Assume role command is failing in CI

[vertism]

Service name

Multiple including:
https://github.com/ministryofjustice/correspondence_tool_public "contact-moj-"
https://github.com/ministryofjustice/request-personal-information "request-for-personal-information-
https://github.com/ministryofjustice/parliamentary-questions "parliamentary-questions-*"

Service environment

N/A - Issue in CI

• Dev / Development
• Staging
• Prod / Production
• Other

Impact on the service

Builds in CI are failing which is blocking the deploy pipeline

Problem description

Recently the assume role command has sometimes stopped working. These are setup according to this guide.

When it fails, the role-to-assume argument just seems to be missing and there’s an error -
Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers.

The logs look like:

Run aws-actions/configure-aws-credentials@v4
  with:
    aws-region: eu-west-2
    audience: sts.amazonaws.com
  env:
    PREFIX: pq
    SHA: a88b588e4abb305dffde32635398fbb2d05732
Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

When it's running correctly (which it sometimes does) the role-to-assume argument is visible:

Run aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: ***
    aws-region: eu-west-2
    audience: sts.amazonaws.com
  env:
    PREFIX: pq
    SHA: 7f84ecac522209b46e674d6a71685e19692f055
Assuming role with OIDC
Authenticated as assumedRoleId AROA2HJSWAHHQCMGLEDP

I have found a workaround which is to make a change to the configure-aws-credentials such as setting the role-to-assume to an empty string, allowing that to build then reverting the commit.

I thought it might be some kind of caching bug and tried adding the unset-current-credentials: true argument to the command, but that has not fixed it.

Contact person

[email protected]
Slack: "@andrew Pepler"