Sharing credentials for subsequent jobs

[yellowmamba]

I have two jobs that require aws credentials, currently having this step in both jobs to get auth'd. Is there a way to just obtain the credentials for once and share the credentials like an artifact for dependent jobs later?

[peterwoodworth]

Here's a helpful article on a couple options you have to persist GitHub Action data.

I'm going to convert this to a discussion so that further discussion can take place over examples and what the best strategy might be

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[jshields]

I don't think you would store credentials as an artifact.

See the documentation on the output-credentials option for aws-actions/configure-aws-credentials
https://github.com/marketplace/actions/configure-aws-credentials-action-for-github-actions#retrieving-credentials-from-step-output-assumerole-with-temporary-credentials

In the example they give, the credentials are referenced only from within the same job's steps, like:
${{ steps.creds.outputs.aws-secret-access-key }}. In your case, you want the job to output the creds for other jobs.

You should be able to set them as outputs of the job like this example is doing with the Docker credentials:
https://github.com/aws-actions/amazon-ecr-login?tab=readme-ov-file#run-an-image-as-a-service

The subsequent jobs that depend on the credentials can use the needs: key, like the above example does with the Docker credentials, but the question is asking about AWS credentials instead.

What I am finding is that it's probably better to just assume the role you need using OIDC in each job that needs it rather than pass credentials around, because you still need to use aws-actions/configure-aws-credentials with the output credentials anyway - you might as well just assume the role again in the next job that needs credentials.

Additionally if sensitive values are passed, they should be masked, which the AWS actions documentation does not show:
https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#example-masking-a-generated-output-within-a-single-job