cloudbees-io/Configure AWS Credentials For CloudBees Automations
Configure AWS credential and region environment variables for use with the AWS CLI and AWS SDKs
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 8, 2026
- License
- MIT
Pinned Snippet
uses: cloudbees-io/configure-aws-credentials@77c87be1380c78f01d07eb875374650d6753cc05 # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| audience | The audience to use for the OIDC provider | no | sts.amazonaws.com |
| cloudbees-api-token | The CloudBees API Token to use for fetching OIDC ID tokens, must have `id-token: write` permission | — | ${{ cloudbees.api.token }} |
| cloudbees-api-url | The CloudBees API root URL to use for fetching OIDC ID tokens | — | ${{ cloudbees.api.url }} |
| aws-access-key-id | AWS Access Key ID. This input is required if running in the GitHub hosted environment. It is optional if running in a self-hosted environment that already has AWS credentials, for example on an EC2 instance. | no | — |
| aws-secret-access-key | AWS Secret Access Key. This input is required if running in the GitHub hosted environment. It is optional if running in a self-hosted environment that already has AWS credentials, for example on an EC2 instance. | no | — |
| aws-session-token | AWS Session Token | no | — |
| aws-region | AWS Region, e.g. us-east-2 | yes | — |
| mask-aws-account-id | Whether to set the AWS account ID for these credentials as a secret value, so that it is masked in logs. Valid values are 'true' and 'false'. Defaults to true | no | true |
| role-to-assume | Use the provided credentials to assume an IAM role and configure the Actions environment with the assumed role credentials rather than with the provided credentials | no | — |
| web-identity-token-file | Use the web identity token file from the provided file system path in order to assume an IAM role using a web identity. E.g., from within an Amazon EKS worker node | no | — |
| role-duration-seconds | Role duration in seconds (default: 6 hours, 1 hour for OIDC/specified aws-session-token) | no | — |
| role-session-name | Role session name (default: CloudBeesAutomations) | no | — |
| role-external-id | The external ID of the role to assume | no | — |
| role-skip-session-tagging | Skip session tagging during role assumption | no | false |
| http-proxy | Proxy to use for the AWS SDK agent | no | — |
| role-chaining | Use existing credentials from the environment to assume a new role | no | false |
| inline-session-policy | Inline session policy | no | — |
| managed-session-policies | List of managed session policies | no | — |
Outputs
| name | description |
|---|---|
| aws-account-id | The AWS account ID for the provided credentials |