From b0d27efaabf2dc4241c35e8bf45e3717e4f5cc19 Mon Sep 17 00:00:00 2001
From: Sathiyakumar Ganesan <sathiyakumar.ganesan1@nhs.net>
Date: Fri, 10 Jul 2026 12:02:15 +0100
Subject: [PATCH 1/3] Fix AWS account parameter usage and improve role
 existence check in assume role step

---
 azure/components/aws-assume-role.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/azure/components/aws-assume-role.yml b/azure/components/aws-assume-role.yml
index 0bb3e34..a7f430a 100644
--- a/azure/components/aws-assume-role.yml
+++ b/azure/components/aws-assume-role.yml
@@ -34,9 +34,9 @@ steps:
       aws_role="$(ROLE)"
       echo "assume role: '${aws_role}'"
 
-      if [[ "$AWS_ACCOUNT" =~ ^(prod|dev)$ ]]; then
-          echo "account is $AWS_ACCOUNT"
-          account_id="$(aws ssm get-parameter --name /account-ids/$AWS_ACCOUNT --query Parameter.Value --output text)"
+      if [[ "${{ parameters.aws_account }}" =~ ^(prod|dev)$ ]]; then # NOSONAR
+          echo "account is ${{ parameters.aws_account }}"
+          account_id="$(aws ssm get-parameter --name /account-ids/${{ parameters.aws_account }} --query Parameter.Value --output text)"
           if [[ "${aws_role}" != arn:aws:iam:* ]]; then
               aws_role="arn:aws:iam::${account_id}:role/${aws_role}"
           fi
@@ -46,7 +46,7 @@ steps:
           echo "check if role exists"
           # iam synchronisation issues can take a few to make the role appear
           for i in {1..15}; do
-            if aws iam get-role --role-name ${aws_role} > /dev/null; then
+            if aws iam get-role --role-name "${aws_role}" > /dev/null; then
               echo role exists
               sleep 2
               break
@@ -94,7 +94,6 @@ steps:
         sed -i "s#\[default\]#\[profile ${profile}\]#" ~/.aws/config
       fi
     env:
-      AWS_ACCOUNT: ${{ parameters.aws_account }}
       PROFILE: ${{ parameters.profile }}
     displayName: assume role
     condition: and(succeeded(), eq(variables['ROLE_EXISTS'], 'true'))

From 03b7fc0ae7d06009133433a963c48345746a64d2 Mon Sep 17 00:00:00 2001
From: Sathiyakumar Ganesan <sathiyakumar.ganesan1@nhs.net>
Date: Fri, 10 Jul 2026 12:05:27 +0100
Subject: [PATCH 2/3] Refactor account ID retrieval for clarity in assume role
 step

---
 azure/components/aws-assume-role.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/azure/components/aws-assume-role.yml b/azure/components/aws-assume-role.yml
index a7f430a..44a4470 100644
--- a/azure/components/aws-assume-role.yml
+++ b/azure/components/aws-assume-role.yml
@@ -35,8 +35,8 @@ steps:
       echo "assume role: '${aws_role}'"
 
       if [[ "${{ parameters.aws_account }}" =~ ^(prod|dev)$ ]]; then # NOSONAR
-          echo "account is ${{ parameters.aws_account }}"
-          account_id="$(aws ssm get-parameter --name /account-ids/${{ parameters.aws_account }} --query Parameter.Value --output text)"
+          echo "account is ${{ parameters.aws_account }}" # NOSONAR
+          account_id="$(aws ssm get-parameter --name /account-ids/${{ parameters.aws_account }} --query Parameter.Value --output text)" # NOSONAR
           if [[ "${aws_role}" != arn:aws:iam:* ]]; then
               aws_role="arn:aws:iam::${account_id}:role/${aws_role}"
           fi

From 5a438e57b5f641034f532d83cd8cc4bd2cd96d7a Mon Sep 17 00:00:00 2001
From: Sathiyakumar Ganesan <sathiyakumar.ganesan1@nhs.net>
Date: Fri, 10 Jul 2026 12:32:17 +0100
Subject: [PATCH 3/3] Fix account parameter usage in assume role step for
 improved clarity

---
 azure/components/aws-assume-role.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/azure/components/aws-assume-role.yml b/azure/components/aws-assume-role.yml
index 44a4470..862702e 100644
--- a/azure/components/aws-assume-role.yml
+++ b/azure/components/aws-assume-role.yml
@@ -34,9 +34,9 @@ steps:
       aws_role="$(ROLE)"
       echo "assume role: '${aws_role}'"
 
-      if [[ "${{ parameters.aws_account }}" =~ ^(prod|dev)$ ]]; then # NOSONAR
-          echo "account is ${{ parameters.aws_account }}" # NOSONAR
-          account_id="$(aws ssm get-parameter --name /account-ids/${{ parameters.aws_account }} --query Parameter.Value --output text)" # NOSONAR
+      if [[ "${ACCOUNT}" =~ ^(prod|dev)$ ]]; then
+          echo "account is ${ACCOUNT}"
+          account_id="$(aws ssm get-parameter --name /account-ids/${ACCOUNT} --query Parameter.Value --output text)"
           if [[ "${aws_role}" != arn:aws:iam:* ]]; then
               aws_role="arn:aws:iam::${account_id}:role/${aws_role}"
           fi
@@ -95,5 +95,6 @@ steps:
       fi
     env:
       PROFILE: ${{ parameters.profile }}
+      ACCOUNT: ${{ parameters.aws_account }}
     displayName: assume role
     condition: and(succeeded(), eq(variables['ROLE_EXISTS'], 'true'))