Important

Neither this action, nor AWS is responsible for securing access to your AWS account. See theshared responsibility model.

It is highly advised to use temporary AWS credentials scoped to the least privilege when accessing AWS API in order to sign the JWT token.

Using AWS KMS will generate extra costs in your AWS bill.

Usage

Important

An installation access token expires after 1 hour. Pleasesee this comment for alternative approaches if you have long-running processes.

Create a token for the current repository

name:Run tests on stagingon:push:branches:      -mainjobs:hello-world:runs-on:ubuntu-lateststeps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:app-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}      -uses:./actions/staging-testswith:token:${{ steps.app-token.outputs.token }}

Use app token withactions/checkout

on:[pull_request]jobs:auto-format:runs-on:ubuntu-lateststeps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:# requiredapp-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}      -uses:actions/checkout@v4with:token:${{ steps.app-token.outputs.token }}ref:${{ github.head_ref }}# Make sure the value of GITHUB_TOKEN will not be persisted in repo's configpersist-credentials:false      -uses:creyD/prettier_action@v4.3with:github_token:${{ steps.app-token.outputs.token }}

Create a git committer string for an app installation

on:[pull_request]jobs:auto-format:runs-on:ubuntu-lateststeps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:# requiredapp-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}      -name:Get GitHub App User IDid:get-user-idrun:echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"env:GH_TOKEN:${{ steps.app-token.outputs.token }}      -id:committerrun:echo "string=${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"  >> "$GITHUB_OUTPUT"      -run:echo "committer string is ${ {steps.committer.outputs.string }}"

Configure git CLI for an app's bot user

on:[pull_request]jobs:auto-format:runs-on:ubuntu-lateststeps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:# requiredapp-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}      -name:Get GitHub App User IDid:get-user-idrun:echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"env:GH_TOKEN:${{ steps.app-token.outputs.token }}      -run:|          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>'# git commands like commit work using the bot user      -run:|          git add .          git commit -m "Auto-generated changes"          git push

Tip

The<BOT USER ID> is the numeric user ID of the app's bot user, which can be found underhttps://api.github.com/users/<app-slug>%5Bbot%5D.

For example, we can check athttps://api.github.com/users/dependabot[bot] to see the user ID of Dependabot is 49699333.

Alternatively, you can use theoctokit/request-action to get the ID.

Create a token for all repositories in the current owner's installation

on:[workflow_dispatch]jobs:hello-world:runs-on:ubuntu-lateststeps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:app-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}owner:${{ github.repository_owner }}      -uses:peter-evans/create-or-update-comment@v3with:token:${{ steps.app-token.outputs.token }}issue-number:${{ github.event.issue.number }}body:"Hello, World!"

Create a token for multiple repositories in the current owner's installation

on:[issues]jobs:hello-world:runs-on:ubuntu-lateststeps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:app-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}owner:${{ github.repository_owner }}repositories:"repo1,repo2"      -uses:peter-evans/create-or-update-comment@v3with:token:${{ steps.app-token.outputs.token }}issue-number:${{ github.event.issue.number }}body:"Hello, World!"

Create a token for all repositories in another owner's installation

on:[issues]jobs:hello-world:runs-on:ubuntu-lateststeps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:app-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}owner:another-owner      -uses:peter-evans/create-or-update-comment@v3with:token:${{ steps.app-token.outputs.token }}issue-number:${{ github.event.issue.number }}body:"Hello, World!"

Create tokens for multiple user or organization accounts

Note

Seethis documentation for information on using multiline strings in workflows.

on:[workflow_dispatch]jobs:set-matrix:runs-on:ubuntu-latestoutputs:matrix:${{ steps.set.outputs.matrix }}steps:      -id:setrun:echo 'matrix=[{"owner":"owner1"},{"owner":"owner2","repos":["repo1"]}]' >>"$GITHUB_OUTPUT"use-matrix:name:"@${{ matrix.owners-and-repos.owner }} installation"needs:[set-matrix]runs-on:ubuntu-lateststrategy:matrix:owners-and-repos:${{ fromJson(needs.set-matrix.outputs.matrix) }}steps:      -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}      -uses:actions/create-github-app-token@v1id:app-tokenwith:app-id:${{ vars.APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}owner:${{ matrix.owners-and-repos.owner }}repositories:${{ join(matrix.owners-and-repos.repos) }}      -uses:octokit/request-action@v2.xid:get-installation-repositorieswith:route:GET /installation/repositoriesenv:GITHUB_TOKEN:${{ steps.app-token.outputs.token }}      -run:echo "$MULTILINE_JSON_STRING"env:MULTILINE_JSON_STRING:${{ steps.get-installation-repositories.outputs.data }}

Run the workflow in a github.com repository against an organization in GitHub Enterprise Server

on:[push]jobs:create_issue:runs-on:self-hostedsteps:    -name:AWS Loginuses:aws-actions/configure-aws-credentials@v4with:aws-region:${{ vars.AWS_REGION }}role-to-assume:${{ secrets.ROLE_TO_ASSUME }}role-session-name:${{ vars.ROLE_SESSION_NAME }}    -name:Create GitHub App tokenid:create_tokenuses:actions/create-github-app-token@v1with:app-id:${{ vars.GHES_APP_ID }}kms-key-id:${{ secrets.KMS_KEY_ID }}owner:${{ vars.GHES_INSTALLATION_ORG }}github-api-url:${{ vars.GITHUB_API_URL }}    -name:Create issueuses:octokit/request-action@v2.xwith:route:POST /repos/${{ github.repository }}/issuestitle:"New issue from workflow"body:"This is a new issue created from a GitHub Action workflow."env:GITHUB_TOKEN:${{ steps.create_token.outputs.token }}

Inputs

app-id

kms-key-id

owner

repositories

Note

Ifowner is set andrepositories is empty, access will be scoped to all repositories in the provided repository owner's installation. Ifowner andrepositories are empty, access will be scoped to only the current repository.

skip-token-revoke

github-api-url

Outputs

token

installation-id

app-slug

How it works

Note

Installation permissions can differ from the app's permissions they belong to. Installation permissions are set when an app is installed on an account. When the app adds more permissions after the installation, an account administrator will have to approve the new permissions before they are set on the installation.

License