GitHub Actions now selects among multiple AWS STS Credential Providers
The Aembit GitHub Action can now choose which AWS Security Token Service (STS) Federation Credential Provider to use when an Access Policy holds more than one.
An Access Policy can hold more than one AWS STS Federation Credential Provider, each with its own Access Key ID selector. Until now, a GitHub Actions workflow needed a self-hosted runner running Aembit Edge to reach more than one IAM role from a single Access Policy. The alternative was a direct call to the Edge API.
Key capabilities:
- The
aws-access-key-idinput names the Access Key ID selector of the Credential Provider you want, so a workflow on a GitHub-hosted runner reaches any IAM role in the Access Policy. See Retrieve credentials in GitHub Actions. - The Edge API credentials endpoint carries the same selector as connection metadata, alongside the selectors for multiple JSON Web Token (JWT) Credential Providers. See the Edge API credentials endpoint.
- The Edge SDKs for TypeScript and Python pass the selector as connection metadata on the credential request. See Select among multiple Credential Providers with the Edge SDK.
Minimum version required:
- Aembit GitHub Action 1.3.0
- Edge SDK 1.34.0
For how Aembit matches a selector to a Credential Provider, see Using multiple AWS STS Credential Providers.