configure-aws-credentials

The recommended way to authenticate to AWS from GitHub Actions is using OpenID Connect (OIDC). This method provides temporary credentials and avoids the need to store long-lived secrets in GitHub.

To set this up:

1. Create an IAM Identity Provider in your AWS account for GitHub OIDC.
2. Create an IAM Role with a trust policy that allows GitHub Actions to assume it. The trust policy must use sts:AssumeRoleWithWebIdentity and include a condition matching your GitHub organization, repository, and branch/environment.
3. Attach Permissions to the IAM Role for the specific AWS resources your workflow needs to access.
4. Configure your Workflow by setting permissions: id-token: write and using the aws-actions/configure-aws-credentials action with role-to-assume and aws-region.

# Need ID token write permission to use OIDC
permissions:
  id-token: write

jobs:
  run_job_with_aws:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6.2.3
        with:
          role-to-assume: <Role ARN you created in step 2>
          aws-region: <AWS Region you want to use>
      - name: Additional steps
        run: |
          # Your commands that require AWS credentials
          aws sts get-caller-identity

When using static IAM User credentials or assuming one role from another while using profiles, you must enable role-chaining: true and provide the previous profile via the AWS_PROFILE environment variable.

Scenario 1: Static credentials to a role using a profile Set role-chaining: true and pass the profile name in the env block.

Scenario 2: Chaining multiple roles When assuming a second role from a first role, the second step must set role-chaining: true and use the first role's profile name in its env block.

# Scenario 1: Static credentials to a role
- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-role
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-profile: MyProfile1
    role-chaining: true
  env:
    AWS_PROFILE: MyProfile1

# Scenario 2: Chaining multiple roles
- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-first-role
    aws-profile: firstRoleInChain

- name: assume second role
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
    role-chaining: true
    aws-profile: secondRoleInChain
  env:
    AWS_PROFILE: firstRoleInChain

By default, the action exports credentials as environment variables. To use named AWS profiles instead, provide the aws-profile input. This writes credentials to ~/.aws/credentials and ~/.aws/config files.

Key behaviors:

• Profile names cannot contain whitespace, square brackets, or slashes.
• When aws-profile is set, credentials are not exported as environment variables unless you also set output-env-credentials: true.
• The action will not overwrite an existing profile unless overwrite-aws-profile is set to true.
• Caution: Writing to configuration files means credentials persist in the execution environment even after the action cleanup step. Use this only for unusual authentication scenarios.
• The action preserves existing profile sections in the files, but comments will be lost.

- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    aws-profile: MyProfile1
    output-env-credentials: true