Install and configure the AWS command-line interface (awscli)
assume-role-with-web-identity
- This command generates short lived AWS keys using OpenID Connect. You use an IAM OIDC identity provider to establish trust between CircleCI and your AWS account when running jobs. Creating a Web Identity based role-arn
that's compatible with OpenID Connect in AWS IAM is required.
setup
command now includes assume-role-with-web-identity
command. The setup command installs the aws cli
and runs the assume-role-with-web-identity
command if the role-session-id
and role-arn
parameters are passed. If not, a profile is configured with the AWS_SECRET_KEY_ID
and AWS_SECRET_ACCESS_KEY
that are passed as environment variables.
assume-role-with-web-identity
command has the following parameters
role-arn
: The Amazon Resource Name (ARN) of the role that the caller is assuming. Role ARN must be configured for web identity in this command.role-session-name
: An identifier for the assumed role session. It must be less than 64 characterssession-duration
: The duration of the session in seconds. It defaults to 3600 seconds (1 hour).profile-name
: The profile name to be configured with Web Identitydescription: |
Setup the AWS CLI and configure with Web Identity.
Assume roles on AWS without storing keys on CircleCI and utilize short-term credentials instead.
For more information, see the CircleCI OIDC docs: https://circleci.com/docs/2.0/openid-connect-tokens
usage:
version: 2.1
orbs:
aws-cli: circleci/[email protected]
jobs:
aws-cli-example:
executor: aws-cli/default
steps:
- checkout
- aws-cli/setup:
profile-name: WEB IDENTITY PROFILE
role-arn: arn:aws:iam::123456789012:role/WEB-IDENTITY-ROLE
role-session-name: example-session
- run: echo "Run your code here"
workflows:
aws-cli:
jobs:
- aws-cli-example:
context: aws
Full Changelog: https://github.com/CircleCI-Public/aws-cli-orb/compare/v3.0.0...v3.1.0
role-arn
parameter has been removed from the setup command and is now exclusively in the role-arn-setup
command.install
command now lets users specify the install and binary directories for the aws cli
install-dir
: Specify the installation dirertory of AWS CLI. Defaults to /usr/local/aws-cli
binary-dir
: The main aws program in the install directory is symbolically linked to the file aws
in this specified path. Defaults to /usr/local/bin
install
command can now be installed on Alpine
Linux and Windows bash.exe
Windows
uses Choclatey
to add AWS
and must be installed prior.AWS
on Windows
, bash.exe
must be specified when defining the executor using the shell
parameter like so:windows:
machine:
image: windows-server-2019-vs2019:stable
shell: bash.exe
resource_class: windows.medium
Full Changelog: https://github.com/CircleCI-Public/aws-cli-orb/compare/v1.4.1...v3.0.0