[match] feat(s3_storage): add support for AWS STS credentials by monholm · Pull Request #22139 · fastlane/fastlane

monholm · 2024-07-10T11:27:54Z

🔑

Checklist

I've run bundle exec rspec from the root directory to see all new and existing tests pass
I've followed the fastlane code style and run bundle exec rubocop -a to ensure the code style is valid
I see several green ci/circleci builds in the "All checks have passed" section of my PR (connect CircleCI to GitHub if not)
I've read the Contribution Guidelines
I've updated the documentation if necessary.
I've added or updated relevant unit tests.

Motivation and Context

Using temporary short-lived credentials is considered best practice. The current implementation of s3_storage doesn't allow passing session_token, meaning only long-term credentials are supported.

Description

Added session_token to the s3_client_helper and match options.
Added unit test case.

Tested by running match with long-term credentials (without passing session_token) and temporary credentials (including session_token).

Testing Steps

Run match with storage_mode: 's3' and s3_session_token, e.g.:

lane :test_session_token do
  accessKeyId = ENV["AWS_ACCESS_KEY_ID"] || raise("AWS_ACCESS_KEY_ID is required")
  secretAccessKey = ENV["AWS_SECRET_ACCESS_KEY"] || raise("AWS_SECRET_ACCESS_KEY is required")
  sessionToken = ENV["AWS_SESSION_TOKEN"] || raise("AWS_SESSION_TOKEN is required")
  
  match(
    type: "development",
    storage_mode: 's3',
    app_identifier: ["xxxxxxxx"],
    s3_region: "eu-central-1",
    s3_bucket: "my-bucket,
    s3_access_key: accessKeyId,
    s3_secret_access_key: secretAccessKey,
    s3_session_token: sessionToken,
    team_id: 'my-team-id'
  )
end

aws-actions/configure-aws-credentials can be used to obtain temporary credentials in a GitHub Actions runner.

monholm · 2024-07-10T11:39:47Z

Correct me if I'm wrong, but the failing CircleCI tests seems completely unrelated to this PR.

monholm · 2025-08-09T20:17:32Z

@ainame @rogerluan Hi! 👋 I noticed you've both been active recently (reviewing/merging PRs), and I was hoping one of you might help bring this PR back to life.

If there's anything I can do to improve the chances of this getting merged, please let me know.
For what it's worth, we've been successfully using STS credentials for S3 since opening this PR by installing fastlane from the monholm:feat/s3-storage-sts-support branch, and it's been working flawlessly.

Copilot

Pull request overview

Adds AWS STS (session token) support to match S3 storage so users can authenticate with temporary credentials (access key + secret + session token), in addition to long-lived credentials.

Changes:

Adds s3_session_token as a match option/environment variable (MATCH_S3_SESSION_TOKEN).
Plumbs s3_session_token through Match’s S3 storage backend into Fastlane::Helper::S3ClientHelper.
Updates/extends unit tests for S3 client helper behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
match/spec/storage/s3_storage_spec.rb	Updates S3Storage spec subject initialization to include the new `s3_session_token` kwarg.
match/lib/match/storage/s3_storage.rb	Passes `s3_session_token` into `S3ClientHelper` and wires it through `configure`/`initialize`.
match/lib/match/storage.rb	Includes `s3_session_token` in the params forwarded to the S3 backend.
match/lib/match/options.rb	Adds new config option `:s3_session_token` with env var `MATCH_S3_SESSION_TOKEN`.
fastlane/spec/helper/s3_client_helper_spec.rb	Adds a new test case for providing a session token.
fastlane/lib/fastlane/helper/s3_client_helper.rb	Extends helper to accept/store `session_token` and pass it into `Aws::Credentials`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

iBotPeaches · 2026-03-19T11:17:22Z

It looks simple enough, I asked Copilot to peek since I was curious how the AWS SDK handled if we sent an empty string of the session token, maybe that would fail as a priority even if access/secret was passed.

…entials constructor Co-authored-by: Copilot Autofix powered by AI <[email protected]>

monholm · 2026-03-19T13:34:21Z

@iBotPeaches thank you for having a look at this - I appreciate it a lot :)

I've added a comment to the first Copilot suggestion and committed the suggested test. Let me know what you would prefer doing from here!

iBotPeaches

looks good

github-actions

Hey @monholm 👋

Thank you for your contribution to fastlane and congrats on getting this pull request merged 🎉
The code change now lives in the master branch, however it wasn't released to RubyGems yet.
We usually ship about once a month, and your PR will be included in the next one.

Please let us know if this change requires an immediate release by adding a comment here 👍
We'll notify you once we shipped a new release with your changes 🚀"

github-actions

Congratulations! 🎉 This was released as part of fastlane 2.233.0 🚀

monholm added 3 commits July 10, 2024 10:48

feat(s3_client_helper): add support for session_token

5716dfb

feat(match): add support for sts tokens in s3_storage

4e59adb

test(s3_client_helper): add test case for credentials with session_token

13b073a

github-actions Bot added the tool: match label Jul 10, 2024

oct0f1sh mentioned this pull request Jul 11, 2024

CircleCI PR check uses unsupported Ruby version #22141

Closed

4 tasks

monholm closed this Jul 31, 2024

monholm reopened this Jul 31, 2024

monholm added 4 commits November 19, 2024 20:03

Merge branch 'master' into feat/s3-storage-sts-support

40258fd

Merge branch 'fastlane:master' into feat/s3-storage-sts-support

0690cf9

Merge branch 'master' into feat/s3-storage-sts-support

276904a

Merge branch 'master' into feat/s3-storage-sts-support

e7389cc

Merge branch 'fastlane:master' into feat/s3-storage-sts-support

11a52b8

iBotPeaches changed the title ~~feat(s3_storage): add support for AWS STS credentials~~ [match] feat(s3_storage): add support for AWS STS credentials Mar 19, 2026

iBotPeaches requested a review from Copilot March 19, 2026 11:13

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread fastlane/lib/fastlane/helper/s3_client_helper.rb

Comment thread fastlane/spec/helper/s3_client_helper_spec.rb

test(s3_client_helper): check if session_token is passed to Aws::Cred…

d832d66

…entials constructor Co-authored-by: Copilot Autofix powered by AI <[email protected]>

iBotPeaches approved these changes Mar 19, 2026

View reviewed changes

iBotPeaches merged commit 8eb06f7 into fastlane:master Mar 19, 2026
9 checks passed

github-actions Bot added the status: included-in-next-release label Mar 19, 2026

github-actions Bot reviewed Mar 19, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 19, 2026

Version bump to 2.233.0 #29978

Merged

github-actions Bot reviewed Apr 19, 2026

View reviewed changes

github-actions Bot added status: released and removed status: included-in-next-release labels Apr 19, 2026

monholm deleted the feat/s3-storage-sts-support branch April 20, 2026 07:10

github-actions Bot locked and limited conversation to collaborators Jun 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[match] feat(s3_storage): add support for AWS STS credentials#22139

[match] feat(s3_storage): add support for AWS STS credentials#22139
iBotPeaches merged 9 commits into
fastlane:masterfrom
monholm:feat/s3-storage-sts-support

monholm commented Jul 10, 2024 •

edited

Loading

Uh oh!

monholm commented Jul 10, 2024

Uh oh!

monholm commented Aug 9, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

iBotPeaches commented Mar 19, 2026

Uh oh!

monholm commented Mar 19, 2026

Uh oh!

iBotPeaches left a comment

Uh oh!

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

monholm commented Jul 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Motivation and Context

Description

Testing Steps

Uh oh!

monholm commented Jul 10, 2024

Uh oh!

monholm commented Aug 9, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

iBotPeaches commented Mar 19, 2026

Uh oh!

monholm commented Mar 19, 2026

Uh oh!

iBotPeaches left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

monholm commented Jul 10, 2024 •

edited

Loading