feat: add support for assuming a role #17
Conversation
|
Something's wrong, I assume with the mock, but I'm not sure what.. digging more, but putting this up in case this is obvious to others. |
mattsb42-aws
changed the title
|
This LGTM. |
action.yml
Outdated
| @@ -19,6 +19,12 @@ inputs: | |||
| mask-aws-account-id: | |||
| description: "Whether to set the AWS account ID for these credentials as a secret value, so that it is masked in logs. Valid values are 'true' and 'false'. Defaults to true" | |||
| required: false | |||
| role-to-assume: | |||
| description: "Use the provided credentials to assume a role rather than persisting the credentials directly" | |||
There was a problem hiding this comment.
What do you mean by persisting the credentials directly? I associate that with persisting to disk. Do you mean something like using the credentials for API calls directly?
There was a problem hiding this comment.
What I meant by "persisting" was "passing the values along to later steps via outputs".
Maybe
Use the provided credentials to assume a Role and output the assumed credentials for that Role rather than the provided credentials. ?
index.js
Outdated
| } | ||
| catch (error) { | ||
| core.setFailed(error.message); | ||
|
|
||
| const suppressStackTrace = process.env.DO_NOT_SUPPRESS_STACK_TRACE; |
There was a problem hiding this comment.
Nit: the variable name seems opposite to the env variable name: doNotSuppressStackTrace?
|
Thanks for the contribution! FYI I'm working on some automation for cutting the releases of this action; until then |
Description of changes:
As a security-conscious developer, long-lived credentials make me nervous, especially when I do not have a mechanism for an automated actor to change or delete them. Ideally, I would like to constantly refresh the GitHub Secrets that hold my AWS credentials with constantly rotating, short-lived, IAM Role credentials. Unfortunately, until GitHub adds an API for Secrets I cannot do that.
As a halfway measure, I would like to be able to set long-lived credentials in my GitHub Secrets that only have the permissions to assume short-lived credentials with wider permissions. The purpose of this PR is to enable this use-case.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.