-
Notifications
You must be signed in to change notification settings - Fork 521
Open
Labels
bugSomething isn't workingSomething isn't workingneeds-triageThis issue still needs to be triagedThis issue still needs to be triaged
Description
Describe the bug
The example of credentials-chaining in the current README doesn't work as-is. If I add role-skip-session-tagging: true
it works, but not sure why.
Regression Issue
- Select this option if this issue appears to be a regression.
Expected Behavior
Secondary role is assumed
Current Behavior
Secondary role fails to assume.
Reproduction Steps
This workflow fails to assume the second role
name: Test AWS AssumeRole Chaining
on:
push:
permissions:
id-token: write
contents: read
jobs:
test-assume-role-chaining:
runs-on: ubuntu-latest
steps:
- name: Configure AWS Credentials
uses: aws-actions/[email protected]
with:
aws-region: us-west-2
role-to-assume: arn:aws:iam::111111111111:role/MyOIDCRole
role-session-name: MySessionName
- name: Configure other AWS Credentials
uses: aws-actions/[email protected]
with:
aws-region: us-west-2
role-to-assume: arn:aws:iam::222222222222:role/MyOtherRole
role-session-name: MySessionName
role-chaining: true
- name: Test Credentials
run: aws sts get-caller-identity
Possible Solution
This workflow correctly assumes the second role now that I have added role-skip-session-tagging: true
. I have no idea why this particular setting matters, I discovered it while comparing to another working example from v1
name: Test AWS AssumeRole Chaining
on:
push:
permissions:
id-token: write
contents: read
jobs:
test-assume-role-chaining:
runs-on: ubuntu-latest
steps:
- name: Configure AWS Credentials
uses: aws-actions/[email protected]
with:
aws-region: us-west-2
role-to-assume: arn:aws:iam::111111111111:role/MyOIDCRole
role-session-name: MySessionName
- name: Configure other AWS Credentials
uses: aws-actions/[email protected]
with:
aws-region: us-west-2
role-to-assume: arn:aws:iam::222222222222:role/MyOtherRole
role-session-name: MySessionName
role-chaining: true
role-skip-session-tagging: true
- name: Test Credentials
run: aws sts get-caller-identity
Additional Information/Context
the README example uses v4.1.0, the behavior in current v4.2.1 is identical
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workingneeds-triageThis issue still needs to be triagedThis issue still needs to be triaged