Skip to content

Support setting AWS_ROLE_ARN via env var for aws-cli/setup #237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bobziuchkovski wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Support setting AWS_ROLE_ARN via env var for aws-cli/setup #237

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
35d17d6
support setting AWS_ROLE_ARN via env var for aws-cli/setup
bobziuchkovski Sep 19, 2025
004e218
be more explicit about the new behavior of role_arn/$AWS_ROLE_ARN
bobziuchkovski Sep 19, 2025
c9af894
add disable_oidc param as an explicit means of skipping oidc auth
bobziuchkovski Sep 19, 2025
4bacecf
add explicit check for empty string in parameters.role_arn
bobziuchkovski Sep 24, 2025
b83fd46
don't attempt role assumption unless role arn is provided
bobziuchkovski Sep 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 13 additions & 4 deletions src/commands/setup.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
description: |
Installs aws-cli and then configure and store AWS credentials in
~/.aws/credentials and ~/.aws/config.
If role_session_name and role_arn are provided, it will attempt to use OIDC auth.
If role_arn is set, either explicitly or by the value of $AWS_ROLE_ARN, this command will attempt to use OIDC

@bobziuchkovski bobziuchkovski Sep 19, 2025

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I dropped the reference to role_session_name here because it's being provided by default already (default value is $CIRCLE_JOB with unsupported chars replaced and truncated to 64 chars)

auth. If you're providing $AWS_ROLE_ARN but don't want to use OIDC auth, set disable_oidc to true.

parameters:
version:
Expand Down Expand Up @@ -77,9 +78,10 @@ parameters:
role_arn:
description: |
The Amazon Resource Name (ARN) of the role that the caller is assuming.
Role ARN must be configured for web identity.
Role ARN must be configured for web identity / OIDC auth.
(defaults to env var of ${AWS_ROLE_ARN})
type: string
default: ""
default: ${AWS_ROLE_ARN}

role_session_name:
description: An identifier for the assumed role session
Expand Down Expand Up @@ -112,6 +114,13 @@ parameters:
description: |
Set to true if you want to disable the AWS CLI install step. Default to false.

disable_oidc:
type: boolean
default: false
description: |
Set to true if you want don't want to use OIDC auth but are setting $AWS_ROLE_ARN. This command will otherwise
attempt to use OIDC auth if $AWS_ROLE_ARN is set.

when:
description: |
Allows script to run on a specific condition of a workflow.
Expand Down Expand Up @@ -139,7 +148,7 @@ steps:
condition:
and:
- <<parameters.role_session_name>>
- <<parameters.role_arn>>
- not: <<parameters.disable_oidc>>
steps:
- run:
name: Assume Role with Web Identity
Expand Down
5 changes: 5 additions & 0 deletions src/scripts/assume_role_with_web_identity.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,11 @@ AWS_CLI_BOOL_SET_AWS_ENV_VARS="$(echo "${AWS_CLI_BOOL_SET_AWS_ENV_VARS}" | circl
AWS_CLI_STR_ROLE_SESSION_NAME=$(printf '%s' "${AWS_CLI_STR_ROLE_SESSION_NAME}" | tr -sC 'A-Za-z0-9=,.@_\-' '-')
AWS_CLI_STR_ROLE_SESSION_NAME=$(echo "${AWS_CLI_STR_ROLE_SESSION_NAME}" | cut -c -64)

if [ -z "${AWS_CLI_STR_ROLE_ARN}" ]; then
echo "Role ARN is not specified. Skipping assume role with web identity."
exit 0
fi

if [ -z "${AWS_CLI_STR_ROLE_SESSION_NAME}" ]; then
echo "Role session name is required"
exit 1
Expand Down