Terraform ignores skip_credentials_validation flag for s3 backend with custom endpoint.

[mmeintker-tc]

Terraform Version

Terraform v1.6.0
on linux_amd64

Terraform Configuration Files

Provider config:

terraform {
  required_version = ">= 0.13"
  required_providers {
    openstack = {
      source = "terraform-provider-openstack/openstack"
    }
  }
  # will use backend tfvars file
  backend "s3" {}
}

tfvars:

endpoints = {
  s3 = "https://ceph.mydomain.tld:7480"
}
bucket = "tfstates"
key = "tfstate"
use_path_style = true
region = "us-east-1"
skip_credentials_validation = true
skip_region_validation = true

Debug Output

Initializing the backend...
╷
│ Error: Retrieving AWS account details: AWS account ID not previously found and failed retrieving via all available methods. See https://www.terraform.io/docs/providers/aws/index.html#skip_requesting_account_id for workaround and implications. Errors: 2 errors occurred:
│ * retrieving caller identity from STS: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: XXX, api error InvalidClientTokenId: The security token included in the request is invalid.
│ * retrieving account information via iam:ListRoles: operation error IAM: ListRoles, https response error StatusCode: 403, RequestID: XXX, api error InvalidClientTokenId: The security token included in the request is invalid.
│
│
│
│
╵

Error: Process completed with exit code 1.

Expected Behavior

Terraform should just initialize like it did with v1.5.5.

Actual Behavior

It tries to retrieve AWS account details, which it cannot becuase I'm not using an AWS backend.

Steps to Reproduce

1. export AWS_SECRET_ACCESS_KEY=<your S3 secret key>
2. export AWS_ACCESS_KEY_ID=<your S3 access key>
3. terraform init -backend-config=backend.tfvars

Additional Context

Reverting back to terraform v.1.5.5 fixed this issue.

References

No response

[hloeung]

Does the s3 backend need to expose the skip_requesting_account_id option as per the aws provider? So &awsbase.Config{} in https://github.com/hashicorp/terraform/blob/main/internal/backend/remote-state/s3/backend.go#L958C9-L958C24 ?

[josephpage]

This parameter is absolutely necessary if you want to use S3-compatible storage systems such as Ceph, Minio, Digitalocean, OVH or Scaleway as a backend, as they do not implement the STS API.

[cameronharriss]

For the above pull req would we use just the param in 1.6.1 using:

skip_requesting_account_id = true

[bestrocker221]

It still does not work in v1.6.2

Tried to set

    skip_region_validation      = true
    skip_credentials_validation = true
    skip_requesting_account_id  = true
    skip_metadata_api_check     = true

but keep getting

│ Error: Retrieving AWS account details: AWS account ID not previously found and failed retrieving via all available methods. See https://www.terraform.io/docs/providers/aws/index.html#skip_requesting_account_id for workaround and implications. Errors: 2 errors occurred:
│       * retrieving caller identity from STS: operation error STS: GetCallerIdentity, https response error StatusCode: 0, RequestID: , request send failed, Post "https://sts.XXXXX.amazonaws.com/": dial tcp: lookup sts.XXXXX: no such host
│       * retrieving account information via iam:ListRoles: operation error IAM: ListRoles, https response error StatusCode: 403, RequestID: ...... , api error InvalidClientTokenId: The security token included in the request is invalid.

[KaMaToZzz]

@josephpage @jar-b Any idies how fix this?

[lotusnoir]

I got it working replacing

endpoint = "https://s3.fr-par.scw.cloud"

by

    endpoints = { s3 = "https://s3.fr-par.scw.cloud" }
    skip_requesting_account_id = true

then

terraform init -reconfigure

[cdtzabra]

Moved from tf 1.6.0 to 1.6.4 and by adding skip_requesting_account_id = truefix the issue for me.

skip_requesting_account_id = truewas not recognized by tf 1.6.0

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.