https://cloudposse.com logo
Join Slack
Powered by
Hello! I'm looking for a way to switch identity de...
# atmos
j
Hello! I'm looking for a way to switch identity depending on the component in a stack. I have a default identity which I use store terraform state file, But the component that I'm trying to create should be on another account. I have tried using the component level identity selection, but it isn't working. it tries to create the component on the default identity no matter the config I tried.
e
Can you share some snippets of your configs?
j
This is my auth config in 
atmos.yaml
Copy code
auth:
  providers:
    company-sso:
      kind: aws/iam-identity-center
      region: us-east-1
      start_url: <https://company.awsapps.com/start>
      auto_provision_identities: true

  identities:
    company:
      default: true
      kind: aws/permission-set
      via.provider: company-sso
      principal:
        name: role-for-tf-state
        account.id: "11111111111"
  
    company-shared/role-for-create-resources:
      kind: aws/permission-set
      via.provider: company-sso
      principal:
        name: role-for-create-resource
        account.id: "22222222222"
This is my stack config for a s3-bucket
Copy code
import:
  - catalog/infra/s3-bucket
  - mixins/env/dev
  - mixins/region/us-east-1

components:
  terraform:
    s3-bucket:
      auth:
        identity: company-shared/role-for-create-resources
This is the terraform backend auth section in my org 
_defaults.yaml
Copy code
terraform:
  backend_type: s3
  backend:
    s3:
      bucket: atmos-tf-state
      key: terraform.tfstate
      region: us-east-1
      role_arn: "arn:aws:iam::11111111111:role/role-for-tf-state"
      dynamodb_table: atmos-tf-state-lock
      encrypt: true
When I run 
atmos auth login
and try 
atmos auth whoami
, I can see that I assumed 
role-for-tf-state
from account 
11111111111
. When I run 
atmos terraform apply -s s3bucket-dev-ue1
, I get an error saying
Copy code
arn:aws:iam::11111111111:role/role-for-tf-state is not allowed to perform s3:CreateBucket action
a
@JP Pakalapati we are going to review this issue, will let you know
j
Thanks!
a
the issue confirmed - the fix will be released in a new Atmos version this week
gratitude thank you 1
j
You guys are awesome!
e
Copy code
auth:
        identity: company-shared/role-for-create-resources
Where did you find this syntax?
(looks like we have bad docs somewhere)
j
e
a
@JP Pakalapati please try the correct syntax:
Copy code
terraform:
  auth:
    identities:
it should solve your issue (we are fixing other issues reported for Atmos Auth, but your issue looks like the incorrect syntax, which was documented in the doc and fixed in the above PR)
j
I'm still getting the same error.
e
Please share your configs again
Also, try setting 
--logs-level=debug
You can also run describe component to see the deep merged config
Also what version of atmos are you on?
j
The only thing I changed is the auth config in the stack file
Copy code
components:
  terraform:
    s3-bucket:
      auth:
        identities:
          company-shared/role-for-create-resources:
            default: true
Since I also have the 
role-for-tf-state
identity as default, when running the 
atmos terraform apply
it asked me to select between the multiple default identities. I had to select the 
role-for-tf-state
as I need that for storing tf states and I got the error
Copy code
arn:aws:iam::11111111111:role/role-for-tf-state is not allowed to perform s3:CreateBucket action
I'm using the latest 
1.214.0
a
it looks like related to the other issues we are fixing now - let me check and confirm that
e
Can you try changing one thing? This should be supported.
Copy code
via.provider: company-sso
But can you also try this instead:
Copy code
via:
  provider: company-sso
j
Didn't help. I even tried adding 
required: true
for the the identity in stack file like
Copy code
components:
  terraform:
    s3-bucket:
      auth:
        identities:
          company-shared/role-for-create-resources:
            default: true
            required: true
and made sure both the credentials are loaded in the 
~/.config/atmos/cdf72cad0f499891/aws/company-sso/credentials
file. But stil got the error. It's just not switching the identity when running terraform apply.
I wonder if there is a way to look at the terraform provider config Atmos generates during runtime.
a
we are fixing this bug as well, it's a separate bug
j
Ah okay.
Hello 👋 just pinging to see when this fix might be released? Also, is there a way to test the fix in my local before it gets released?
a
please try atmos 1.215.0
to test any version w/o installing it locally, you can use 
--use-version
https://atmos.tools/changelog/pr-artifact-installation
2 Views
Open in Slack
PreviousNext
Powered by