GitHub Action for aws-cli

clareliguori commented 4 years ago

I'm opening this issue to gather feedback about the need for an AWS CLI GitHub Action in the github.com/aws-actions organization. Please use the thumbs-up reaction if this would be useful to you.

For context, GitHub deprecated (and has now deleted) their action actions/aws/cli. That action enabled running workflows like this:

- name: Upload to S3
  uses: actions/aws/cli@master
  with:
    args: s3 cp ./results/ s3://reports/results/ --recursive

Please note that the AWS CLI is pre-installed in the GitHub-hosted environments. For example, runs-on: ubuntu-latest will have AWS CLI version 1.16.299, and you can do the following:

  - name: Upload to S3
    run: |
      aws s3 cp ./results/ s3://reports/results/ --recursive

I do not know how often GitHub will upgrade the version of the AWS CLI in the GitHub-hosted environments.

I have already received multiple requests for an AWS CLI action in the existing action repos that I maintain: https://github.com/aws-actions/configure-aws-credentials/issues/9 https://github.com/aws-actions/amazon-ecs-deploy-task-definition/issues/21 https://github.com/aws-actions/amazon-ecs-deploy-task-definition/issues/18

tpreusse commented 4 years ago

An exemplary usage of aws cli in the configure-aws-credentials readme would have been enough for me. But a separate repo would make it even more obvious, even just with a readme that does a built in run.

KenBerg75 commented 4 years ago

Certainly would be helpful for self-hosted scenarios.

blowfishpro commented 4 years ago

You can sorta do this with the aws-cli docker image. That comes with a lot of limitations though, e.g. you're limited to particular directories which actions volume-maps in: /github/home, /github/workspace, /github/workflow

    steps:
      - name: Download File from S3
        uses: docker://amazon/aws-cli:2.0.7
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        with:
          args: s3 cp s3://bucket/key /github/home/downloaded_file

StacyYang commented 4 years ago

Is that possible to use s3 cp in the pull request with github actions? I found the secrets.AWS_ACCESS_KEY_ID does not work for doing pull request from a fork.

Any solution?

blowfishpro commented 4 years ago

You can make the object publicly accessible and then either pass --no-sign-request or download directly by URL without the aws cli.

Really though, this is a broader problem of needing to be able to build against external pull requests but not leak secrets. If secrets were allowed when building against external PRs, someone could submit a PR that either directly did something malicious with your credentials directly or made them accessible such that they could do something with them later. But merging a PR, especially an external one, without running CI is also not desirable. So really there needs to be a way to say "a trusted human has looked at this PR and verified that it doesn't do anything bad, now run CI with secrets". Running only approved PRs might work. None of this is specific to aws-cli on Github Actions, or for that matter any CI provider though.

thisismydesign commented 4 years ago

I was missing the list of all env vars: https://stackoverflow.com/a/63353289/2771889

After figuring that out it's very straightforward to use the CLI in Actions.

BastianZim commented 4 years ago

I would really appreciate it! Even if it's also offered in the GitHub environment I'd feel safer if there's an AWS certified version to use. Just my two cents...

unfor19 commented 4 years ago

I've created a GitHub Action that installs the AWS CLI on a Linux runner, according to a given version, so you might find it useful - unfor19/install-aws-cli-action

This is how you use it -

- id: install-aws-cli
  uses: unfor19/install-aws-cli-action@v1
  with:
    version: 1

@BastianZim - I agree with your concern regarding the "official version", the action that I've created doesn't require any credentials, it only installs the CLI.

sshymko commented 3 years ago

For the record, aws-cli-install-action is another AWS CLI action:

- uses: chrislennon/action-aws-cli@v1.1
- run: aws s3 ls
  env:
    AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
    AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

unfor19 commented 3 years ago

@sshymko the action that you mentioned is archived :\ This is why I created my action

bwagner5 commented 3 years ago

You can sorta do this with the aws-cli docker image. That comes with a lot of limitations though, e.g. you're limited to particular directories which actions volume-maps in: /github/home, /github/workspace, /github/workflow
    steps:
      - name: Download File from S3
        uses: docker://amazon/aws-cli:2.0.7
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        with:
          args: s3 cp s3://bucket/key /github/home/downloaded_file

I tried using the docker work round to get a more up-to-date aws-cli but I need it on Windows as well as Linux and there's not a Windows docker image for the aws-cli (aws-cli is also not published to ecr public yet, so we're at the mercy of dockerhub rate limiting too).

unfor19 commented 3 years ago

@bwagner5 just wondering, would you use my action https://github.com/unfor19/install-aws-cli-action if it supported Windows?

The main difference between my action and the others out there - I'm installing the aws-cli on the runner, unlike other actions that run a Docker container that has the aws-cli installed on it.