-
Notifications
You must be signed in to change notification settings - Fork 464
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Assuming two roles in the same in composite action can't override previous step credential #307
Comments
unsetting these vars works...
|
@ZacharyBenamram Interesting. I've try reset env on action(s Configure AWS Credentials, but no luck. name: aws oidc auth
description: |
Get aws oidc auth.
inputs:
role-to-assume:
description: "AWS IAM Role to assume 1"
required: true
runs:
using: "composite" # this is key point
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@master
with:
aws-region: ap-northeast-1
role-to-assume: ${{ inputs.role-to-assume }}
role-session-name: GitHubActions-${{ github.run_id }}
env:
AWS_ACCESS_KEY_ID: ""
AWS_SECRET_ACCESS_KEY: ""
AWS_SESSION_TOKEN: ""
AWS_DEFAULT_REGION: ""
AWS_REGION: ""
- name: get-caller-identity is allowed to run on role.
run: aws sts get-caller-identity
shell: bash 2nd Configure AWS Credentials is not updated. (same as 1st run's role) |
this seems to be caused by this underlying issue: actions/runner#789 |
Has anyone found a workaround/fix for that one? |
I would love for this issue to be fixed, or the underlying one. And I'm also curious about potential workarounds |
This was probably suggested multiple times over multiple issues, but why not set creds as This would provide a workaround for the actions/runner#789 and seems to be a good practice anyway, as it does not pollute whole job's env. |
For anyone still looking for workaround you can find a temporary fix described here #236 (comment) |
I'm standing on the shoulders of giants with this, but here is something that I whipped up to meet my use case: https://github.com/marketplace/actions/configure-aws-profile |
Really seems like it should be a piece of cake to add an option that skips the call to Force exporting the |
A different combination between enabling Please open up a new issue if you continue to have problems, it seems there are different problems being described in the comments of this issue |
** Note ** |
Summary
If I use configure-aws-credentials in composite action multiple times, it can't override previous credential.
Is it bug or expected behaviour?
Expected behaviour
There are 2 pattern work as expected.
Pattern A
If I call multiple aws-actions/configure-aws-credentials in workflow, it works as expected.
1st get-caller-identity shows myrole_A.
2nd get-caller-identity shows myrole_B.
Pattern B
If I call multiple aws-actions/configure-aws-credentials in composite actions, it works as expected.
1st get-caller-identity shows myrole_A.
2nd get-caller-identity shows myrole_B.
Actual behaviour
Pattern C. If I call composite actions include aws-actions/configure-aws-credentials, then call same composite actions in same job, 2nd call of composite action not override aws credentials.
1st get-caller-identity shows myrole_A.
However, 2nd get-caller-identity also shows myrole_A.
Reproduce step
./.github/actions/aws_oidc_auth_single/action.yaml
The text was updated successfully, but these errors were encountered: