S3 module downloads doesn't work with AWS IRSA

[ugurzongur]

IAM roles for service accounts (IRSA) is a feature of EKS to provide IAM role creds to kubernetes pods. The aws-sdk version (v1.15.78) used in the current version of go-getter doesn't support IRSA in its default credential chain. Versions after v1.23.13 are supported (source). To overcome this problem, a recent version of aws-sdk should be used.

The use case: We bumped into this problem while using terraform (via atlantis) in a kubernetes pod.

[ugurzongur]

For others that might have the same issue, a workaround exists in the meanwhile. Which is adding aws-cli and jq to the base image and exporting creds manually before running terraform (for atlantis we did this with custom workflows):

ROLE_ARN=$AWS_ROLE_ARN
ROLE_SESSION_NAME=session-`date +%s%N`
WEB_IDENTITY_TOKEN=`cat $AWS_WEB_IDENTITY_TOKEN_FILE`
OUT=`aws sts assume-role-with-web-identity --role-arn $ROLE_ARN --role-session-name $ROLE_SESSION_NAME --web-identity-token $WEB_IDENTITY_TOKEN`
export AWS_ACCESS_KEY_ID=$(echo $OUT | jq -r '.Credentials''.AccessKeyId');\
export AWS_SECRET_ACCESS_KEY=$(echo $OUT | jq -r '.Credentials''.SecretAccessKey');\
export AWS_SESSION_TOKEN=$(echo $OUT | jq -r '.Credentials''.SessionToken');
aws sts get-caller-identity

[kmoe]

Since this issue targets Terraform, which uses v2 of go-getter, this will actually be closed by #385.

[jukie]

@kmoe where are you seeing terraform target v2? https://github.com/hashicorp/terraform/blob/main/go.mod#L37 shows it still on v1.
I'm starting to work on a PR to bump that to v2 but I'm curious if we could have a new release cut on the v1 tree to minimize the amount of work needed to get this bug fix out.