Ability to log out?

[ofx-cezar-gradinariu]

I have a scenario where I would like to have the capability to re-run the "configure-aws-credentials" action again using the same account but different roles inside the same job.

Is there a way to log out/reset/forget the credentials of the first run? My current option is to revert to bash and that is pretty verbose.

Thank you

[clareliguori]

Hi @ofx-cezar-gradinariu, you can re-run the action multiple times in your workflow file, and the action will overwrite the previous credentials each time.

jobs:
  deploy:
    name: Upload to Amazon S3
    runs-on: ubuntu-latest

    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - name: Configure AWS credentials from Test account
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.TEST_AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.TEST_AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Copy files to the test website with the AWS CLI
      run: |
        aws s3 sync . s3://my-s3-test-website-bucket

    - name: Configure AWS credentials from Production account
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.PROD_AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }}
        aws-region: us-west-2

    - name: Copy files to the production website with the AWS CLI
      run: |
        aws s3 sync . s3://my-s3-prod-website-bucket

[ofx-cezar-gradinariu]

Thank you @clareliguori . If you have them auth in different regions it probably works. But in my case, the region is the same.

[clareliguori]

@ofx-cezar-gradinariu that's fine, it's the same idea that you run the action again with different credential secrets (TEST vs PROD in the example) Are you seeing that re-running the action with different credentials does not work?

    - name: Configure AWS credentials from Test account
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.TEST_AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.TEST_AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Copy files to the test website with the AWS CLI
      run: |
        aws s3 sync . s3://my-s3-test-website-bucket

    - name: Configure AWS credentials from Production account
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.PROD_AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Copy files to the production website with the AWS CLI
      run: |
        aws s3 sync . s3://my-s3-prod-website-bucket

[pioneer2k]

Hi @clareliguori,
as @ofx-cezar-gradinariu we are also assuming roles in different accounts in the same region. If we login again with the same user, but to a diffrent role in a different account, we get an error message like this:

##[error]User: arn:aws:sts::***:assumed-role/TerraformInfrastructureRole/InfrastructureSession is not authorized to perform: sts:TagSession on resource: ***

The role, that here is talked about, is the role from our first login. So it seems that the second login is using some information of the first login.

This is our example:

- name: Configure AWS credentials for AWS infrastructure account
  id: awscredentialsinfra
  uses: aws-actions/[email protected]
  with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      aws-session-token: ''
      aws-region: eu-central-1
      role-to-assume: ${{ secrets.INFRASTRUCTURE_ROLE }}
      role-duration-seconds: 3600
      role-session-name: InfrastructureSession

- name: Configure AWS credentials for AWS DEV and QA account
  uses: aws-actions/[email protected]
  with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      aws-session-token: ''
      aws-region: eu-central-1
      role-to-assume: ${{ secrets.DEV_AND_TEST_ROLE }}
      role-duration-seconds: 3600
      role-session-name: DEVAndQASession

[clareliguori]

Ah thank you for the example @pioneer2k ! I'll work on repro'ing this