Account ID gets blanked out (by ***) in subsequent Steps

[matthewponzio]

I am provisioning access to an Account in a Step configured as follows:

- name: Provision access to new Customer Account
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ env.CUSTOMER_ACCT_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ env.CUSTOMER_ACCT_SECRET_ACCESS_KEY }}
        aws-session-token: ${{ env.CUSTOMER_ACCT_SESSION_TOKEN }}
        aws-region: us-east-1

The above works perfectly fine and I am able to perform tasks against the target Account.

However ANY and ALL references to the Account ID for the target Account is blanked out (***) in subsequent steps (at least for bash Actions). It does not matter if the Account ID is in an environment variable, or hardcoded into a string in the bash code; GitHub Actions is finding it and ***ing out.

By way of example, the following code in a bash Step:

AUTH_POLICY='{
          "Version": "2008-10-17",
          "Statement": [
            {
              "Sid": "stmnt1671547986142",
              "Effect": "Allow",
              "Principal": {
                "Service": "cognito-idp.amazonaws.com"
              },
              "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail"
              ],
              "Resource": "arn:aws:ses:us-east-1:123456789012:identity/[email protected]"
            }
          ]
        }')
echo $AUTH_POLICY

Will yield the following output in ANY Step that takes place AFTER the Step shown above:

{ "Version": "2008-10-17", "Statement": [ { "Sid": "stmnt1671547986142", "Effect": "Allow", "Principal": { "Service": "cognito-idp.amazonaws.com" }, "Action": [ "ses:SendEmail", "ses:SendRawEmail" ], "Resource": "arn:aws:ses:us-east-1:***:identity/[email protected]" } ] }

[matthewponzio]

An even simpler example...
Where 123456789012 is the Account ID of the Account to which the previous aws-actions/configure-aws-credentials@v1 Step provisioned access, the following Step...

    - name: Echo Account Id
      shell: bash
      run: |
          echo "Account Id is: 123456789012"

would yield this when the Workflow is run:
Account Id is: ***

[matthewponzio]

Okay, dug through the Repo and answered my own question!

mask-aws-account-id: false

My request after this experience would be - PLEASE add the Action parameters to the README?

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.