How to obscure AWS Account ID in SAM pipelineconfig.toml?

Question

It's been my understanding that exposing ones AWS Account ID in a public git repository isn't a great idea if it can be avoided. I'm currently spinning up a project with the SAM CLI, using the pipelines feature. This creates a file called `pipelineconfig.toml` which contains ARNs that show my AWS Account ID. (for IAM roles)
Is it possible to do some sort of variable replacement in the config file for the SAM pipeline that doesn't require extra complexity like a custom variable hydration script? Am I simply worrying too much about exposing my AWS Account ID?
[https://i.imgur.com/AlLnIOl.png](https://i.imgur.com/AlLnIOl.png)

Answer

I don't see any option for SAM to perform substitution in the configuration file itself. However, account IDs are not sensitive information (for example, see Corey Quinn's [recent article](https://www.lastweekinaws.com/blog/are-aws-account-ids-sensitive-information/) including a quote from AWS), so you don't really need to worry about masking them in the configuration file. Of course, you should still be careful not to commit actual credentials to your repo.

How to obscure AWS Account ID in SAM pipelineconfig.toml?

Contenus pertinents