Action overrides AWS env vars for subsequent running action

[nicolaevladescu]

Hi.

I am using aws-actions/configure-aws-credentials@v1 and doing some ECR steps, after which i run a custom action similar to the below code, in which i set some env vars for awscli with different AWS credentials (key_id+secret) than those used with this action.

runs:
  ...
  inputs:
    aws_region:
      required: true
    aws_key:
      required: true
    aws_secret:
      required: true
  env:
    AWS_DEFAULT_REGION: ${{ inputs.aws_region }}
    AWS_ACCESS_KEY_ID: ${{ inputs.aws_key }}
    AWS_SECRET_ACCESS_KEY: ${{ inputs.aws_secret }}
  using: 'docker'
  image: 'docker://example/toolkit:latest'
  args:
    - 'bash'
    - '-c'
    - 'printenv | grep -i aws && aws configure list && aws sts get-caller-identity --output json | jq'

The vars are present both as standalone and those prefixed with INPUT_, but after seeing the output of aws configure list and aws sts get-caller-identity i find out that the credentials are not those i set manually, but those populated by configure-aws-credentials from previous steps.

So my questions are:

• Why do they propagate and take precedence over the ones i set specifically in my custom action?
• How can we reset credentials and vars or do a cleanup after using configure-aws-credentials action?

[clareliguori]

Hi @nicolaevladescu , I don't know the order of precedence that GitHub Actions follows for setting env variables in Docker actions (I can't find it documented anywhere), but it appears that env vars set in the workflow's environment override values in the action's env settings based on what you are seeing. It would be a good question for you to ask in the GitHub Actions forum.

Do you see the same behavior for any kind of environment variable, not just ones set by this action? For example, does "bar" take precedence over both "foo" and "baz" below?

jobs:
  job1:
    env:
      AWS_ACCESS_KEY_ID: "foo"
    steps:
    - run: |
       echo "::set-env name=AWS_ACCESS_KEY_ID::bar"
    - uses: <<your action>>
      with:
        aws_key: "baz"

With respect to resetting the environment variables, individual GitHub Action jobs each have a fresh environment, so you can do:

jobs:
  job1:
    runs-on: ubuntu-latest
    steps:
    - uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-2
  job2:
    runs-on: ubuntu-latest
    steps:
    - uses: <<your action>>
      with:
        aws_key: ${{ secrets.ANOTHER_AWS_ACCESS_KEY_ID }}
        aws_secret: ${{ secrets.ANOTHER_AWS_SECRET_ACCESS_KEY }}
        aws_region: us-east-2

[nicolaevladescu]

Hi.

Thank you for the suggestions, yeah it seems it's out of the control of this action. I will try to find out the precedence from GitHub.

Thanks for the feedback!