Using terraform in an AWS SSO+Okta environment

Question

I'm using SSO in an AWS SSO+Control Tower+Okta environment

When I login to AWS via Okta, I use the Option 1 setting to allow me to use the aws command

Get credentials for AdministratorAccess

When I run the terraform plan, I get the following error There is no problem with terraform init.

【terraform plan error】

╷
│ Error: AccessDenied: Access Denied
│   status code: 403, request id: QN738HDZPQKMERFX, host id: roylHCGU3cOMfwkWjdpbeG991Ho28bredvY1/6vSgGavaM/VXn6rNtDSGIpnBS2cqetL38YdF1o=
│ 
│ 
╵

I thought the above error might be due to the fact that I cannot access the terraform.tfstate that I have set in backend.tf, but the following command completes successfully

【backend.tf】

terraform {
  backend "s3" {
    bucket               = "test-tfstate2"
    key                  = "provisioning/test/static/production/terraform.tfstate"
    region               = "ap-northeast-1"
    workspace_key_prefix = ""
  }
}

【command】 aws s3 ls s3://test-tfstate2/provisioning/test/static/production/terraform.tfstate

【Result】 2022-02-17 18:18:05 0 terraform.tfstate

What is the cause of the AccessDenied error in this situation?

Any advice would be appreciated.

Answer 1

In order to troubleshoot this issue further and find the root cause of the problem you can execute:

TF_LOG=DEBUG terraform plan

This should give you exact reason while plan is failing. I suspect it's due to the permission issue: "Validate Response s3/ListObjects failed" but we need to confirm it first by running plan with the DEBUG option.

It could also happen that your terraform uses default credentials from ~/.aws/credentials file. That's why when you execute aws ls s3 ... manually - it works, but it doesn't work with terraform.

To avoid this, please use option 2 from the guide you provided (by creating additional configuration block in your ~/.aws/credentials file.

Then you can do export AWS_PROFILE={name_of_your_new_profile} and then try to execute terraform plan once again.

If all of this will not work, please update your question with the DEBUG's output.

Best of luck :)