Configure AWS Credentials

Authenticate to AWS in GitHub Actions (and others)! Works especially well with AWS Secrets Manager.

Quick Start (OIDC, recommended)

1. Create an IAM Identity Provider in your AWS account for GitHub OIDC. (See OIDC configuration below for details.)
2. Create an IAM Role in your AWS account with a trust policy that allows GitHub Actions to assume it. (Expand the sections below)

GitHub OIDC Trust Policy

json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com", "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>" } } } ] }

Note: if you are running in a GitHub environment based workflow, the value for the Sub claim will be different, in the form of repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:environment:<ENVIRONMENT_NAME>. Adjust the trust policy accordingly if you are using environment-based workflows.

1. Attach permissions to the IAM Role that allow it to access the AWS resources you need.
2. Add the following to your GitHub Actions workflow:

Example Workflow

yaml # Need ID token write permission to use OIDC permissions: id-token: write jobs: run_job_with_aws: runs-on: ubuntu-latest steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v6.1.0 with: role-to-assume: <Role ARN you created in step 2> aws-region: <AWS Region you want to use> - name: Additional steps run: | # Your commands that require AWS credentials aws sts get-caller-identity

That's it! Your GitHub Actions workflow can now access AWS resources using the IAM Role you created. Other authentication scenarios are also supported (see below).

Security Recommendations

• Use temporary credentials when possible. OIDC is recommended because it provides temporary credentials and it's easy to set up.
• Do not store credentials in your repository's code. Consider using git-secrets to prevent committing secrets to your repository.
• Grant least privilege to your workflows. Grant only those permissions that are necessary for the workflow to run.
• Monitor the activity of the credentials used in workflows.
• Periodically rotate any long-lived credentials that you use.
• Store sensitive information in a secure way, such as using AWS Secrets Manager or GitHub Secrets.
• Be especially careful about running Actions in non-ephemeral environments, or triggering workflows on pull_request_target events.

Non-OIDC Authentication Options

This action supports five different authentication methods that are configured by specifying different inputs.

1. Use a core.getIDToken() call to authenticate via OIDC.
2. Re-export existing long-lived IAM credentials (access key ID and secret access key) as environment variables.
3. Use static credentials stored in GitHub Secrets to fetch temporary credentials via STS AssumeRole.
4. Use a Web Identity Token to fetch temporary credentials via STS AssumeRoleWithWebIdentity.
5. Use credentials stored in the Action environment to fetch temporary credentials via STS AssumeRole.

Because we use the AWS JavaScript SDK, we always will use the credential resolution flow for Node.js.

Depending on your inputs, the action might override parts of this flow.

Inputs and their effects on the credential resolution flow

Note: role-chaining is not always necessary to use existing credentials. If you're getting a "Credentials loaded by the SDK do not match" error, try enabling this option.

Additionally, aws-region is always required.

Note: If you use GitHub Enterprise Server, you may need to adjust examples here to match your environment.

Additional Options

Options

The options list can be expanded below. See action.yml for more detail.

Options list and descriptions