provider/aws: Add support for AssumeRole prior to operations

[jen20]

This PR builds on the work of @imduffy15 in #8506, adding in support for Session Name and External ID, and changing around the configuration block a bit.

There is still a case which needs fixing regarding the error message when no valid source credentials are passed in, and also if the source credentials are valid but the role cannot be assumed.

Automated testing is left as a follow-up to this - we have a strategy in place but it requires some (more broadly useful) changes to the acceptance testing harness to be feasible.

Fixes #1275.

[stack72]

why errors.New and not errWrap?

[jen20]

We are generating a new error rather than wrapping one produced by an upstream API?

[stack72]

@jen20 so pleased to see this included. I left a few nit picks about the ordering of error checking and about what way we throw errors. These are not show stoppers at all :) More nit picks

[stack72]

LGTM! Nice work :)

[imduffy15]

Thanks for making this happen @stack72 and @jen20

[bentterp]

I totally don't understand how to use this, could somebody please explain? I've read through #1275 as well, without any light bulbs going off.

Until now, we've been using a script that does STS::AssumeRole with MFA, obtains the temporary credentials, exports them as environment variables. After that, we happily continue with terraform plan and apply.

Is there now a smarter way of doing this?

[imduffy15]

Hi @benttrep,
There is indeed, there's no more need for assume role scripts.

Authenticate to your account that has the assume role privilege using any of the standard authentication methods(env vars, profile, ec2 IAM role etc).

Then just follow the docs at https://www.terraform.io/docs/providers/aws/

[bentterp]

Aaah 😲 This is awesome ❗

And the docs were updated as part of the release 👍

A suggestion: could we have a link to the updated docs included in the changelog? As the documentation grows, it becomes harder and harder to spot the changes in the docs.

E.g. https://www.terraform.io/docs/providers/aws/index.html#Assume_role - and yes, anchors in the docs would be great.

[drdamour]

i'm probably missing something but the docs aren't really followable...i have the arn_role block in my assume role...but it's not working. always get

Error refreshing state: 1 error(s) occurred:

* The role "arn:aws:iam:::role/devops" cannot be assumed.

  There are a number of possible causes of this - the most common are:
    * The credentials used in order to assume the role are invalid
    * The credentials do not have appropriate permission to assume the role
    * The role ARN is not valid

how would i know what value to put in session_id and external_id? i expected terraform to prompt me for my MFA value.

[jen20]

Hi @drdamour! There are a few different issues in your example:

Firstly the role ARN is indeed not valid - they have an account ID in them. The IAM console will show you the correct ARN for a given role. This covers the third error.

Secondly, Assuming a role has two aspects:

• the first is acquiring a session token - the sts:GetSessionToken API operation. This is where an MFA code is typically specified. Terraform does not do this for you (though if running as part of Terraform Enterprise it can be configured).
• the second is assuming a role - the sts:AssumeRole operation. Roles may specify as part of the specification that in order to be assumed, the session token provided must have an MFA token attached. This is the part that Terraform does for you if the role_arn option is specified.

In order to fix your example you'll need to do the following:

1. Fix the role ARN so it is valid
2. Make a call to sts:GetSessionToken via whatever mechanism you would use for the CLI (likely aws sts get-session-token) and use the credentials returned as the values to AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN.

[drdamour]

thanks, i was obfuscating my role id...i'm using a valid one. the whole reason we had the script was to get the session token. i suspect that's what @bentterp 's script was doing as well...so alas you still need a wrapper script to do stuff with MFA..that sucks.

thanks for confirming.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.