作者：阳光-沙滩男人 | 来源：互联网 | 2023-07-27 19:22
When using multiple AWS accounts it's good practice to only allow access via AssumeRole from a master account. This can be done with or without requiring MFA. Terraform supports assume_role with s3 state file and aws provider configurations, but doesn't seem to ask the MFA token code when one is required. This prevents using AssumeRole for credentials when MFA is required.
AWS documentation describing MFA with cross account AssumeRole: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html#MFAProtectedAPI-cross-account-delegation
Terraform Version
1
2
| $ terraform --version
Terraform v0.11.0 |
Affected Resource(s)
Both of these support assume_role, so they should also support asking for MFA token code:
- S3 backend configuration
- AWS provider configuration
Terraform Configuration Files
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| hcl
terraform {
backend "s3" {
bucket &＃061; "terraform-state-bucket"
key &＃061; "tf-state"
region &＃061; "eu-west-1"
role_arn &＃061; "arn:aws:iam::916005212345:role/OrganizationAccountAccessRole"
}
}
provider "aws" {
region &＃061; "eu-west-1"
assume_role {
role_arn &＃061; "arn:aws:iam::916005212345:role/OrganizationAccountAccessRole"
session_name &＃061; "terraform-session"
}
} |
Actual Behavior (with DEBUG)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
| $ TF_LOG&＃061;debug terraform init
2017/11/23 13:36:12 [INFO] Terraform version: 0.11.0
2017/11/23 13:36:12 [INFO] Go runtime version: go1.9.2
2017/11/23 13:36:12 [INFO] CLI args: []string{"/usr/local/Cellar/terraform/0.11.0/bin/terraform", "init"}
2017/11/23 13:36:12 [DEBUG] Attempting to open CLI config file: /Users/***/.terraformrc
2017/11/23 13:36:12 [DEBUG] File doesn&＃039;t exist, but doesn&＃039;t need to. Ignoring.
2017/11/23 13:36:12 [INFO] CLI command args: []string{"init"}
2017/11/23 13:36:12 [DEBUG] command: loading backend config file: /Users/***
Initializing the backend...
2017/11/23 13:36:12 [WARN] command: backend config change! saved: 16375281725947963338, new: 2383462577283113429
Backend configuration changed!
Terraform has detected that the configuration specified for the backend
has changed. Terraform will now reconfigure for this backend. If you didn&＃039;t
intend to reconfigure your backend please undo any changes to the "backend"
section in your Terraform configuration.
2017/11/23 13:36:12 [INFO] Building AWS region structure
2017/11/23 13:36:12 [INFO] Building AWS auth structure
2017/11/23 13:36:12 [INFO] Setting AWS metadata API timeout to 100ms
2017/11/23 13:36:13 [INFO] Ignoring AWS metadata API endpoint at default location as it doesn&＃039;t return any instance-id
2017/11/23 13:36:13 [INFO] Attempting to AssumeRole arn:aws:iam::***:role/OrganizationAccountAccessRole (SessionName: "", ExternalId: "", Policy: "")
2017/11/23 13:36:13 [INFO] AWS Auth provider used: "SharedCredentialsProvider"
2017/11/23 13:36:13 [DEBUG] plugin: waiting for all plugin processes to complete...
Error initializing new backend:
Error configuring the backend "s3": The role "arn:aws:iam::***:role/OrganizationAccountAccessRole" cannot be assumed.
There are a number of possible causes of this - the most common are:
* The credentials used in order to assume the role are invalid
* The credentials do not have appropriate permission to assume the role
* The role ARN is not valid
Please update the configuration in your Terraform files to fix this error
then run this command again. |
该提问来源于开源项目：terraform-providers/terraform-provider-aws
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| provider "aws" {
profile &＃061; "prod"
region &＃061; "eu-west-1"
version &＃061; "3.4.0"
}
terraform {
required_version &＃061; "0.13.2"
backend "s3" {
profile &＃061; "prod"
region &＃061; "eu-west-1"
dynamodb_table &＃061; "terraform-locks"
bucket &＃061; "prod-terraform-states"
}
} |
Also you could check with
1
2
| export AWS_SDK_LOAD_CONFIG&＃061;1
aws --profile prod sts get-caller-identity |
it should use credentials from aws-vault and ask for mfa only once
or run aws-vault directly:
1
| env AWS_SDK_LOAD_CONFIG&＃061;0 aws-vault --some-backend-options --prompt&＃061;osascript exec --region eu-west-1 --duration&＃061;1h root --json |
京公网安备 11010802041100号