v1 Implementation

[naftulikay]

Docs

• Terraform Cloud Docs: Dynamic Credentials with the AWS Provider
• GitHub: hashicorp/terraform-dynamic-credentials-setup-examples: Sample Code for AWS Setup

Overview

Similar to what we did for setting up GitHub OIDC for AWS IAM access, Terraform Cloud can also be configured so as to assume roles dynamically without storing any credentials anywhere.

This should be a fairly simple module, as all it will do is create the aws_iam_openid_connect_provider for Terraform Cloud, which will look like this:

terraform {
  required_providers {
    aws = {}
    tls = {}
  }
}

data tls_certificate default {
  # should be configurable for terraform enterprise
  url = "https://app.terraform.io"
}

resource aws_iam_openid_connect_provider default {
  url = data.tls_certificate.default.url
  client_id_list = ["aws.workload.identity"]
  thumbprint_list = [data.tls_certificate.default.certificates[0].sha1_fingerprint]
}

This is essentially all that needs doing for the actual infrastructure, but we should also provide an example for usage.

Usage Example

Once this is created, we need to create IAM roles with an assume policy that allows the OIDC provider to assume the given role.

data aws_iam_policy_document assume {
  statement {
    sid = "AllowAssumeFromTerraformCloud"
    effect = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]
    principals {
      type = "Federated"
      identifiers = [aws_iam_openid_connect_provider.default.arn]
    }

    condition {
      test = "StringEquals"
      variable = "app.terraform.io:aud"
      values = ["aws.workload.identity"]
    }

    condition {
      test = "StringLike"
      variable = "app.terraform.io:sub"
      values = [
        # here we can constrain things fairly specifically, we have the org name, project name,
        # workspace name, and run phase (plan or apply). we can wildcard too, so that's nice
        "organization:my-org:project:my-project:workspace:*:run_phase:*"
      ]
    }
  }
}

Particularly of note is that we can get extremely granular with the permissions here. We can hardcode the org/project/workspace/run phase, or we can wildcard to, say, allow any workspace in a specific org or org/project to assume the role. We can even limit the assume to only be applicable during the plan phase or run phase, to provide read-only access during plan.

Terraform Cloud Setup

With this finished, we have to do some configuration of Terraform Cloud. We'll need to set the following environment variables on all workspaces using the OIDC provider to access AWS:

• TFC_AWS_PROVIDER_AUTH should be set to true
• TFC_AWS_RUN_ROLE_ARN should be set to the ARN of the role to be assumed.