Add "credential_source" variable to S3 backend #18213
Comments
|
Hi @vanniszsu, Thanks for filing the issue. This would need to be a feature request for the aws provider first, since we use their authentication code to ensure the behavior is kept sin sync. Note that it's not necessary to put I'll defer to the aws provider developers' opinion on adding another configuration field, when the standard mechanisms for providing credentials already support this. |
|
@jbardin running into similar issue with the following setup: main.tf: terraform {
backend "s3" {
bucket = "lorem-example-prod-terraform"
dynamodb_table = "lorem-example-prod-terraform"
key = "foo/terraform.tfstate"
region = "us-west-2"
profile = "prod"
}
}
provider "aws" {
region = "us-west-2"
profile = "prod"
}~/.aws/config: [profile staging]
role_arn=arn:aws:iam::999999999:role/tf.staging.role
credential_source=Ec2InstanceMetadata
[profile prod]
role_arn=arn:aws:iam::888888888:role/tf.prod.role
credential_source=Ec2InstanceMetadataWhat's wrong here? I would expect Terraform to attempt to use the profile and retrieve the appropriate credentials from instance metadata. I did find the following issue: hashicorp/terraform-provider-aws#5018, which seems to suggest the aws go sdk only recently added support for Edit: |
|
Version 1.41.0 of the AWS provider should support Outside the built-in support from an AWS configuration file, we'll need to decide if adding the ability to configure the provider and/or backend with an extra |
|
Dependency update pull request submitted: #19190 |
|
@bflad thanks a bunch! I appreciate the quick response. I will say that I tried in a variety of ways to get this working with no success. My setup is a bit complicated, so I imagine I am missing something somewhere. Essentially, I have a terraform worker running in kubernetes that uses kube2iam to initially assume some role, let's call that roleA. roleA has the ability to assume 3 roles across different AWS accounts, Role1, Role2, Role3. For my Terraform configuration uses said profiles, so they can easily be reused for local plans and applies. Worth noting the above hasn't worked to date, so I am using a I have attempted with the latest version of terraform and the aws terraform provider, playing with my test quite a bit. In one test I attempted just using the Looking at Terraform debug, it appears the provider is attempting to use And the actual get callerid call from the provider: I am scratching my head. Sorry for the rant, just not sure others have been successful in a similar approach or if there are any tests in place that capture such a scenario. |
|
This is also still an issue with terraform |
|
This is also still an issue with terraform 0.12.18. aws-cli works perfectly with our configuration, however, terrafrom is not able to assume the correct role |
|
This issue should be resolved in current versions of Terraform. If you are still encountering this error, please open a new issue |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Terraform Version
Problem description
according to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
I've setup instance profile and attached a role to this instance profile, and also associate my EC2 instance to this instance profile
the role has been attached all the necessary policies, for the trusted relationship of this role, we allow ec2 service to assume it.
in AWS configuration, we can use credential_source=Ec2InstanceMetadata under [default] profile to make use of ec2 auto assumed https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#using-aws-iam-roles
but in Terraform S3 backend Configuration variables , there are only role_arn, profile, shared_credentials_file , but missing credential_source
Request Terraform S3 backend to have credential_source variable to match all the AWS authentication options
Expected Behavior
Terraform can read the meta data of the EC2 instance use the temporary access key and token from http://169.254.169.254/latest/meta-data/iam/security-credentials/ to access the S3
Actual Behavior
No credential_source
have to setup aws configuration as below first before I can run the terraform init
Steps to Reproduce
terraform initAdditional Context
The text was updated successfully, but these errors were encountered: