Error when trying to use Container Role with Force Skip OIDC set to true

[simonkarman]

I'm using self hosted GitHub runners and use their container role (aws configure list) as my base credentials from which I assume other credentials.

So I have disabled the use of OIDC.

    - uses: aws-actions/configure-aws-credentials@v5.1.0
      with:
        role-to-assume: my-role
        role-duration-seconds: 3600
        aws-region: eu-west-1
        force-skip-oidc: true

However, this gives me the following error:

If 'force-skip-oidc' is true and 'role-to-assume' is set, 'aws-access-key-id' or 'web-identity-token-file' must be set

As the logic in there requires one of those settings to be active: https://github.com/aws-actions/configure-aws-credentials/blame/b1257c400167d727708335212f95607835cd03fd/src/index.ts#L74

However, in my case I don't want any of those to be active. Can this check be removed so that I can use the Container Role while force skipping OIDC?

[kellertk]

Hi there! You don't need to use force-skip-oidc, but you will need to do this in multiple steps. First, use the action to pick up the container credentials and export them to the environment, then use the environment credentials to assume a role. As an example:

name: ECS Self-Hosted Test

on:
  workflow_dispatch:

jobs:
  test-ecs-runner:
    runs-on: [self-hosted, ecs]
    steps:
      # Step 1: Pick up ECS container credentials and export to env
      - name: Get ECS container credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-region: us-east-1

      # Step 2: Use the exported env creds to assume role
      - name: Assume final role
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-region: us-east-1
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
          role-to-assume: <your role here>
          role-skip-session-tagging: true

      - name: Verify credentials
        run: aws sts get-caller-identity