'Multiple configurations present' error when overriding provider roles

[wandergeek]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.14

Affected Resource(s)

provider "aws"

Terraform Configuration Files

settings.tf

terraform {
  required_version = "0.11.14"

  backend "s3" {
    role_arn             = "arn:aws:iam::xxxxx:role/cross_account/sre"
    workspace_key_prefix = "xxxxxx"
    bucket               = "xxxxxx"
    key                  = "xxxxxx.tfstate"
    encrypt              = "true"
    region               = "ap-northeast-1"
  }
}

provider "aws" {
  region  = "ap-northeast-1"
  version = "2.15.0"

  assume_role {
    session_name = "terraform"
    role_arn     = "arn:aws:iam::xxxxxx:role/cross_account/sre"
  }
}

provider "aws" {
  region  = "ap-southeast-1"
  version = "2.15.0"
  alias   = "ap-southeast-1"

  assume_role {
    session_name = "terraform"
    role_arn     = "arn:aws:iam::xxxxxx:role/cross_account/sre"
  }
}

override.tf

terraform {
  required_version = "0.11.14"

  backend "s3" {
    role_arn             = "arn:aws:iam::xxxxx:role/services/terraform_ops"
    workspace_key_prefix = "xxxxxx"
    bucket               = "xxxxxx"
    key                  = "xxxxxx.tfstate"
    encrypt              = "true"
    region               = "ap-northeast-1"
  }
}

provider "aws" {
  region  = "ap-northeast-1"
  version = "2.15.0"

  assume_role {
    session_name = "terraform"
    role_arn     = "arn:aws:iam::xxxxxx:role/services/terraform_ops"
  }
}

provider "aws" {
  region  = "ap-southeast-1"
  version = "2.15.0"
  alias   = "ap-southeast-1"

  assume_role {
    session_name = "terraform"
    role_arn     = "arn:aws:iam::xxxxxx:role/services/terraform_ops"
  }
}

The only difference between settings.tf and the override file is the roles have been switched from arn:aws:iam::xxxxxx:role/cross_account/sre to arn:aws:iam::xxxxxx:role/services/terraform_ops.

Debug Output

Full output: https://gist.github.com/wandergeek/09ee3117c12cc47e5a5efef038e026dd

Expected Behavior

I should be able to override the role_arn for aws provider aliases.

Actual Behavior

Error message

Error: provider.aws.ap-southeast-1: multiple configurations present; only one configuration is allowed per provider

Steps to Reproduce

1. Create settings.tf and override.tf with the contents above.
2. Run make init

Important Factoids

• For 2HA regions, we create these aliases in order to provide 3HA for our platform.
• We have to swap these roles during CI runs for operational and security purposes

[justinretzolk]

Hey @wandergeek 👋 Thank you for taking the time to file this issue. Given that there's been a number of Terraform and AWS provider releases since you initially filed it, can you confirm whether you're still experiencing this behavior?