Terraform: can't connect to AWS provider using shared config file or static variable

Question

I'm trying to use terraform to manage AWS resources and trying to set up the credentials configuration. I'm following the official documentation: https://www.terraform.io/docs/providers/aws/index.html

My first idea was set a shared credentials file so I configure it:

• ~.aws/credentials

  [default]
  aws_access_key_id=****
  aws_secret_access_key=****
  

• ~.aws/config

  [default]
  region=us-east-1
  output=json
  

• app/main.tf

  provider "aws" {
      region = "us-east-1"
      version = "~> 2.0"
      profile = "default"
  }
  
  terraform {
      backend "s3" {
          bucket = "example-bucket"
          key    = "terraform-test.tfstate"
          region = "us-east-1"
    }
  }
  

When I run terraform init I receive the following message:

Error: No valid credential sources found for AWS Provider.
        Please see https://terraform.io/docs/providers/aws/index.html for more information on
        providing credentials for the AWS Provider

I have already tested the credentials using aws cli and it's working perfectly.

After that, I tried to configure static credentials in main.tf like this:

provider "aws" {
    region = "us-east-1"
    version = "~> 2.0"
    access_key = "****"
    secret_key = "****"
}

Same error...

I decided to test with environment variables and then it worked. But now I want to know why I could not configure with static variables or shared config file. All this cases was described in the official docs, what am I doing wrong?

Answer 1

The easiest way I've found to properly set credentials for my local runs and remote terraform cloud runs is to use environment variables. Before running set the environment variables for

AWS_ACCESS_KEY_ID
AWS_SECRET_KEY
AWS_DEFAULT_REGION

This should allow you to run in both Linux, PowerShell or even remote runs in Terraform cloud without issue.

I've gone between various approaches and this has provided me the easiest workflow. If you're doing this in AWS directly then of course you could use IAM instance role and avoid credentials altogether. This wouldn't allow you to keep the same workflow for local and remote though.