英文:
Can't access OIDC token from github workflow in one runner but not the other
问题
我正在尝试在自托管运行器上运行我的Github工作流程。我已经在两台计算机上安装了自托管运行器：
- Macbook Pro
- Ubuntu桌面
Macbook Pro上的自托管运行器正常工作，但Ubuntu上的自托管运行器在这一步失败：
- name: 使用OIDC进行角色假设
uses: aws-actions/configure-aws-credentials@master
with:
role-to-assume: arn:aws:iam::123456789012:role/github-connection-role
aws-region: us-west-2
出现以下错误：
错误：请求中包含的安全令牌无效。
为了提供更多背景信息，以下是整个工作流程：
name: 部署
on:
push:
branches:
- main
jobs:
ci:
name: 使用Node 16构建和部署
timeout-minutes: 60
runs-on: self-hosted
permissions:
id-token: write
contents: read
steps:
- name: 检出
uses: actions/checkout@v3
- name: 使用Node.js 16
uses: actions/setup-node@v3
with:
node-version: 16
cache: 'npm'
cache-dependency-path: package-lock.json
- name: 安装依赖
run: npm install
- name: 构建
run: npm run build
- name: 使用OIDC进行角色假设
uses: aws-actions/configure-aws-credentials@master
with:
role-to-assume: arn:aws:iam::123456789012:role/github-connection-role
aws-region: us-west-2
- name: 部署
run: npx cdk deploy app-production-stack --ci --require-approval never
在运行作业时，是否需要在自托管运行器主机上进行某些配置，以便访问安全令牌？
英文:
I'm trying to get my Github workflows running on self-hosted runners. I've got the self-hosted runner installed on two computers:
- Macbook Pro
- Ubuntu desktop
The Macbook pro runner works fine, but the Ubuntu runner fail at this step:
- name: Assume role using OIDC
uses: aws-actions/configure-aws-credentials@master
with:
role-to-assume: arn:aws:iam::123456789012:role/github-connection-role
aws-region: us-west-2
With this error:
Error: The security token included in the request is invalid.
For more context, here's the entire workflow
name: Deploy
on:
push:
branches:
- main
jobs:
ci:
name: Build and deploy with Node 16
timeout-minutes: 60
runs-on: self-hosted
permissions:
id-token: write
contents: read
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Use Node.js 16
uses: actions/setup-node@v3
with:
node-version: 16
cache: 'npm'
cache-dependency-path: package-lock.json
- name: Install dependencies
run: npm install
- name: Build
run: npm run build
- name: Assume role using OIDC
uses: aws-actions/configure-aws-credentials@master
with:
role-to-assume: arn:aws:iam::123456789012:role/github-connection-role
aws-region: us-west-2
- name: Deploy
run: npx cdk deploy app-production-stack --ci --require-approval never
Is there something I need to configure on the runner host before it can access security tokens in running jobs?
答案1
得分: 0
问题出在我的Ubuntu电脑上配置了过期的AWS凭据。我假设主机AWS没有被Runner使用。我通过更新Ubuntu的~/.aws/credentials文件，添加了一个具有假定我的github-connection-role角色权限的默认配置文件，成功解决了问题。
英文:
The issue ended up being that my Ubuntu computer was configured with expired AWS credentials. I assumed the host AWS wasn't used by the runner. I was able to fix the issue by updating the Ubuntu ~/.aws/credentials file to include a default profile that has permission to assume my github-connection-role role.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论