Migrate configure-aws-credentials to use AWS SDK for JavaScript (v3) #680

GeorgeDavis-TriumphTech · 2023-03-01T18:31:48Z

Describe the feature

(node:1629) NOTE: We are formalizing our plans to enter AWS SDK for JavaScript (v2) into maintenance mode in 2023.

Please migrate your code to use AWS SDK for JavaScript (v3).
For more information, check the migration guide at https://a.co/7PzMCcy
(Use `node --trace-warnings ...` to show where the warning was created)

Use Case

There is a warning message when we use aws-actions/configure-aws-credentials@v1-node16 in GitHub Actions workflow.

Proposed Solution

Migrate configure-aws-credentials to use AWS SDK for JavaScript (v3)

Other Information

No response

Acknowledgements

I may be able to implement this feature request
This feature might incur a breaking change

The text was updated successfully, but these errors were encountered:

rjminchuk · 2023-03-02T17:41:05Z

seeing this as well

povisenko · 2023-03-02T22:01:39Z

+1
aws-actions/configure-aws-credentials@v1-node16

ngb7h · 2023-03-03T13:19:39Z

We're also using aws-actions/configure-aws-credentials@v1-node16, same warning.

kellertk · 2023-03-06T23:41:01Z

The JS v3 SDK no longer supports exporting a global credential object, which is used by our action. A major rewrite of the action and our tests is needed to support v3. This is in progress and will coincide with a v3 release of this action :)

mfn · 2023-03-22T14:45:54Z

I can't (yet?) confirm any problems from my side, I'm using this action in 30+ workflows and they work; only the message is shown:

Run aws-actions/configure-aws-credentials@v2
  with:
    aws-access-key-id: ***
    aws-secret-access-key: ***
    aws-region: eu-central-1
    audience: sts.amazonaws.com
(node:2126) NOTE: We are formalizing our plans to enter AWS SDK for JavaScript (v2) into maintenance mode in 2023.

Please migrate your code to use AWS SDK for JavaScript (v3).
For more information, check the migration guide at https://a.co/7PzMCcy
(Use `node --trace-warnings ...` to show where the warning was created)

This is from an hour ago.

AndrewReid-Journey · 2023-03-24T10:45:10Z

It seems like they finally dropped the support for this after the deprecation.

Without any changes, it stopped working just in a matter of a few days, now we get this:
Please migrate your code to use AWS SDK for JavaScript (v3).
For more information, check the migration guide at https://a.co/7PzMCcy
(Use `node --trace-warnings ...` to show where the warning was created)
Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers```

Interestingly, i'm having the exact same issue as you in some of my workflows now. Weirdly I have some workflows which still run OK (albeit showing the warning message about the maintenance mode plans for 2023) but others where this step is failing now. The only differences I can see between these workflows is that the failing ones are declared to run in a container where as the others are not. I wonder if this is the same scenario in your case?

Artur-Oliveira-Jesus · 2023-04-14T14:27:13Z

there is another way to configure credencials? because i'm having the same problem...

aborza-c · 2023-04-21T04:38:42Z

The JS v3 SDK no longer supports exporting a global credential object, which is used by our action. A major rewrite of the action and our tests is needed to support v3. This is in progress and will coincide with a v3 release of this action :)

Is this only an issue with setting up credentials directly? What about using OIDC, is that also affected?

mchittineni · 2023-04-21T11:43:54Z

Hi facing similar issue, when trying to load AWS Credentials(v2) via OIDC
Run aws-actions/configure-aws-credentials@v2
with:
role-to-assume: arn:aws:iam:xxxxxxxx:role/xxxxx
aws-region: eu-west-2
audience: sts.amazonaws.com
NOTE: We are formalizing our plans to enter AWS SDK for JavaScript (v2) into maintenance mode in 2023.

Please migrate your code to use AWS SDK for JavaScript (v3).
For more information, check the migration guide at https://a.co/7PzMCcy
(Use node --trace-warnings ... to show where the warning was created)
Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

kkurczewski · 2023-04-21T13:23:29Z

@mchittineni, this issue is only about removing unaesthetic warning, error you got is not related/caused by this warning. Your error states:

Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

So most likely you are passing wrong or missing role/region/other param.

mchittineni · 2023-04-21T13:29:21Z

@kkurczewski sorry after making the comment i realised my mistake, when i add the permissions

https://github.com/aws-actions/configure-aws-credentials#:~:text=OIDC%20Token%20endpoint.-,permissions%3A,-id%2Dtoken%3A

the error got changed into a warning and still showing as mentioned below.

Run aws-actions/configure-aws-credentials@v2
with:
role-to-assume: arn:aws:iam:xxxxxxxx:role/xxxxx
aws-region: eu-west-2
audience: sts.amazonaws.com
NOTE: We are formalizing our plans to enter AWS SDK for JavaScript (v2) into maintenance mode in 2023.

Please migrate your code to use AWS SDK for JavaScript (v3).
For more information, check the migration guide at https://a.co/7PzMCcy
(Use node --trace-warnings ... to show where the warning was created)

andreyFernandoSoares · 2023-05-26T01:23:02Z

require('aws-sdk/lib/maintenance_mode_message').suppress = true;

akshit-speed · 2023-06-20T11:51:46Z

Is there any update for same ? Due to this we are starting to seen some of the workflows are failing randomly while configuring aws credentials step.

jensenbox · 2023-06-27T20:25:05Z

Happened 2 times in the last 7 days for us. Is there an update on when this will be resolved?

omegion · 2023-06-28T07:40:33Z

Same here, it's happening quite often today.

dacahill7 · 2023-06-28T14:57:46Z

I was thinking this was my issue, but it turns out I was running into this:
https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/

Adding to the thread since others might be hitting the same problem, even tho its not directly related.

gscho · 2023-06-28T17:28:29Z

When I follow the instructions in the blog post things work. But I don't understand where they are getting the 1c58a3a8518e8759bf075b76b750d4f2df264fcd thumbprint from. I get these two from token.actions.githubusercontent.com

6938fd4d98bab03faadb97b34396831e3780aea1
f879abce0008e4eb126e0097e46620f5aaae26ad

Where does this thumbprint in the blog post come from?

danopia · 2023-06-29T07:48:10Z

Where does this thumbprint in the blog post come from?

For some context, here's the certificate chain that I see for GHA in Google Chrome:

I believe that you are looking at the last certificate (Github's cert), but for AWS OIDC you generally want the first intermediate, which is the second certificate in the list. This is because the first certificate can't be used and the last certificate is renewed at least annually:

Subject	SHA-1	Lifespan	Usage with AWS OIDC
DigiCert Global Root CA	a8985d3a...	25 years	❌ Thumbprint won't be recognized
DigiCert TLS RSA SHA256 2020 CA1	1c58a3a8...	10 years	✅ Recognized & infrequent rotation
*.actions.githubusercontent.com	f879abce...	~1.3 years	😕 Needs regular rotation

Note that this is all a relic of AWS OIDC being paranoid enough to not use the trusted CA list maintained by OSs and browsers. I'd love to see a "Internet root trust store" option from AWS so we can stop worrying about rotating fingerprints 🤷🏻

kellertk · 2023-06-29T15:43:00Z

Hello everyone, the error that you're seeing related to thumbprints and certificates is not related to JavaScript v3. This is a tracking issue for the v3 migration, which we already have in progress. We work extremely closely with the JavaScript SDK team and migrating this action to the new version will happen before the SDK is fully deprecated. For any discussion related to certificate thumbprints, please see #357.

kellertk · 2023-06-29T15:43:56Z

Just to confirm, the warning you're seeing as a result of the v2 SDK being used is merely cosmetic at this time.

Blunderchips · 2023-07-10T12:12:40Z

Our pipeline started failing this morning with something related to this. Not getting a warning but a failed job. Is there a work around for this issue?

peterwoodworth · 2023-07-10T17:28:42Z

The error is not due to the SDK version, but something else. The message you see there is just a warning unrelated to the error.

Please open up another issue with the details of your workflow @Blunderchips

Blunderchips · 2023-07-10T17:31:15Z

The error is not due to the SDK version, but something else. The message you see there is just a warning unrelated to the error.

Please open up another issue with the details of your workflow @Blunderchips

Ok, will do it when I get a chance. Stopped working over the weekend with no changes our side.

snusmu · 2023-07-11T15:29:37Z

i get exact same issue as Blunderchips when trying to setup this github action for the first time, with a very basic workflow

Blunderchips · 2023-07-11T16:22:10Z

i get exact same issue as Blunderchips when trying to setup this github action for the first time, with a very basic workflow

Yes, same error. It worked on the Friday then not on the Monday. Of course, our keys are defined and are still valid.

c-ameron · 2023-07-25T19:00:55Z

The JS v3 SDK no longer supports exporting a global credential object, which is used by our action. A major rewrite of the action and our tests is needed to support v3. This is in progress and will coincide with a v3 release of this action :)

Thanks for the info @kellertk . Do you have an ETA of when this will be released? And will this include the other aws actions (ie amazon-ecs-deploy-task-definition)?

DanielMcAssey · 2023-07-26T16:25:21Z

Same here, worked on Friday, stopped working on Monday, nothing changed on our pipeline or AWS

flo-hame · 2023-08-14T18:00:57Z

I faced the same errors. Adding following to the top of my deployment.yaml fixed it:

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read  # This is required for actions/checkout

kellertk · 2023-08-23T23:41:19Z

Closed by #791

github-actions · 2023-08-23T23:41:41Z

** Note **
Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

GeorgeDavis-TriumphTech added feature-request A feature should be added or improved. needs-triage This issue still needs to be triaged labels Mar 1, 2023

kellertk added next-major-version This issue will be fixed/implemented in the next major version and removed needs-triage This issue still needs to be triaged labels Mar 6, 2023

This comment was marked as off-topic.

Sign in to view

BenSNews mentioned this issue Mar 29, 2023

Sync upstream 2023-03 fsa-streamotion/configure-aws-credentials#5

Merged

This comment was marked as resolved.

Sign in to view

nikkocampbell mentioned this issue Apr 11, 2023

MET-1295 - Check/update configure-aws-credentials action in GH Workflows Metrist-Software/orchestrator#191

Merged

3 tasks

koleror mentioned this issue Apr 28, 2023

Upgrade to AWS SDK v3 #717

Closed

2 tasks

gruzewski mentioned this issue May 2, 2023

[PLA-150][internal] Switch Github Action to use AWS role v7labs/darwin-py#584

Merged

st-Wook mentioned this issue May 15, 2023

Update GitHub actions 4ian/GDevelop#5279

Merged

snusmu mentioned this issue Jul 11, 2023

Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers #770

Closed

zukizukizuki mentioned this issue Jul 27, 2023

ci作成(github actions) zukizukizuki/aws-terraform#1

Closed

kellertk closed this as completed Aug 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate configure-aws-credentials to use AWS SDK for JavaScript (v3) #680

Migrate configure-aws-credentials to use AWS SDK for JavaScript (v3) #680

GeorgeDavis-TriumphTech commented Mar 1, 2023

rjminchuk commented Mar 2, 2023

povisenko commented Mar 2, 2023

ngb7h commented Mar 3, 2023

kellertk commented Mar 6, 2023

This comment was marked as off-topic.

mfn commented Mar 22, 2023

This comment was marked as off-topic.

AndrewReid-Journey commented Mar 24, 2023

This comment was marked as off-topic.

This comment was marked as resolved.

Artur-Oliveira-Jesus commented Apr 14, 2023 •

edited

Loading

aborza-c commented Apr 21, 2023

mchittineni commented Apr 21, 2023 •

edited

Loading

kkurczewski commented Apr 21, 2023

mchittineni commented Apr 21, 2023 •

edited

Loading

andreyFernandoSoares commented May 26, 2023

akshit-speed commented Jun 20, 2023

jensenbox commented Jun 27, 2023

omegion commented Jun 28, 2023

dacahill7 commented Jun 28, 2023

gscho commented Jun 28, 2023 •

edited

Loading

danopia commented Jun 29, 2023 •

edited

Loading

kellertk commented Jun 29, 2023

kellertk commented Jun 29, 2023

Blunderchips commented Jul 10, 2023

peterwoodworth commented Jul 10, 2023

Blunderchips commented Jul 10, 2023

snusmu commented Jul 11, 2023

Blunderchips commented Jul 11, 2023

c-ameron commented Jul 25, 2023

DanielMcAssey commented Jul 26, 2023

flo-hame commented Aug 14, 2023 •

edited

Loading

kellertk commented Aug 23, 2023

github-actions bot commented Aug 23, 2023

Migrate configure-aws-credentials to use AWS SDK for JavaScript (v3) #680

Migrate configure-aws-credentials to use AWS SDK for JavaScript (v3) #680

Comments

GeorgeDavis-TriumphTech commented Mar 1, 2023

Describe the feature

Use Case

Proposed Solution

Other Information

Acknowledgements

rjminchuk commented Mar 2, 2023

povisenko commented Mar 2, 2023

ngb7h commented Mar 3, 2023

kellertk commented Mar 6, 2023

This comment was marked as off-topic.

mfn commented Mar 22, 2023

This comment was marked as off-topic.

AndrewReid-Journey commented Mar 24, 2023

This comment was marked as off-topic.

This comment was marked as resolved.

Artur-Oliveira-Jesus commented Apr 14, 2023 • edited Loading

aborza-c commented Apr 21, 2023

mchittineni commented Apr 21, 2023 • edited Loading

kkurczewski commented Apr 21, 2023

mchittineni commented Apr 21, 2023 • edited Loading

andreyFernandoSoares commented May 26, 2023

akshit-speed commented Jun 20, 2023

jensenbox commented Jun 27, 2023

omegion commented Jun 28, 2023

dacahill7 commented Jun 28, 2023

gscho commented Jun 28, 2023 • edited Loading

danopia commented Jun 29, 2023 • edited Loading

kellertk commented Jun 29, 2023

kellertk commented Jun 29, 2023

Blunderchips commented Jul 10, 2023

peterwoodworth commented Jul 10, 2023

Blunderchips commented Jul 10, 2023

snusmu commented Jul 11, 2023

Blunderchips commented Jul 11, 2023

c-ameron commented Jul 25, 2023

DanielMcAssey commented Jul 26, 2023

flo-hame commented Aug 14, 2023 • edited Loading

kellertk commented Aug 23, 2023

github-actions bot commented Aug 23, 2023

Artur-Oliveira-Jesus commented Apr 14, 2023 •

edited

Loading

mchittineni commented Apr 21, 2023 •

edited

Loading

mchittineni commented Apr 21, 2023 •

edited

Loading

gscho commented Jun 28, 2023 •

edited

Loading

danopia commented Jun 29, 2023 •

edited

Loading

flo-hame commented Aug 14, 2023 •

edited

Loading