-
Notifications
You must be signed in to change notification settings - Fork 464
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Trying to use webIdentityTokenFile
results in Credentials could not be loaded
error
#124
Comments
@callum-tait-pbx you should now be able to use a web identity token file to assume a role : #240 |
While this was implemented in #240 for EKS support, the nascent GitHub OIDC provider doesn't work properly with it. Cribbing from https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html, I can try this, which fails to find credentials when run.
This workflow yields this error:
At the same time, it is possible to do the same thing without this action:
For completeness, both of these are using a GitHub OIDC provider in IAM created with Cloudformation like in the blog post:
|
I don't think I understand why this is the case, but if I redundantly specify env variables that match the action input variables, then everything seems to work as expected? - uses: aws-actions/configure-aws-credentials@8053174404968575ac1dd102dcb1109d2fe6d9ea
env:
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
AWS_ROLE_ARN: arn:aws:iam::123412341234:role/srv_ops
AWS_DEFAULT_REGION: us-west-2
with:
aws-region: us-west-2
role-to-assume: arn:aws:iam::123412341234:role/srv_ops
web-identity-token-file: /tmp/awscreds
role-duration-seconds: 900 |
webIdentityTokenFile
results in Credentials could not be loaded
error
The original issue here has to do with supporting a new feature. I'm repurposing this issue to track the issue @avram has reported. I've found the same behavior in that trying to use this feature as documented results in error. I think I've found the reason why and I'm going to submit a PR |
Actually - I had something slightly misconfigured. I am finding that configure-aws-credentials/index.js Line 104 in 5a4b8f0
Please ensure that your file is properly generated and exists where you're specifying it, and this should work. The error messaging will need further investigation, but is lower priority. Let me know if anyone has any leads here, thanks! |
From my reading of the code this cannot work |
This should be fixed in |
** Note ** |
https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role-with-web-identity.html
I have a setup where I need to assume a role using a web identity token, AWS CLI commands below:
Expected Action YAML:
The context to this is I have a pod running on a EKS cluster and EKS IRSA is not an option.
The text was updated successfully, but these errors were encountered: