d/aws_credentials: New Data Source

[Omarimcblack]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates #8242

Release note for CHANGELOG:

* **New Data Source:** `aws_credentials`

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSCredentials_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20
-run=TestAccAWSCredentials_ -timeout 120m
=== RUN   TestAccAWSCredentials_basic
=== PAUSE TestAccAWSCredentials_basic
=== CONT  TestAccAWSCredentials_basic
--- PASS: TestAccAWSCredentials_basic (62.60s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws
64.457s

...

[keeleysam]

This would be extremely useful when paired with https://registry.terraform.io/providers/vancluever/acme/latest/docs/guides/dns-providers-route53 if you're assuming a role.

[bflad]

Hi @Omarimcblack 👋 Thank you for submitting this.

In the security-minded interest of the community, the maintainers are hesitant to make it easy to exfiltrate active AWS credentials from a Terraform run in a manner such as this. There are valid use cases within Terraform as in the referenced issue, but those credentials may be then used completely outside of Terraform's context (e.g. if they are visible to CI logging then anyone with CI log access can see and use them locally). While implementing a data source like this is opt-in for practitioners, setting up controls/policies to block its usage is also opt-in and the need for these controls/policies has to be known either before or during the provider upgrade that includes the data source. Given those implications, having this ability within an officially released Terraform AWS Provider binary would not be acceptable in many organizations.

Rather than providing any sort of false hope with this particular implementation, I'm going to close this. Let's continue the discussion in #8242 as there are likely other ways we (the broader Terraform + AWS community) can solve this issue. 👍

[paultyng]

FWIW if you really need this functionality and since you have written the code, you can create a separate provider that reads the same information and contains this data source and then publish it on the registry.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!