Comments (5)
I could be mistaken, so @mr-smithers-excellent will have to correct me if my observations are incorrect, but the way the action is written does not have any specific requirement on the AWS authentication method used. It is simply making the AWS CLI call to ecr get-login-password
using the environment variables provided. I have not tested, but I believe you could simply add the following early enough in your workflow:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: ${{ secrets.AWS_REGION }}
The aws-actions/configure-aws-credentials
action would set the appropriate STS session environment variables (AWS_ACCESS_KEY_ID
, AWS_SECRET_ACCESS_KEY
& AWS_SESSION_TOKEN
). I use this method with other actions but haven't yet tried it with this one.
Alternatively you might be able to just set the AWS_ROLE_ARN
and AWS_ROLE_SESSION_NAME
env variables though I haven't tried that either myself but they are documented environment variables for the CLI.
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
from docker-build-push.
@jbouse - I believe this should be the case, but have not tested it personally. If it does not work, I'd certainly consider it to be a bug with this workflow and could mitigate.
@Udomomo - can you try the approach detailed above and see if you're able to push to your ECR with the IAM role setup in the previous step?
from docker-build-push.
After a bit more research, it looks like you will additionally need a web identity token file to authenticate. So the resulting prerequisite action would look something like this:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: ${{ secrets.AWS_REGION }}
web-identity-token-file: ${{ secrets.AWS_TOKEN_FILE }}
@Udomomo - is this the approach you are targeting?
from docker-build-push.
After a bit more research, it looks like you will additionally need a web identity token file to authenticate. So the resulting prerequisite action would look something like this:
- name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v1 with: role-to-assume: ${{ secrets.AWS_IAM_ROLE }} aws-region: ${{ secrets.AWS_REGION }} web-identity-token-file: ${{ secrets.AWS_TOKEN_FILE }}
I use Github OIDC to authenticate with AWS and do not include the web-identity-token-file
option. The example I gave above was from my own configuration minus the optional session length. The web-identity-token-file
would most likely need to be used if not attempting to use Github OIDC.
I use the following:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
with:
role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/${{ env.AWS_ROLE_NAME }}
role-duration-seconds: 1200
aws-region: ${{ env.AWS_REGION }}
I use the env.
prefix rather than secrets.
because I have an earlier stage that is getting details out of my Hashicorp Vault and those values get stored as environment variables (still masked for security in logs).
from docker-build-push.
@Udomomo - this should be an available auth mechanism using this action as detailed above. Be sure you are referencing the latest version using the below syntax. Feel free to re-open this issue if you have further problems.
- uses: mr-smithers-excellent/docker-build-push@v5
or
- uses: mr-smithers-excellent/[email protected]
from docker-build-push.
Related Issues (20)
- Set output warning when running this action HOT 7
- Github action Error: Dockerfile does not exist in location Dockerfile HOT 8
- Build The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. HOT 7
- Docker Push without build HOT 2
- Support for pull_request event
- Support for pull_request event HOT 6
- Output image SHA256 digest(s) HOT 4
- ERROR: failed to solve: Internal: header key "exclude-patterns" contains value with non-printable ASCII characters HOT 3
- Why is my organization's name a secret? HOT 1
- How do I find the correct registry and image name to use? HOT 2
- Any plan to support Azure Container Registries? HOT 4
- Exit Code 1 after pushing latest tag HOT 1
- Is it possible to cache node_modules that were installed in Dockerfile? HOT 1
- "Node.js 16 actions are deprecated" warning HOT 1
- Action fails pipeline if credentials are not supplied HOT 9
- Not working with Artifact Registry HOT 2
- Conditionally Setting `addLatest` does not work for truthy values HOT 1
- Why is there no switch to set whether to push all tags? HOT 4
- Input multiPlatform is set to true, skipping Docker push step HOT 2
- How to push latest tag only upon releases HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from docker-build-push.