| aws_region | AWS region | yes | — |
| role_to_assume | ARN of the IAM role to assume (for OIDC) | no | — |
| role_session_name | Name for the assumed role session | no | github-actions-${{ github.run_id }} |
| role_duration | Duration of the role session in seconds | no | 3600 |
| aws_access_key_id | AWS Access Key ID (if not using OIDC) | no | — |
| aws_secret_access_key | AWS Secret Access Key (if not using OIDC) | no | — |
| enable_ecr_login | Enable Docker login to Amazon ECR | no | false |
| eks_cluster_name | Name of the EKS cluster to configure kubectl for | no | — |
| ecr_registries | Comma-separated list of ECR registry IDs for cross-account access | no | — |
| ecr_repositories | Comma-separated list of ECR repositories to ensure exist (e.g., "backend,frontend") | no | "" |
| codeartifact_domain | CodeArtifact domain name | no | — |
| codeartifact_repository | CodeArtifact repository name | no | — |
| codeartifact_tool | Tool to configure for CodeArtifact (npm, pip, twine, dotnet, nuget, swift, maven, gradle) | no | — |
| codeartifact_region | Region for CodeArtifact (defaults to aws_region if not specified) | no | — |
| codeartifact_domain_owner | AWS account ID that owns the CodeArtifact domain (defaults to authenticated account) | no | — |
| codeartifact_duration | Duration of the CodeArtifact token in seconds | no | 43200 |
| codeartifact_namespace | CodeArtifact namespace for the repository | no | — |
| codeartifact_output_token | Output the CodeArtifact token instead of using aws codeartifact login (useful for custom configurations) | no | false |