dflook/terraform-plan@v1 => Error: failed to get shared config profile, prod

[alunduil-gs]

Problem description

I'm not sure if this is a duplicate of #285 or not so I'm opening this separately. Please mark as duplicate and I'll move discussion into #285 if that's preferred.

When this attempts to run AWS authentication is successful, shows the expected identity and has updated both the configuration and the environment, but I continually get the aforementioned error during the Plan step: Error: failed to get shared config profile, prod

I'm guessing this might be due to how the AWS credentials for multiple profiles are passed into the action but haven't been able to track that down. Any help is appreciated here. Thanks!

I did set ACTIONS_STEP_DEBUG to true in the environment of the step but there wasn't a secret configuration that I was seeing so maybe I'm missing something obvious about how to set that parameter as well.

Terraform version

1.11.1

Backend

No response

Workflow YAML

plan:
    needs: validate
    runs-on: ubuntu-latest
    name: Plan
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: mcblair/configure-aws-profile-action@v1.0.0
        with:
          region: ${{ inputs.region }}
          role-arn: redacted
          profile-name: ${{ inputs.profile }}
  
      - name: Plan
        uses: dflook/terraform-plan@v1
        with:
          path: ${{ inputs.path }}
        env: 
          ACTIONS_STEP_DEBUG: true
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Workflow log

Run dflook/terraform-plan@v1
  with:
    path: terraform/prod/aws_global
    workspace: default
    destroy: false
    add_github_comment: true
    parallelism: 0
  env:
    AWS_DEFAULT_REGION: us-east-1
    AWS_REGION: us-east-1
    AWS_ACCESS_KEY_ID: 
    AWS_SECRET_ACCESS_KEY: 
    AWS_SESSION_TOKEN: 
    ACTIONS_STEP_DEBUG: true
    GITHUB_TOKEN: ***
/usr/bin/docker run --name danielflookterraformgithubactionssha2567aef5fd3c9c6b005c5fe0a77b3065e5a2eeed4650993041a54c25013761237f7_62d648 --label 77c427 --workdir /github/workspace --rm -e "AWS_DEFAULT_REGION" -e "AWS_REGION" -e "AWS_ACCESS_KEY_ID" -e "AWS_SECRET_ACCESS_KEY" -e "AWS_SESSION_TOKEN" -e "ACTIONS_STEP_DEBUG" -e "GITHUB_TOKEN" -e "INPUT_PATH" -e "INPUT_WORKSPACE" -e "INPUT_LABEL" -e "INPUT_VARIABLES" -e "INPUT_VAR_FILE" -e "INPUT_VAR" -e "INPUT_BACKEND_CONFIG" -e "INPUT_BACKEND_CONFIG_FILE" -e "INPUT_REPLACE" -e "INPUT_TARGET" -e "INPUT_DESTROY" -e "INPUT_ADD_GITHUB_COMMENT" -e "INPUT_PARALLELISM" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_ENVIRONMENT" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e "ACTIONS_ID_TOKEN_REQUEST_URL" -e "ACTIONS_ID_TOKEN_REQUEST_TOKEN" -e "ACTIONS_RESULTS_URL" -e GITHUB_ACTIONS=true -e CI=true --entrypoint "/entrypoints/plan.sh" -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/GSInfra/GSInfra":"/github/workspace" danielflook/terraform-github-actions@sha256:7aef5fd3c9c6b005c5fe0a77b3065e5a2eeed4650993041a54c25013761237f7
Installing Terraform
  gpg: Signature made Wed Mar  5 12:18:45 2025 UTC
  gpg:                using RSA key 374EC75B485913604A831CC7C820C6D5CD27AB87
  gpg: Good signature from "HashiCorp Security (hashicorp.com/security) <security@hashicorp.com>" [ultimate]
  terraform_1.11.1_linux_amd64.zip: OK
  Using latest Terraform version that matches the required_version constraints
  Switched to Terraform v1.11.1
  Terraform v1.11.1
  on linux_amd64
  Detected s3 backend
Initializing Terraform
  Initializing the backend...
  ╷
  │ Warning: Deprecated Parameter
  │ 
  │   on main.tf line 8, in terraform:
  │    8:     dynamodb_table = "production_terraform_state_locks"
  │ 
  │ The parameter "dynamodb_table" is deprecated. Use parameter "use_lockfile"
  │ instead.
  ╵
  ╷
  │ Error: failed to get shared config profile, prod
  │ 
  │ 
  ╵

Has debug logging been enabled?

• Yes, the ACTIONS_STEP_DEBUG secret was set to true when capturing the workflow log above. I understand that if I have not done this, I may not recieve a response.

[dflook]

From the error message it looks like your s3 backend block is configured to use a specific AWS profile. The mcblair/configure-aws-profile-action step will configure this profile for the runner environment, but this is not shared with docker based actions.

You would need to configure the profile inside the terraform step. you can use the TERRAFORM_PRE_RUN environment variable to run commands inside the container. Perhaps something like:

plan:
    steps:
      - name: Plan
        uses: dflook/terraform-plan@v1
        with:
          path: ${{ inputs.path }}
        env: 
          TERRAFORM_PRE_RUN: |
            mkdir -p ~/.aws
            echo "[prod]" > ~/.aws/credentials
            echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" >> ~/.aws/credentials
            echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" >> ~/.aws/credentials
            echo "aws_session_token=$AWS_SESSION_TOKEN" >> ~/.aws/credentials
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

I haven't tested this.

ACTIONS_STEP_DEBUG needs to be set in the repository settings as a Actions secret or variable to work, see here. I don't think the logs are needed for this issue though.

[alunduil-gs]

Thanks! I'll give that a try and update if I'm still running into issues.

[alunduil-gs]

That did the trick, would it be possible to request that this be added as an option (link_aws_profiles as a list) in future versions to simplify this workflow? I'll leave this open for your consideration, but the original issue is resolved if you want to close this. Thanks again!