Skip to content

Option output-env-credentials: false fails on self-hosted runner with instance profile #1554

@glostis-prl

Description

@glostis-prl

Describe the bug

I am running the action with the following options:

      - name: Configure AWS credentials
        id: setup-aws-creds
        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
        with:
          aws-region: eu-west-1
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          output-credentials: true
          output-env-credentials: false

The workflow is run on a self-hosted Github runner that already has an AWS instance profile set.

The goal of the step is to assume a different role from the one provided by the instance profile and use the generated temporary credentials through the step's outputs (output-credentials: true). We disable the output to the environment (output-env-credentials: false) in order to prevent the AWS instance profile from being shadowed by the assumed role, because we use this instance profile in other steps.

Regression Issue

  • Select this option if this issue appears to be a regression.

Expected Behavior

The step runs successfully and only populates the Github output, no other side-effects.

Current Behavior

The step throws the following error:

Error: Credentials loaded by the SDK do not match the expected access key ID configured by the action

Reproduction Steps

Run the action with the options above on a self-hosted runner with an AWR instance profile already set.

Possible Solution

No response

Additional Information/Context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingp2

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions