Add support for Task Roles when running on ECS or CodeBuild

[jekh]

This is a port of my original PR #14199 from the terraform repo, before the provider spin-off in 0.10+. It addresses #259.

Here's the comment from the original PR:

[This PR] adds the RemoteCredProvider from the AWS SDK if the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set. The RemoteCredProvider uses the value of that environment variable and appends it to the hard-coded URL http://169.254.170.2, and uses the resulting URL to obtain Task Role credentials.

The benefit of this approach is that it falls back to the default AWS SDK to obtain ECS credentials. It may be valuable to always fall back to the default SDK unless specific terraform overrides are configured, rather than providing a custom credentials bootstrap or mimicking the SDK behavior, so that terraform is able to automatically take advantage of future updates to the SDK's credential-finding behavior.

[kshcherban]

When is this going to be merged?

[radeksimko]

Thanks for the contribution.

Thinking out laud:

It would've been safer to have a test with mock of the ECS/IAM credentials endpoint and just append the provider at all times.

That would however require new skip_* option in the provider block, so that folks running in some obscure environments sensitive on overall no of API calls can avoid it.

So to sum it up - it's probably not worth the effort until this method of auth is going to expand.

I did test this in a real ECS environment (slightly modified example, CoreOS latest stable, latest ECS agent) - it worked fine, so this LGTM. 👍

[jch254]

Is this solving hashicorp/terraform#16278? I'm still facing the issue with TF 0.11.1 and AWS provider 1.6 - Error configuring the backend "s3": No valid credential sources found for AWS Provider.

[jch254]

I can confirm this is now working in CodeBuild WITHOUT the pre_build phase I posted above. Terraform 0.11.7 and Terraform AWS provider 1.14.1. Brilliant work 👍

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!