
-    vi.spyOn(core, 'getInput').mockImplementation((name: string) => {
+    vi.mocked(core.getInput).mockImplementation((name: string) => {
       if (name === 'aws-profile') return 'my-profile';
       if (name === 'output-env-credentials') return 'true';
       return '';
@@ -50,7 +45,7 @@ describe('Configure AWS Credentials cleanup', {}, () => {
     expect(core.exportVariable).toHaveBeenCalledWith('AWS_PROFILE', '');
   });
   it('skips env cleanup when aws-profile is set without output-env-credentials', {}, () => {
-    vi.spyOn(core, 'getInput').mockImplementation((name: string) => {
+    vi.mocked(core.getInput).mockImplementation((name: string) => {
       if (name === 'aws-profile') return 'my-profile';
       return '';
     });
@@ -59,14 +54,14 @@ describe('Configure AWS Credentials cleanup', {}, () => {
     expect(core.exportVariable).toHaveBeenCalledTimes(0);
   });
   it('handles errors', {}, () => {
-    vi.spyOn(core, 'exportVariable').mockImplementationOnce(() => {
+    vi.mocked(core.exportVariable).mockImplementationOnce(() => {
       throw new Error('Test error');
     });
     cleanup();
     expect(core.setFailed).toHaveBeenCalled();
   });
   it(`doesn't export credentials as empty env variables if asked not to`, {}, () => {
-    vi.spyOn(core, 'getInput').mockImplementation(mocks.getInput(mocks.NO_ENV_CREDS_INPUTS));
+    vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.NO_ENV_CREDS_INPUTS));
     cleanup();
     expect(core.exportVariable).toHaveBeenCalledTimes(0);
   });

test/helpers.test.ts

@@ -28,6 +28,29 @@ describe('Configure AWS Credentials helpers', {}, () => {
     await expect(helpers.retryAndBackoff(fn, false)).rejects.toMatch('i am not retryable');
     expect(fn).toHaveBeenCalledTimes(1);
   });
+  it('retries and logs with label at info level', {}, async () => {
+    helpers.withsleep(() => Promise.resolve());
+    const fn = vi.fn().mockRejectedValueOnce(new Error('transient')).mockResolvedValueOnce('success');
+    const result = await helpers.retryAndBackoff(fn, true, 3, 0, 50, 'TestOp');
+    expect(result).toBe('success');
+    expect(fn).toHaveBeenCalledTimes(2);
+    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry TestOp: attempt 1 of 3 failed'));
+    helpers.reset();
+  });
+  it('logs max retries reached with label', {}, async () => {
+    helpers.withsleep(() => Promise.resolve());
+    const fn = vi.fn().mockRejectedValue(new Error('persistent'));
+    await expect(helpers.retryAndBackoff(fn, true, 2, 0, 50, 'TestOp')).rejects.toThrow('persistent');
+    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry TestOp: reached max retries (2)'));
+    helpers.reset();
+  });
+  it('retries without a label (backward compat)', {}, async () => {
+    helpers.withsleep(() => Promise.resolve());
+    const fn = vi.fn().mockRejectedValueOnce(new Error('transient')).mockResolvedValueOnce('ok');
+    await helpers.retryAndBackoff(fn, true, 3);
+    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry: attempt 1 of 3 failed'));
+    helpers.reset();
+  });
   it('can output creds when told to', {}, () => {
     vi.spyOn(core, 'setOutput').mockImplementation(() => {});
     vi.spyOn(core, 'setSecret').mockImplementation(() => {});
@@ -84,13 +107,13 @@ describe('Configure AWS Credentials helpers', {}, () => {
   it('handles getBooleanInput correctly', {}, () => {
     vi.spyOn(core, 'getInput').mockReturnValue('true');
     expect(helpers.getBooleanInput('test')).toBe(true);
-    
+
     vi.spyOn(core, 'getInput').mockReturnValue('false');
     expect(helpers.getBooleanInput('test')).toBe(false);
-    
+
     vi.spyOn(core, 'getInput').mockReturnValue('');
     expect(helpers.getBooleanInput('test', { default: true })).toBe(true);
-    
+
     vi.spyOn(core, 'getInput').mockReturnValue('invalid');
     expect(() => helpers.getBooleanInput('test')).toThrow();
   });
@@ -154,6 +177,52 @@ describe('Configure AWS Credentials helpers', {}, () => {
         fs.mkdirSync('/dir/subdir', { recursive: true });
         expect(() => helpers.readFileUtf8('/dir/subdir')).toThrow(/not a regular file/);
       });
+
+      it.skipIf(process.platform === 'win32')(
+        'follows the kubelet projected-token symlink chain at /var/run/secrets/*/serviceaccount/token',
+        () => {
+          fs.mkdirSync('/var/run/secrets/eks.amazonaws.com/serviceaccount/..2026_05_28_00_00_00.123', {
+            recursive: true,
+          });
+          fs.writeFileSync(
+            '/var/run/secrets/eks.amazonaws.com/serviceaccount/..2026_05_28_00_00_00.123/token',
+            'jwt-token',
+          );
+          fs.symlinkSync('..2026_05_28_00_00_00.123', '/var/run/secrets/eks.amazonaws.com/serviceaccount/..data');
+          fs.symlinkSync('..data/token', '/var/run/secrets/eks.amazonaws.com/serviceaccount/token');
+          expect(helpers.readFileUtf8('/var/run/secrets/eks.amazonaws.com/serviceaccount/token')).toBe('jwt-token');
+        },
+      );
+
+      it.skipIf(process.platform === 'win32')('still refuses symlinks at lookalike paths outside the allowlist', () => {
+        fs.mkdirSync('/var/run/secrets/eks.amazonaws.com/serviceaccount', { recursive: true });
+        fs.writeFileSync('/var/run/secrets/eks.amazonaws.com/serviceaccount/secret', 'jwt-token');
+        fs.symlinkSync(
+          '/var/run/secrets/eks.amazonaws.com/serviceaccount/secret',
+          '/var/run/secrets/eks.amazonaws.com/serviceaccount/token2',
+        );
+        expect(() => helpers.readFileUtf8('/var/run/secrets/eks.amazonaws.com/serviceaccount/token2')).toThrow(
+          /Refusing .* \(.* symbolic link\)/,
+        );
+      });
+    });
+
+    describe('isAllowListed', {}, () => {
+      it.skipIf(process.platform === 'win32')('matches the canonical kubelet projected-token path', () => {
+        expect(helpers.isAllowListed('/var/run/secrets/eks.amazonaws.com/serviceaccount/token')).toBe(true);
+        expect(helpers.isAllowListed('/var/run/secrets/kubernetes.io/serviceaccount/token')).toBe(true);
+      });
+
+      it.skipIf(process.platform === 'win32')('rejects nested or unrelated paths', () => {
+        expect(helpers.isAllowListed('/var/run/secrets/serviceaccount/token')).toBe(false);
+        expect(helpers.isAllowListed('/var/run/secrets/a/b/serviceaccount/token')).toBe(false);
+        expect(helpers.isAllowListed('/var/run/secrets/eks.amazonaws.com/serviceaccount/token2')).toBe(false);
+        expect(helpers.isAllowListed('/etc/var/run/secrets/foo/serviceaccount/token')).toBe(false);
+      });
+
+      it.skipIf(process.platform === 'win32')('normalizes path traversal attempts', () => {
+        expect(helpers.isAllowListed('/var/run/secrets/foo/serviceaccount/../../../../etc/passwd')).toBe(false);
+      });
     });
 
     describe('writeFileUtf8', {}, () => {

test/mockinputs.test.ts

@@ -6,6 +6,46 @@ const inputs = {
     'aws-region': 'fake-region-1',
     'special-characters-workaround': 'true',
   },
+  CUSTOM_TAGS_INVALID_JSON_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+    'retry-max-attempts': '1',
+    'custom-tags': 'not a json',
+  },
+  CUSTOM_TAGS_ARRAY_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+    'retry-max-attempts': '1',
+    'custom-tags': '[1, 2, 3]',
+  },
+  CUSTOM_TAGS_RESERVED_KEY_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+    'retry-max-attempts': '1',
+    'custom-tags': JSON.stringify({ Repository: 'evil-repo' }),
+  },
+  CUSTOM_TAGS_INVALID_KEY_CHARS_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+    'retry-max-attempts': '1',
+    'custom-tags': JSON.stringify({ 'invalid{key}': 'value' }),
+  },
+  CUSTOM_TAGS_OBJECT_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+    'retry-max-attempts': '1',
+    'custom-tags': JSON.stringify({ Environment: 'Production', Team: 'DevOps' }),
+  },
   IAM_USER_INPUTS: {
     'aws-access-key-id': 'MYAWSACCESSKEYID',
     'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
@@ -43,6 +83,14 @@ const inputs = {
     'output-env-credentials': 'false',
     'output-credentials': 'true',
   },
+  IAM_ASSUMEROLE_NO_ENV_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+    'output-env-credentials': 'false',
+    'output-credentials': 'true',
+  },
 };
 
 const envs = {
@@ -53,6 +101,13 @@ const envs = {
   GITHUB_SHA: 'MY-COMMIT-ID',
   GITHUB_WORKSPACE: '/home/github',
   GITHUB_ACTIONS: 'true',
+  GITHUB_REF: 'refs/pull/42/merge',
+  GITHUB_EVENT_NAME: 'pull_request',
+  GITHUB_RUN_ID: '16412345678',
+  GITHUB_JOB: 'build',
+  GITHUB_BASE_REF: 'main',
+  GITHUB_HEAD_REF: 'feature-branch',
+  GITHUB_TRIGGERING_ACTOR: 'MY-USERNAME[bot]',
 };
 
 const outputs = {

test/profileManager.test.ts

@@ -96,7 +96,10 @@ describe('Profile Manager', {}, () => {
     });
 
     it('round-trips through parseIni', {}, () => {
-      const data = { dev: { aws_access_key_id: 'AKIA', aws_secret_access_key: 'secret' }, 'profile prod': { region: 'us-west-2' } };
+      const data = {
+        dev: { aws_access_key_id: 'AKIA', aws_secret_access_key: 'secret' },
+        'profile prod': { region: 'us-west-2' },
+      };
       const roundTripped = parseIni(stringifyIni(data));
       expect(roundTripped).toEqual(data);
     });
@@ -197,10 +200,15 @@ describe('Profile Manager', {}, () => {
       const filePath = '/home/runner/.aws/credentials';
       fs.mkdirSync('/home/runner/.aws', { recursive: true });
 
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        filePath,
-        aws_secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        'dev',
-      }, false);
+        {
+          aws_access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+          aws_secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        },
+        false,
+      );
 
       const content = fs.readFileSync(filePath, 'utf-8');
       const parsed = parseIni(content);
@@ -215,16 +223,26 @@ describe('Profile Manager', {}, () => {
       fs.mkdirSync('/home/runner/.aws', { recursive: true });
 
       // Create initial profile
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        filePath,
-        aws_secret_access_key: 'devSecretKey',
+        'dev',
-      }, false);
+        {
+          aws_access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+          aws_secret_access_key: 'devSecretKey',
+        },
+        false,
+      );
 
       // Add second profile
-      mergeProfileSection(filePath, 'prod', {
+      mergeProfileSection(
-        aws_access_key_id: 'AKIAPRODEXAMPLE',
+        filePath,
-        aws_secret_access_key: 'prodSecretKey',
+        'prod',
-      }, false);
+        {
+          aws_access_key_id: 'AKIAPRODEXAMPLE',
+          aws_secret_access_key: 'prodSecretKey',
+        },
+        false,
+      );
 
       const content = fs.readFileSync(filePath, 'utf-8');
       const parsed = parseIni(content);
@@ -240,18 +258,28 @@ describe('Profile Manager', {}, () => {
       fs.mkdirSync('/home/runner/.aws', { recursive: true });
 
       // Create initial profile
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'OLD_KEY',
+        filePath,
-        aws_secret_access_key: 'oldSecretKey',
+        'dev',
-        aws_session_token: 'oldSessionToken'
+        {
-      }, false);
+          aws_access_key_id: 'OLD_KEY',
+          aws_secret_access_key: 'oldSecretKey',
+          aws_session_token: 'oldSessionToken',
+        },
+        false,
+      );
 
       // Overwrite with new credentials
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'NEW_KEY',
+        filePath,
-        aws_secret_access_key: 'newSecretKey',
+        'dev',
-        aws_session_token: 'newSessionToken',
+        {
-      }, true);
+          aws_access_key_id: 'NEW_KEY',
+          aws_secret_access_key: 'newSecretKey',
+          aws_session_token: 'newSessionToken',
+        },
+        true,
+      );
 
       const content = fs.readFileSync(filePath, 'utf-8');
       const parsed = parseIni(content);
@@ -266,17 +294,27 @@ describe('Profile Manager', {}, () => {
       fs.mkdirSync('/home/runner/.aws', { recursive: true });
 
       // Create profile with session token
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'AKIA',
+        filePath,
-        aws_secret_access_key: 'secret',
+        'dev',
-        aws_session_token: 'old-token',
+        {
-      }, false);
+          aws_access_key_id: 'AKIA',
+          aws_secret_access_key: 'secret',
+          aws_session_token: 'old-token',
+        },
+        false,
+      );
 
       // Overwrite without session token
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'AKIA2',
+        filePath,
-        aws_secret_access_key: 'secret2',
+        'dev',
-      }, true);
+        {
+          aws_access_key_id: 'AKIA2',
+          aws_secret_access_key: 'secret2',
+        },
+        true,
+      );
 
       const content = fs.readFileSync(filePath, 'utf-8');
       const parsed = parseIni(content);
@@ -291,10 +329,15 @@ describe('Profile Manager', {}, () => {
       fs.mkdirSync('/home/runner/.aws', { recursive: true });
       fs.writeFileSync(filePath, '', { mode: 0o600 });
 
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'AKIA',
+        filePath,
-        aws_secret_access_key: 'secret',
+        'dev',
-      }, false);
+        {
+          aws_access_key_id: 'AKIA',
+          aws_secret_access_key: 'secret',
+        },
+        false,
+      );
 
       const content = fs.readFileSync(filePath, 'utf-8');
       const parsed = parseIni(content);
@@ -308,17 +351,31 @@ describe('Profile Manager', {}, () => {
       fs.mkdirSync('/home/runner/.aws', { recursive: true });
 
       // Create initial profile
-      mergeProfileSection(filePath, 'dev', {
+      mergeProfileSection(
-        aws_access_key_id: 'OLD_KEY',
+        filePath,
-        aws_secret_access_key: 'oldSecretKey',
+        'dev',
-      }, false);
+        {
+          aws_access_key_id: 'OLD_KEY',
+          aws_secret_access_key: 'oldSecretKey',
+        },
+        false,
+      );
 
       // Overwrite with new credentials
-      expect(() => mergeProfileSection(filePath, 'dev', {
+      expect(() =>
-        aws_access_key_id: 'NEW_KEY',
+        mergeProfileSection(
-        aws_secret_access_key: 'newSecretKey',
+          filePath,
-        aws_session_token: 'sessionToken',
+          'dev',
-      }, false)).toThrow(`Profile with name "dev" already exists. Please use the overwrite-aws-profile input if you want to overwrite existing profiles.`);
+          {
+            aws_access_key_id: 'NEW_KEY',
+            aws_secret_access_key: 'newSecretKey',
+            aws_session_token: 'sessionToken',
+          },
+          false,
+        ),
+      ).toThrow(
+        `Profile with name "dev" already exists. Please use the overwrite-aws-profile input if you want to overwrite existing profiles.`,
+      );
 
       const content = fs.readFileSync(filePath, 'utf-8');
       const parsed = parseIni(content);
@@ -469,7 +526,7 @@ describe('Profile Manager', {}, () => {
             SecretAccessKey: 'secret',
           },
           'us-east-1',
-          false
+          false,
         ),
       ).toThrow('whitespace');
     });
@@ -487,7 +544,7 @@ describe('Profile Manager', {}, () => {
           SecretAccessKey: 'secret',
         },
         'us-east-1',
-        false
+        false,
       );
 
       expect(fs.existsSync('/custom/credentials')).toBe(true);
@@ -502,7 +559,7 @@ describe('Profile Manager', {}, () => {
           SecretAccessKey: 'secret',
         },
         'us-east-1',
-        false
+        false,
       );
 
       expect(core.info).toHaveBeenCalledWith('Writing credentials to profile: dev');
@@ -518,12 +575,7 @@ describe('Profile Manager', {}, () => {
         '[personal]\naws_access_key_id=AKIAPERSONAL\naws_secret_access_key=personalSecret\naws_session_token=personalToken\n',
       );
 
-      writeProfileFiles(
+      writeProfileFiles('dev', { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' }, 'us-east-1', false);
-        'dev',
-        { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' },
-        'us-east-1',
-        false,
-      );
 
       const content = fs.readFileSync(credsPath, 'utf-8');
       const parsed = parseIni(content);
@@ -541,17 +593,9 @@ describe('Profile Manager', {}, () => {
     it('preserves pre-existing config with extra keys', {}, () => {
       const configPath = getProfileFilePaths().config;
       fs.mkdirSync(require('node:path').dirname(configPath), { recursive: true });
-      fs.writeFileSync(
+      fs.writeFileSync(configPath, '[profile personal]\nregion=eu-west-1\noutput=json\ncli_pager=\n');
-        configPath,
-        '[profile personal]\nregion=eu-west-1\noutput=json\ncli_pager=\n',
-      );
 
-      writeProfileFiles(
+      writeProfileFiles('dev', { AccessKeyId: 'AKIA', SecretAccessKey: 'secret' }, 'us-east-1', false);
-        'dev',
-        { AccessKeyId: 'AKIA', SecretAccessKey: 'secret' },
-        'us-east-1',
-        false
-      );
 
       const content = fs.readFileSync(configPath, 'utf-8');
       const parsed = parseIni(content);
@@ -567,17 +611,9 @@ describe('Profile Manager', {}, () => {
     it('preserves pre-existing default profile when writing a named profile', {}, () => {
       const credsPath = getProfileFilePaths().credentials;
       fs.mkdirSync(require('node:path').dirname(credsPath), { recursive: true });
-      fs.writeFileSync(
+      fs.writeFileSync(credsPath, '[default]\naws_access_key_id=AKIADEFAULT\naws_secret_access_key=defaultSecret\n');
-        credsPath,
-        '[default]\naws_access_key_id=AKIADEFAULT\naws_secret_access_key=defaultSecret\n',
-      );
 
-      writeProfileFiles(
+      writeProfileFiles('dev', { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' }, 'us-west-2', false);
-        'dev',
-        { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' },
-        'us-west-2',
-        false
-      );
 
       const content = fs.readFileSync(credsPath, 'utf-8');
       const parsed = parseIni(content);
@@ -597,12 +633,7 @@ describe('Profile Manager', {}, () => {
         '# My important comment\n[personal]\naws_access_key_id=AKIA\naws_secret_access_key=secret\n',
       );
 
-      writeProfileFiles(
+      writeProfileFiles('dev', { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' }, 'us-east-1', false);
-        'dev',
-        { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' },
-        'us-east-1',
-        false
-      );
 
       const content = fs.readFileSync(credsPath, 'utf-8') as string;
 
@@ -636,12 +667,7 @@ describe('Profile Manager', {}, () => {
 
       fs.mkdirSync('/custom-creds', { recursive: true });
 
-      writeProfileFiles(
+      writeProfileFiles('dev', { AccessKeyId: 'AKIA', SecretAccessKey: 'secret' }, 'us-east-1', false);
-        'dev',
-        { AccessKeyId: 'AKIA', SecretAccessKey: 'secret' },
-        'us-east-1',
-        false
-      );
 
       expect(fs.existsSync('/custom-creds/credentials')).toBe(true);
       // Config file should be at the default path (under homedir)
@@ -658,7 +684,7 @@ describe('Profile Manager', {}, () => {
           SessionToken: 'FwoGZXIvYXdzEBYaDEXAMPLE',
         },
         'us-east-1',
-        false
+        false,
       );
 
       const credsPath = getProfileFilePaths().credentials;
@@ -673,28 +699,20 @@ describe('Profile Manager', {}, () => {
       // - LF line endings, trailing newline
       expect(credContent).toBe(
         '[dev]\n' +
-        'aws_access_key_id = AKIAIOSFODNN7EXAMPLE\n' +
+          'aws_access_key_id = AKIAIOSFODNN7EXAMPLE\n' +
-        'aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n' +
+          'aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n' +
-        'aws_session_token = FwoGZXIvYXdzEBYaDEXAMPLE\n',
+          'aws_session_token = FwoGZXIvYXdzEBYaDEXAMPLE\n',
-      );
-      expect(configContent).toBe(
-        '[profile dev]\n' +
-        'region = us-east-1\n',
       );
+      expect(configContent).toBe('[profile dev]\n' + 'region = us-east-1\n');
     });
 
     it('golden file for multi-profile output', {}, () => {
-      writeProfileFiles(
+      writeProfileFiles('dev', { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' }, 'us-east-1', false);
-        'dev',
-        { AccessKeyId: 'AKIADEV', SecretAccessKey: 'devSecret' },
-        'us-east-1',
-        false
-      );
       writeProfileFiles(
         'prod',
         { AccessKeyId: 'AKIAPROD', SecretAccessKey: 'prodSecret', SessionToken: 'prodToken' },
         'us-west-2',
-        false
+        false,
       );
 
       const credsPath = getProfileFilePaths().credentials;
@@ -705,20 +723,16 @@ describe('Profile Manager', {}, () => {
 
       expect(credContent).toBe(
         '[dev]\n' +
-        'aws_access_key_id = AKIADEV\n' +
+          'aws_access_key_id = AKIADEV\n' +
-        'aws_secret_access_key = devSecret\n' +
+          'aws_secret_access_key = devSecret\n' +
-        '\n' +
+          '\n' +
-        '[prod]\n' +
+          '[prod]\n' +
-        'aws_access_key_id = AKIAPROD\n' +
+          'aws_access_key_id = AKIAPROD\n' +
-        'aws_secret_access_key = prodSecret\n' +
+          'aws_secret_access_key = prodSecret\n' +
-        'aws_session_token = prodToken\n',
+          'aws_session_token = prodToken\n',
       );
       expect(configContent).toBe(
-        '[profile dev]\n' +
+        '[profile dev]\n' + 'region = us-east-1\n' + '\n' + '[profile prod]\n' + 'region = us-west-2\n',
-        'region = us-east-1\n' +
-        '\n' +
-        '[profile prod]\n' +
-        'region = us-west-2\n',
       );
     });
   });