Open
Conversation
liyu-ma
requested review from
alyssa1303,
anson627,
sumanthreddy29,
vittoriasalim,
wonderyl and
xinWeiWei24
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the shared AWS login step template to support OIDC/STS-style credentials by propagating and configuring AWS_SESSION_TOKEN, while keeping compatibility with existing static key flows.
Changes:
- Export
AWS_SESSION_TOKENas a secret pipeline variable when present. - Configure AWS CLI to use
aws_session_tokenwhen provided. - Remove the unused step
name.
liyu-ma
changed the title
liyu-ma
changed the title
liyu-ma
force-pushed
the
maliyu/aws-oidc-auth
branch
from
0019c88 to
bf5ba9b
Compare
liyu-ma
force-pushed
the
maliyu/aws-oidc-auth
branch
from
0e05551 to
e641eab
Compare
Export and configure AWS_SESSION_TOKEN in login.yml to support OIDC-based credentials which return temporary session tokens. Conditional guards ensure backward compatibility with static keys. Also remove step name to avoid duplicate name errors when login is called multiple times in a pipeline.
Add validation to treat unresolved $(AWS_SESSION_TOKEN) literals as empty, and unset aws_session_token when not applicable to prevent stale tokens from persisting on self-hosted agents.
Remove unnecessary literal-string check in AWSShellScript step where env vars are always real. Add explanatory comment for the literal check in the bash step, and a log line when unsetting stale tokens.
Replace 'aws configure unset' with 'aws configure set ... ""' for compatibility with AWS CLI v1 which lacks the unset subcommand.
Log when ADO passes unresolved literal, when a real session token is found (with first 4 chars), and when no token is present.
Remove the else branch that set aws_session_token to empty string, which caused AWS CLI to send an empty token in API calls. Now simply skip session token configuration when not available.
When service_connection is used without OIDC, step 1 does not set AWS_SESSION_TOKEN. ADO then passes the literal string '$(AWS_SESSION_TOKEN)' to step 2's env block, which would incorrectly configure aws_session_token.
… script ADO performs macro expansion on $(...) patterns in script bodies, even inside single quotes. Split the literal string construction so ADO doesn't recognize the pattern.
liyu-ma
force-pushed
the
maliyu/aws-oidc-auth
branch
from
c9c1e4b to
18ecf79
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
login.ymlsupports two configuration of credential: service_connection and variable_group. OIDC token requires service connection and three parameters: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKENChange
Get login credentialsstep. Note that this step is not run at internal pipelines as they usevariable_groupcredential type.AWS Loginstep, and use it to configure aws cliaws_session_tokenAWS_SESSIONenv var will default to literal '$(AWS_SESSION_TOKEN)' when the var is not set (indicating this is not OIDC auth). Need to clear this literal value because it is invalid and will fail pipeline