Hey guys, I'm having an issue in version

1.202.0

and up where now the role authentication is now being resolved correctly. I use asume roles with SSO logging and this works perfectly on versions before that one but since this version the role is not resolving correctly even when the

backend.tf.json

and

providers.tf.json

file looks good. the only thing I see that might be the issue is that I use interpolation on the org config to generate this roles and on the terminal the role is not resolving but as mention before the files are looking good. any suggestion or any changes on how atmos resolved interpolation that it might affect this?

Did you try 1.202.1 that was released lastnight

@Miguel Zablah please try

1.202.1

If not working, what prev version works? 1.201.0 ? also, please provide our auth config so we could test it

I have try

1.202.1

and it also don't work 😢

@Miguel Zablah please open an issue and provide your configuration - would be much easier to trace it (re: "I use interpolation on the org config to generate this roles and on the terminal the role is not resolving but as mention before the files are looking good")

I use asume roles with SSO logging

Do you use assume role with

atmos auth

and identities, or in terraform?

@Erik Osterman (Cloud Posse) I want to move to

atmos auth

but that will have to wait to next year 😛 I'm using terraform orgs to template the terraform roles to assume so I have in

orgs/acme/_defaults.yaml

the backend configuration like normal:

terraform:
  backend_type: s3
  backend:
    s3:
      encrypt: true
      use_lockfile: true
      bucket: '{{ .vars.namespace }}-gbl-root-tfstate'
      key: 'terraform.tfstate'
      region: '{{ .vars.region }}'

but for the backend role I have `orgs/acme/plat/_default.yaml`:

terraform:
  backend_type: s3
  backend:
    s3:
      assume_role:
        role_arn: 'arn:aws:iam::{{ (env "state_account_id") }}:role/{{ .vars.namespace }}-{{ (env "gbl_environment") }}-{{ (env "state_stage") }}-{{ (env "state_role_suffix") }}'

and for the provider role I have

orgs/acme/plat/dev/_default.yaml

terraform:
  settings:
    github:
      actions_enabled: true
  providers:
    aws:
      region: '{{ .vars.region }}'
      assume_role:
        role_arn: 'arn:aws:iam::{{ (printf "%s_account_id" .vars.stage | env) }}:role/{{ .vars.namespace }}-{{ (env "gbl_environment") }}-{{ .vars.stage }}-{{ (printf "%s_role_suffix" .vars.stage | env) }}'

What I think is happening is that in the latest version the evaluation on orgs has change and is not longer getting the Environment variables on the CLI context only the

.vars

work there now. I think this is the issue bc the error show that is trying to assume the incorrect role and it looks like this:

Assuming role ARN=arn:aws:iam:::role/acme---

@Andriy Knysh (Cloud Posse) https://linear.app/cloudposse/issue/DEV-3853/invalid-role-arn-composed-template-env-values-are-empty-when-rendering