AWS_PROFILE not respected for S3 backend when running terraform init/terraform workspace #20062
Description
Terraform Version
Terraform v0.11.11
Terraform Configuration Files
terraform {
backend "s3" {
bucket = "example-bucket"
key = "example/terraform.tfstate"
region = "eu-west-2"
encrypt = "true"
}
}Debug Output
I have created a user, which has no permissions, except the permission to assume the develop role, which has full permissions
Example 1
Running terraform init.
This output is expected, as the user does not have permissions to allow access to the S3 bucket:
Error loading state: AccessDenied: Access Denied
status code: 403, ...
Example 2
Running AWS_PROFILE=develop terraform init
Error configuring the backend "s3": No valid credential sources found for AWS Provider.
Please see https://terraform.io/docs/providers/aws/index.html for more information on
providing credentials for the AWS Provider
Please update the configuration in your Terraform files to fix this error.
If you'd like to update the configuration interactively without storing
the values in your configuration, run "terraform init".
Example 3
Running AWS_SDK_LOAD_CONFIG=1 AWS_PROFILE=develop terraform init
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
These examples are also true with terraform workspace commands
Additional Context
Unfortunately, terraform apply/terraform plan can't be ran with AWS_SDK_LOAD_CONFIG:
Error: Error refreshing state: 1 error(s) occurred:
* provider.aws: No valid credential sources found for AWS Provider.
Please see https://terraform.io/docs/providers/aws/index.html for more information on
providing credentials for the AWS Provider
This makes me think there is a difference in the way that credentials are loaded when using init vs plan/apply
If this can't be reproduced by others, I can provide TRACE logs ... There's just too many redactions to go through, if this can be reproduced elsewhere ...