Plaintext Credentials Showing Up In GitHub Actions

[cameron-zwane]

I am using GitHub Actions with AWS, Terraform and aws sts get-caller-identity.

A step in my workflow job is there to validate my AWS role. It looks like this:

- name: Validate Identity with AWSrun: aws sts get-caller-identity
  run: aws sts get-caller-identity

The issue I am having is that instead of displaying the credentials starred out like my other pipelines like the example below, it actually populates the *** with real credentials (like my actual Arn info), leaving my pipeline full of actual secrets for some reason.

{
    "UserId": "removed_for_question:removed_for_question",
    "Account": "***",
    "Arn": "arn:aws:sts::***:removed_for_question"
}

I have figured out that the reason my one pipeline is hiding the info and the other is not is because of the VERSION I am using here:

      - name: Configure AWS credentials
        uses: aws-actions/[email protected]
        with:
          role-to-assume: ${{ secrets.AWS_ROLE }}
          role-session-name: removed_for_question
          aws-region: ${{ secrets.AWS_REGION }}

vs. the one that exposes the secrets:

      - name: Configure AWS credentials
        uses: aws-actions/[email protected]
        with:
          role-to-assume: ${{ secrets.AWS_ROLE }}
          role-session-name: removed_for_question
          aws-region: ${{ secrets.AWS_REGION }}

How do I hide those credentials without having to use an old version? I'm very new to most of the tools, and have no clue if this is me using the tool wrong or what.