Closed lscerrigdc closed 2 years ago
Thanks for the request!
This does look like something we can investigate and look for.
I took a look and it looks like we have a two options.
aws-cli
calls.secret
and access
creds, so interested users can use an alternative method that gives authentication to aws-cli
.I'm thinking the 2nd path for least resistance, but also the 1st path if we making a new major version and then remove all use of having to cleanse/purge access keys in bash.
We are going to make a new major v2 version that enforces the use of the configure-aws-credentials
prior to our action. This looks to be most secure and how we can evolve build scripts to be most hardened.
It would be nice if the task could use the credentials set up by the https://github.com/aws-actions/configure-aws-credentials task. This would help avoid having to refresh the secret in the repo settings and use AWS roles instead