feat: add `drop-current-credentials` and `role-output-credentials` #325

blz-ea · 2021-12-04T17:07:30Z

Fixes #236, fixes #379

Description:

Add drop-current-credentials input which when set to true removes AWS credentials prior to assuming the role.
Useful when you need to assume multiple roles, based on the original role that was attached to EC2
Add role-output-credentials input which when set to true outputs credentials instead of adding them to environment. Credentials can be referenced in the later steps. This solves certain security problem, and assume multiple roles without adding them to environment

    - name: Configure AWS credentials
      id: aws
      uses: aws-actions/configure-aws-credentials
      with:
        role-to-assume: arn:aws:iam::1234567890:role/my-role
        aws-region: us-east-1
        role-output-credentials: true

    - name: Identity
      env:
        AWS_REGION: '${{ steps.aws.outputs.aws-region }}'
        AWS_DEFAULT_REGION: '${{ steps.aws.outputs.aws-default-region }}'
        AWS_ACCESS_KEY_ID: '${{ steps.aws.outputs.aws-access-key-id }}'
        AWS_SECRET_ACCESS_KEY: '${{ steps.aws.outputs.aws-secret-access-key }}'
        AWS_SESSION_TOKEN: '${{ steps.aws.outputs.aws-session-token }}'
      run: |
        aws sts get-caller-identity

Output assumed role's aws-account-id instead of source roles

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

aksel

I think there's a typo.

README.md

kdomanski · 2022-02-20T15:59:59Z

+1 for this. Exporting the env vars by default not only complicates work with multiple profile, but in some cases forces the users to manually clear the variables (by writing empty values to $GITHUB_ENV), because many tools give the env vars precedence over the configuration files.

pragmaticivan · 2022-03-17T13:23:17Z

Howdy! Any progress with that PR? this seems to be breaking composable actions that use that library.

kdomanski · 2022-03-27T22:06:32Z

cc @paragbhingre

pragmaticivan · 2022-03-28T13:36:56Z

cc @clareliguori

xoanmm · 2022-06-06T20:58:54Z

@aksel What is the actual state of this PR? It will be merge in the near future?

byF · 2022-08-11T15:32:21Z

If anyone runs into this:

There is no way how to unset env var in github action runner Allow to unset env variables actions/runner#1126
Setting env vars to empty echo "AWS_ACCESS_KEY_ID=" >> $GITHUB_ENV doesn't work anymore either

This PR is important to make this action usable multiple times per job.

RafPe · 2022-08-16T22:06:27Z

@byF Can u paste the code that does not work for you ? I am still setting up the variables to empty and it works for me

      #TODO: Replace shell drop credentials with GHA
      # Onnce issue https://github.com/aws-actions/configure-aws-credentials/pull/325 is merged - use default action configuration
      - name: reset aws credentials
        shell: bash
        run: |
            echo "AWS_ACCESS_KEY_ID=" >> $GITHUB_ENV
            echo "AWS_SECRET_ACCESS_KEY=" >> $GITHUB_ENV
            echo "AWS_SESSION_TOKEN=" >> $GITHUB_ENV

      - uses: hmarr/debug-action@v2

peterwoodworth

Thanks a ton @blz-ea for this contribution, and many apologies for the long delay between your submission and this review.

Overall this is good work, I've left a few comments that I'd like you to address when you have the opportunity.

However before you address those, I have concern over adding two new and mostly unrelated features in the same PR. I'm going to request that you separate drop-current-credentials functionality from this PR in a new PR and branch. I'll give both this PR and the new one my full attention upon hearing back from you 🙂

peterwoodworth · 2022-10-04T23:06:32Z

README.md

@@ -118,6 +118,28 @@ In this example, the Action will load the OIDC token from the GitHub-provided en
 ```
 In this example, the secret `AWS_ROLE_TO_ASSUME` contains a string like `arn:aws:iam::123456789100:role/my-github-actions-role`.  To assume a role in the same account as the static credentials, you can simply specify the role name, like `role-to-assume: my-github-actions-role`.

+```yaml


We don't need a full example, but I'd like for there to be at least a description of drop-current-credentials in the README with a short explanation on when it would be useful to use

peterwoodworth · 2022-10-04T23:11:38Z

index.js

+
+  for (const e of envs) {
+    core.exportVariable(e, '');
+    delete process.env[e]


The line delete process.env[e] seems redundant to me. core.exportVariable sets these values to empty, why would we need to delete them altogether in the second line?

For reference, here's how exportVariable is implemented under the hood https://github.com/actions/toolkit/blob/b00a9fd033f4b30f2355acd212f531ecbbb9b38f/packages/core/src/core.ts#L83-L93

peterwoodworth · 2022-10-04T23:17:13Z

index.js

@@ -228,14 +253,32 @@ async function validateCredentials(expectedAccessKeyId) {
  }
 }

-function getStsClient(region) {
+function getStsClient(region, credentials) {


I'm unsure what problem this is exactly trying to solve. Why do we need to pass in credentials now?

There are a couple other instances where getStsClient and exportAccountId get called (lines 43 and 382 in your index.js) without being updated to have credentials passed in. Since I'm confused at the necessity for this in the first place, I'm not sure why credentials are only passed on line 418. Could you clear this up for me?

@blz-ea

A reimplementation of @blz-ea's role-output-credentials from aws-actions#325 for the newer v1 aws-credentials provider. Implements output-credentials functionality to support use-cases that do not wish to persist credentials into GHA environment variables (useful when multiple accounts or roles need to be involved). Does NOT re-implement drop-current-credentials as I have no use-case for that. I hope that by a smaller more tactile patch I can get this merged upstream. All credit to @blz-ea, but direct admonitions at me.

@blz-ea

A reimplementation of @blz-ea's role-output-credentials from aws-actions#325 for the newer v1 aws-credentials provider. Implements output-credentials functionality to support use-cases that do not wish to persist credentials into GHA environment variables (useful when multiple accounts or roles need to be involved). Does NOT re-implement drop-current-credentials as I have no use-case for that. I hope that by a smaller more tactile patch I can get this merged upstream. All credit to @blz-ea, but direct admonitions at me.

peterwoodworth · 2023-02-22T02:29:22Z

Apologies for the delay once more, but I'll be closing this due to staleness. Thanks for the contribution

yporwal1 · 2023-07-06T14:04:34Z

Hi @peterwoodworth
Is this merged ?

peterwoodworth · 2023-07-06T20:05:58Z

@yporwal1 this had to get closed because the PR was abandoned, not that it's the submitters fault or anything. This action was in no-mans land for a while in terms of ownership, but the next version of this action should be coming in the near future, and it has this new feature implemented

blz-ea added 10 commits December 3, 2021 23:27

feat: add role-output-credentials

9d53c01

chore: add test, fix readme & input names

d9cb5e1

chore: update dist

93c0045

chore: reset dist

04c81e4

chore: add accountId to assume role response

ed14a03

fix: export correct account-id

15449c4

feat: add drop-credentials

a59e607

fix: typo

c4da4fe

chore: reset dist

b1ae9a8

chore: add test & fix typo

dd14f72

blz-ea marked this pull request as ready for review December 4, 2021 17:08

aksel reviewed Dec 7, 2021

View reviewed changes

README.md Outdated Show resolved Hide resolved

fix: typo

844b033

blz-ea added 2 commits March 18, 2022 11:33

Merge branch 'master' into feature/output-creds

5af6e80

fix: revert retryBackoff from conflict resolution

ff62a38

jim-hill-r mentioned this pull request Aug 8, 2022

Support setting credentials as action outputs instead of setting environment variables #379

Closed

peterwoodworth suggested changes Oct 4, 2022

View reviewed changes

peterwoodworth self-assigned this Oct 5, 2022

bryan-aguilar mentioned this pull request Jan 10, 2023

[release/v0.25.x] reset aws creds in release ssm workflow aws-observability/aws-otel-collector#1752

Merged

jdnurmi mentioned this pull request Feb 14, 2023

Implement role-output-credentials for v1 #659

Closed

peterwoodworth closed this Feb 22, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add `drop-current-credentials` and `role-output-credentials` #325

feat: add `drop-current-credentials` and `role-output-credentials` #325

blz-ea commented Dec 4, 2021 •

edited by peterwoodworth

Loading

aksel left a comment

kdomanski commented Feb 20, 2022

pragmaticivan commented Mar 17, 2022

kdomanski commented Mar 27, 2022

pragmaticivan commented Mar 28, 2022

xoanmm commented Jun 6, 2022 •

edited

Loading

byF commented Aug 11, 2022

RafPe commented Aug 16, 2022

peterwoodworth left a comment

peterwoodworth Oct 4, 2022

peterwoodworth Oct 4, 2022

peterwoodworth Oct 4, 2022

peterwoodworth commented Feb 22, 2023

yporwal1 commented Jul 6, 2023

peterwoodworth commented Jul 6, 2023

feat: add drop-current-credentials and role-output-credentials #325

feat: add drop-current-credentials and role-output-credentials #325

Conversation

blz-ea commented Dec 4, 2021 • edited by peterwoodworth Loading

aksel left a comment

Choose a reason for hiding this comment

kdomanski commented Feb 20, 2022

pragmaticivan commented Mar 17, 2022

kdomanski commented Mar 27, 2022

pragmaticivan commented Mar 28, 2022

xoanmm commented Jun 6, 2022 • edited Loading

byF commented Aug 11, 2022

RafPe commented Aug 16, 2022

peterwoodworth left a comment

Choose a reason for hiding this comment

peterwoodworth Oct 4, 2022

Choose a reason for hiding this comment

peterwoodworth Oct 4, 2022

Choose a reason for hiding this comment

peterwoodworth Oct 4, 2022

Choose a reason for hiding this comment

peterwoodworth commented Feb 22, 2023

yporwal1 commented Jul 6, 2023

peterwoodworth commented Jul 6, 2023

feat: add `drop-current-credentials` and `role-output-credentials` #325

feat: add `drop-current-credentials` and `role-output-credentials` #325

blz-ea commented Dec 4, 2021 •

edited by peterwoodworth

Loading

xoanmm commented Jun 6, 2022 •

edited

Loading