Provide a way to idempotently fetch credentials

[ianbotsf]

Describe the feature

I have several reusable actions which need AWS credentials to already be configured. I'd like for those actions to be able to invoke configure-aws-credentials but to only fetch credentials if they haven't already been fetched. I can imagine enabling this via a new config option but I'm not attached to any particular method—I just want to avoid fetching the same credentials twice.

Use Case

I have multiple reusable actions and multiple workflows, for example:

• workflow-1 invokes action-1
• workflow-2 invokes action-2
• action-2 invokes action-1
• workflow-3 MAY invoke neither/either/both action-1 and action-3

I want each of these actions to be able to ensure credentials are fetched without duplicating work that may've already been done.

Proposed Solution

Possibly a new mode of execution, configurable as an action input, which tracks/detects whether credentials have already been fetched and short-circuits.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

[kellertk]

The if: conditional in action syntax allows for accessing the env context. Something like this appears to work for me:

name: Test CAWSC IF
on:
  workflow_dispatch:

jobs:
  cawsc:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: CAWSC
        if: ${{ env.AWS_ACCESS_KEY_ID == '' }}
        uses: aws-actions/configure-aws-credentials@main
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.role }}
          role-duration-seconds: 900
      - name: Whoami
        run: |
          aws sts get-caller-identity

Of course, that will only skip the step if credentials don't exist at all, but doesn't check whether or not they're valid. We can add an option to this action to check if current credentials are valid (by calling get-caller-identity) and fetching new credentials if that call fails.

[github-actions]

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.