Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

backend/s3: Support New af-south-1 Region Automatic Validation #24741

Closed
bflad opened this issue Apr 22, 2020 · 2 comments · Fixed by #24745
Closed

backend/s3: Support New af-south-1 Region Automatic Validation #24741

bflad opened this issue Apr 22, 2020 · 2 comments · Fixed by #24745
Labels
backend/s3 enhancement

Comments

@bflad
Copy link
Contributor

bflad commented Apr 22, 2020

Current Terraform Version

Terraform v0.12.24

Use-cases

https://aws.amazon.com/about-aws/whats-new/2020/04/announcing-aws-africa-cape-town-region/

Amazon Web Services (AWS) is announcing the immediate availability of the AWS Africa (Cape Town) Region, which is the first AWS Region in Africa. The AWS Africa (Cape Town) Region consists of three Availability Zones

The region shorthand name is af-south-1. Allow S3 Back storage in the new region without special backend configuration.

Attempted Solutions

terraform {
  # ... potentially other configuration ...

  backend "s3" {
    # ... other configuration ...

    region = "af-south-1"
  }
}
$ terraform init

Initializing the backend...

Error: Invalid AWS Region: af-south-1

Available Workaround

terraform {
  # ... potentially other configuration ...

  backend "s3" {
    # ... other configuration ...

    region                 = "af-south-1"
    skip_region_validation = true
  }
}

Proposal

Update AWS Go SDK dependency to v1.30.12, which contains new region endpoint information.

References
@bflad bflad mentioned this issue Apr 22, 2020
Merged
bflad added a commit that referenced this issue Apr 22, 2020
@bflad
deps: github.com/aws/aws-sdk-go@v1.30.12
020dda9 
Reference: #24710
Reference: #24741

Changes:

```
NOTES:

* backend/s3: Region validation now automatically supports the new `af-south-1` (Africa (Cape Town)) region. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the [AWS Documentation](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable). When the region is not enabled, the Terraform S3 Backend will return errors during credential validation (e.g. `error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid`).

ENHANCEMENTS:

* backend/s3: Support automatic region validation for `af-south-1`
* backend/s3: Support Client Side Metrics (CSM) options from shared configuration file
* backend/s3: Support IAM Roles for Service Accounts (IRSA) via `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE` environment variables
```

Updated via:

```console
$ go get github.com/aws/aws-sdk-go@v1.30.12
$ go mod tidy
$ go mod vendor
```

Output from acceptance testing:

```console
$ TF_ACC=1 go test -v ./backend/remote-state/s3 | grep '^--- '
--- PASS: TestBackend_impl (0.00s)
--- PASS: TestBackendConfig (1.68s)
--- PASS: TestBackendConfig_invalidKey (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyLength (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyEncoding (0.00s)
--- PASS: TestBackendConfig_conflictingEncryptionSchema (0.00s)
--- PASS: TestBackend (15.07s)
--- PASS: TestBackendLocked (26.40s)
--- PASS: TestBackendSSECustomerKey (16.99s)
--- PASS: TestBackendExtraPaths (12.05s)
--- PASS: TestBackendPrefixInWorkspace (5.55s)
--- PASS: TestKeyEnv (45.07s)
--- PASS: TestRemoteClient_impl (0.00s)
--- PASS: TestRemoteClient (5.39s)
--- PASS: TestRemoteClientLocks (14.30s)
--- PASS: TestForceUnlock (20.08s)
--- PASS: TestRemoteClient_clientMD5 (16.43s)
--- PASS: TestRemoteClient_stateChecksum (24.58s)
```
@bflad bflad mentioned this issue Apr 22, 2020
Merged
bflad added a commit that referenced this issue Apr 24, 2020
@bflad @nicolasenno
deps: github.com/aws/aws-sdk-go@v1.30.12 [master] (#24745)
2681ccf 
* update github.com/aws/aws-sdk-go to v1.30.9

* deps: github.com/aws/aws-sdk-go@v1.30.12

Reference: #24710
Reference: #24741

Changes:

```
NOTES:

* backend/s3: Region validation now automatically supports the new `af-south-1` (Africa (Cape Town)) region. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the [AWS Documentation](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable). When the region is not enabled, the Terraform S3 Backend will return errors during credential validation (e.g. `error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid`).

ENHANCEMENTS:

* backend/s3: Support automatic region validation for `af-south-1`
```

Updated via:

```console
$ go get github.com/aws/aws-sdk-go@v1.30.12
$ go mod tidy
$ go mod vendor
```

Output from acceptance testing:

```console
$ TF_ACC=1 go test -v ./backend/remote-state/s3 | grep '^--- '
--- PASS: TestBackend_impl (0.00s)
--- PASS: TestBackendConfig (1.68s)
--- PASS: TestBackendConfig_invalidKey (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyLength (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyEncoding (0.00s)
--- PASS: TestBackendConfig_conflictingEncryptionSchema (0.00s)
--- PASS: TestBackend (15.07s)
--- PASS: TestBackendLocked (26.40s)
--- PASS: TestBackendSSECustomerKey (16.99s)
--- PASS: TestBackendExtraPaths (12.05s)
--- PASS: TestBackendPrefixInWorkspace (5.55s)
--- PASS: TestKeyEnv (45.07s)
--- PASS: TestRemoteClient_impl (0.00s)
--- PASS: TestRemoteClient (5.39s)
--- PASS: TestRemoteClientLocks (14.30s)
--- PASS: TestForceUnlock (20.08s)
--- PASS: TestRemoteClient_clientMD5 (16.43s)
--- PASS: TestRemoteClient_stateChecksum (24.58s)
```

Co-authored-by: Nicola Senno <nicola.senno@workday.com>
@bflad
Copy link
Contributor Author

bflad commented Apr 24, 2020

Support for this has been merged into master, which is currently the development branch for the first releases of Terraform CLI v0.13. Please follow #24745 and the v0.12 branch for updates about any potential Terraform CLI v0.12.25 release that would also contain this update.

@ghost
Copy link

ghost commented May 25, 2020

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@ghost ghost locked and limited conversation to collaborators May 25, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
backend/s3 enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

deps: github.com/aws/aws-sdk-go@v1.30.12 [master] hashicorp/terraform
1 participant
@bflad