Error getting creds when assuming role and using fallback credentials

[YakDriver]

Related issues:

• Pass credentials to local-exec OR extract credentials via properties terraform-provider-aws#8242
• Terraform AWS provider unable to assume role using profile that assumes a role itself terraform-provider-aws#8052
• AWS assume role not working (regression?) terraform-provider-aws#6566
• assume_role does not use custom sts endpoint terraform-provider-aws#6424
• AWS config role_arn not working terraform-provider-aws#5592
• Doesn't ask MFA token code when using assume_role with MFA required terraform-provider-aws#2420

Currently, session-derived credentials are obtained after execution has passed the assume role logic.

Currently Session-derived creds without profile:

GetSession()
    |
    |---> GetSessionOptions()
            |
            |---> GetCredentials()
            |       |
            |       |---> ASSUME ROLE (starting awsauth.go:233)
            |
            |--- SESSION-DERIVED CREDS OBTAINED, if no profile (session.go:49)

Currently Session-derived creds with profile:

GetSession()
    |
    |---> GetSessionOptions()
    |       |
    |       |---> GetCredentials()
    |       |       |
    |       |       |---> ASSUME ROLE (starting awsauth.go:233)
    |       |
    |       |--- Profile set (session.go:59)
    |       
    |--- SESSION-DERIVED CREDS OBTAINED, if profile (session.go:94)

Specific resultant issue:

• On the awsauth.go path, you cannot assume a role if your credentials come from a credential process. However, you can assume a role if your credentials come from a shared credentials profile.

The error that you can expect to see:

Error: Error refreshing state: 1 error(s) occurred:

* provider.aws: No valid credential sources found for AWS Provider.
  Please see https://terraform.io/docs/providers/aws/index.html for more information on
  providing credentials for the AWS Provider

[YakDriver]

Testing Results

👍 credential_process credentials without assume_role

This works:

provider "aws" {
  profile = "credproc"
  region  = "us-east-1"
}

Here the shared credentials file has something along these lines:

[credproc]
credential_process = /some/process/that/returns/creds

👍 Regular credentials with assume_role

This works:

provider "aws" {
  profile = "default"
  region  = "us-east-1"

  assume_role {
    role_arn     = "arn:aws:iam::<ACCOUNT ID>:role/<ROLE NAME>"
    session_name = "<SESSION NAME>"
    external_id  = "<EXTERNAL ID>"
  }
}

👎 Credential process with assume role

This fails:

provider "aws" {
  profile = "credproc"
  region  = "us-east-1"

  assume_role {
    role_arn     = "arn:aws:iam::<ACCOUNT ID>:role/<ROLE NAME>"
    session_name = "<SESSION NAME>"
    external_id  = "<EXTERNAL ID>"
  }
}

The error:

$ terraform apply

Error: Error refreshing state: 1 error(s) occurred:

* provider.aws: No valid credential sources found for AWS Provider.
  Please see https://terraform.io/docs/providers/aws/index.html for more information on
  providing credentials for the AWS Provider

The corresponding AWS CLI command does work:

$ aws sts assume-role --role-arn arn:aws:iam::<ACCOUNT ID>:role/<ROLE NAME> --external-id <EXTERNAL ID> --role-session-name <SESSION NAME> --profile credproc

👍 Temporary security credentials with assume role

This works:

provider "aws" {
  profile = "temp"
  region  = "us-east-1"

  assume_role {
    role_arn     = "arn:aws:iam::<ACCOUNT ID>:role/<ROLE NAME>"
    session_name = "<SESSION NAME>"
    external_id  = "<EXTERNAL ID>"
  }
}

Role associated with temporary security credentials must have this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::*:role/<ROLE NAME>"
            ]
        }
    ]
}

The corresponding AWS CLI command also works:

$ aws sts assume-role --role-arn arn:aws:iam::<ACCOUNT ID>:role/<ROLE NAME> --external-id <EXTERNAL ID> --role-session-name <SESSION NAME> --profile temp

[YakDriver]

I'm making an effort to collect the credential tests in a quick and dirty repo. I think this will help inform an eventual solution. If you have something that's not working, it's easy to add a new test based on the existing set: https://github.com/YakDriver/terraform-cred-tests

[scalp42]

I can confirm @YakDriver seeing the same situation regarding all the scenarios you showed.

[evandam]

Confirming the same as @YakDriver and @scalp42 here.

[danielov1]

Is this issue resolved?