starred/act

Fork 0

mirror of https://github.com/nektos/act.git synced 2026-04-26 09:25:54 +03:00

[GH-ISSUE #409] Use local aws credentials in local `act` run #287

New issue

Closed

opened 2026-03-01 21:42:05 +03:00 by kerem · 6 comments

kerem commented

2026-03-01 21:42:05 +03:00

Owner

Originally created by @aldegoeij on GitHub (Nov 6, 2020).
Original GitHub issue: https://github.com/nektos/act/issues/409

Is it somehow possible to read the credentials from my local ~/.aws/ directory and use them in the workflow run?

It is the same logic as used in e.g. docker by adding -v $HOME/.aws:/root/.aws to docker run command. Processes in the docker container now use the local credentials as base credentials for role assume.

This way within the workflow the base credentials are the base credentials of my local aws configuration. Currently I need to copy paste Access Key Id, Secret Access Key and Session Token into a .secrets file for act to pickup?

Is there any way to pass e.g. custom docker commands?

Originally created by @aldegoeij on GitHub (Nov 6, 2020). Original GitHub issue: https://github.com/nektos/act/issues/409 Is it somehow possible to read the credentials from my local `~/.aws/` directory and use them in the workflow run? It is the same logic as used in e.g. docker by adding `-v $HOME/.aws:/root/.aws` to docker run command. Processes in the docker container now use the local credentials as base credentials for role assume. This way within the workflow the base credentials are the base credentials of my local aws configuration. Currently I need to copy paste Access Key Id, Secret Access Key and Session Token into a `.secrets` file for `act` to pickup? Is there any way to pass e.g. custom docker commands?

kerem

2026-03-01 21:42:05 +03:00

closed this issue
added the
stale
label

kerem commented

2026-03-01 21:42:06 +03:00

Author

Owner

@rahb3rt commented on GitHub (Nov 18, 2020):

I am sure you could pass them in via secrets function?

Something like act -s AWS_SECRETE=$(cat ~/.aws/config) and so on would that not work? @aldegoeij

@rahb3rt commented on GitHub (Nov 18, 2020): I am sure you could pass them in via secrets function? Something like `act -s AWS_SECRETE=$(cat ~/.aws/config)` and so on would that not work? @aldegoeij

kerem commented

2026-03-01 21:42:06 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 16, 2021):

Issue is stale and will be closed in 14 days unless there is new activity

@github-actions[bot] commented on GitHub (Jan 16, 2021): Issue is stale and will be closed in 14 days unless there is new activity

kerem commented

2026-03-01 21:42:06 +03:00

Author

Owner

@vcolanoKH commented on GitHub (Feb 11, 2022):

Finagling @rahb3rt's answer a bit I got this working with

act pull_request \
 --env AWS_ACCESS_KEY_ID=$(aws configure get default.aws_access_key_id) \
 --env AWS_SECRET_ACCESS_KEY=$(aws configure get default.aws_secret_access_key) \
 --env AWS_SESSION_TOKEN=$(aws configure get default.aws_session_token

Sources:

@vcolanoKH commented on GitHub (Feb 11, 2022): Finagling @rahb3rt's answer a bit I got this working with ```bash act pull_request \ --env AWS_ACCESS_KEY_ID=$(aws configure get default.aws_access_key_id) \ --env AWS_SECRET_ACCESS_KEY=$(aws configure get default.aws_secret_access_key) \ --env AWS_SESSION_TOKEN=$(aws configure get default.aws_session_token ``` Sources: * https://stackoverflow.com/a/40852848/2121777 * https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html

kerem commented

2026-03-01 21:42:06 +03:00

Author

Owner

@rdettai commented on GitHub (Mar 16, 2022):

for reference, what i ended up doing:

calling command
act --env CREDS_FILE="$(shell cat ~/.aws/credentials | base64 -w 0)"
new step

      - name: "Write AWS credentials file"
        if: ${{ env.ACT }}
        description: "When running locally with `act`, load AWS credentials"
        run: |
          mkdir ~/.aws
          echo $CREDS_FILE | base64 -d > ~/.aws/credentials

As you can see, I am encoding with base64 to avoid all escaping/newline issues.

@rdettai commented on GitHub (Mar 16, 2022): for reference, what i ended up doing: - calling command `act --env CREDS_FILE="$(shell cat ~/.aws/credentials | base64 -w 0)" ` - new step ``` - name: "Write AWS credentials file" if: ${{ env.ACT }} description: "When running locally with `act`, load AWS credentials" run: | mkdir ~/.aws echo $CREDS_FILE | base64 -d > ~/.aws/credentials ``` As you can see, I am encoding with base64 to avoid all escaping/newline issues.

kerem commented

2026-03-01 21:42:06 +03:00

Author

Owner

@furkantektas commented on GitHub (May 2, 2024):

Alternative to @rdettai's solution, you can pass the credentials via env-file parameter like this:

act pull_request --env-file <(aws configure export-credentials --format env)

@furkantektas commented on GitHub (May 2, 2024): Alternative to @rdettai's solution, you can pass the credentials via `env-file` parameter like this: ```bash act pull_request --env-file <(aws configure export-credentials --format env) ```

kerem commented

2026-03-01 21:42:06 +03:00

Author

Owner

@chris-porter-trend commented on GitHub (Mar 11, 2025):

Alternative to @rdettai's solution, you can pass the credentials via env-file parameter like this:

act pull_request --env-file <(aws configure export-credentials --format env)

This worked very well for me. I find issues some issues using both aws-actions/configure-aws-credentials@v4 and aws-actions/amazon-ecr-login@v2. Using role-to-assume on the credentials side did not work, then realized that the aws configure export-credentials was using my default AWS SSO profile. Adding a profile arg solved my issue:

act push --env-file <(aws configure export-credentials --format env --profile=not-my-default-profile)

This ensured the exported credentials were for the intended account and I was able to remove role-to-assume usage.

@chris-porter-trend commented on GitHub (Mar 11, 2025): > Alternative to [@rdettai](https://github.com/rdettai)'s solution, you can pass the credentials via `env-file` parameter like this: > > act pull_request --env-file <(aws configure export-credentials --format env) This worked very well for me. I find issues some issues using both `aws-actions/configure-aws-credentials@v4` and `aws-actions/amazon-ecr-login@v2`. Using `role-to-assume` on the credentials side did not work, then realized that the `aws configure export-credentials` was using my default AWS SSO profile. Adding a profile arg solved my issue: ``` act push --env-file <(aws configure export-credentials --format env --profile=not-my-default-profile) ``` This ensured the exported credentials were for the intended account and I was able to remove `role-to-assume` usage.

kerem referenced this issue

2026-03-01 21:51:01 +03:00

[PR #287] [MERGED] Rewrite contexts before evaluating them #1402

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/act#287

No description provided.

Rows
Columns

[GH-ISSUE #409] Use local aws credentials in local act run #287

[GH-ISSUE #409] Use local aws credentials in local `act` run #287