-
Notifications
You must be signed in to change notification settings - Fork 464
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Question: How to do role chaining? (Not authorized to perform sts:AssumeRoleWithWebIdentity) #391
Comments
I was able to do this by passing the access key from the first step as arguments to the second step.
|
@jferris thanks for the info. Can you explain what "role-skip-session-tagging" is supposed to do (and why it's required to skip it in the chain)? |
@Fran-Rg This isn't required to make role chaining work, according to the docs I've linked above (and I've tested as well), you can role chain and use session tags. We should absolutely have an example of role chaining in the Readme! If someone else gets to it first I can review a PR, else I will get to it when I can |
We now have an example of this in the README 🙂 |
** Note ** |
Trying to do role chaining (assuming first role via GitHub OIDC, and second role using the first role). But failing.
The first role is assumed correctly, and while I can use the
aws sts
cli to assume the second role - that doesn't export the environment variables for further steps. Callingaws-actions/configure-aws-credentials@v1
again fails with aError: Not authorized to perform sts:AssumeRoleWithWebIdentity
error.This is what I get in the log:
This is running on a self-hosted runner on EC2. Such an example in the README will be helpful as well.
The text was updated successfully, but these errors were encountered: