3

I would like to use AWS Assume Roles, with Terraform Cloud / Enterprise

In Terraform Open Source, you would typically just do an Assume Role, leveraging the .aws/Credential Profile on the CLI, which is the initial authentication, and performing the Assume Role:

provider "aws" {
  assume_role {
    role_arn     = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
    session_name = "SESSION_NAME"
    external_id  = "EXTERNAL_ID"
  }
}

The issue is, with Terraform Enterprise or Cloud, you cannot reference a profile, as the immutable infrastructure will not have that file in its directory.

Terraform Cloud/Enterprise needs to have an Access Key ID, and Secret Access Key, set as a variable, so its infrastructure can perform the Terraform RUN, via its Pipeline, and authenticate to what ever AWS Account you would like to provision within.

So the question is: How can I perform an AWS Assume Role, leveraging the Access Key ID, and Secret Access Key, of the AWS account with the "Action": "sts:AssumeRole", Policy?

I would think, the below would work, however Terraform is doing the initial authentication via the AWS Credential Profile creds, for the account which has the sts:AssumeRole policy

Can Terraform look at the access_key, and secret_key, to determine what AWS account to use, when trying to assume the role, rather than use the AWS Credential Profile?

provider "aws" {
  region                  = var.aws_region
  access_key              = var.access_key_id
  secret_key              = var.secret_access_key

    assume_role {
    role_arn     = "arn:aws:iam::566264069176:role/RemoteAdmin"
    #role_arn     = "arn:aws:iam::<awsaccount>:role/<rolename>" # Do a replace in "file_update_automation.ps1"
    session_name = "RemoteAdminRole"
  }
}

In order to allow Terraform Cloud/Enterprise to get new Assume Role Session Tokens, it would need to use the Access_key and Secret_key, to tell it what AWS Account has the sts:assume role, linking to the member AWS Account to be provisioned, and not an AWS Creds Profile

Thank you

Gvazzana
  • 433
  • 5
  • 14
  • Bumping this question. Is it possible, in Terraform Open Source, or Terraform Cloud / Enterprise to leverage AWS Assume Roles, while using the .AWS/Credentials File Profile only for initial auth or scripts, than use AWS Assume Roles, leverage the defined Access_key and Secret_key, and NOT the credentials profile? – Gvazzana Apr 13 '20 at 14:40
  • Seems safe to assume that this can't be done and there's no work around currently? – Aaron Bruce May 24 '21 at 15:39
  • @Gvazzana I would say using Hashicorp Vault for dynamic credential is the only and best method so far. – Lee.Tan May 27 '21 at 14:57

0 Answers0