Do I have to include gitlab variables in my terraform code in order for my credentials to be recognized?

Question

I am trying to set up a pipeline, which is supposed to deploy terraform code into an aws account. The code works fine locally, and I have setup and imported the state bucket and dynamodb table which enables state locking.

However, when I run the code in a gitlab ci, I get the following error message:

Error: error configuring S3 Backend: no valid credential sources for S3 Backend found. │ │ Please see https://www.terraform.io/docs/language/settings/backends/s3.html │ for more information about providing credentials. │ │ Error: NoCredentialProviders: no valid providers in chain. Deprecated. │ For verbose messaging see aws.Config.CredentialsChainVerboseErrors

I export the aws credentials as variables in the before_script like so:

before_script:
  - rm -rf .terraform
  - terraform --version
  - export AWS_ACCESS_KEY_ID
  - export AWS_ROLE_ARN
  - export AWS_DEFAULT_REGION
  - export AWS_ROLE_ARN

Is there another step that I am missing, or do I maybe have to include the credential variables in the terraform code?

Answer 1

The answer to this question is no. I merely forgot to export the AWS_SECRET_ACCESS_KEY variable in the before_script section.

Answer 2

In our terraform pipeline we use the aws cli command to assume a role and get the credential variables, the EC2 instance for the pipeline worker is using a profile which can assume the role.

creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --role-session-name tf-pipeline | jq -r '.Credentials')
export AWS_ACCESS_KEY_ID=$(echo $creds | jq -r '.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq -r '.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $creds | jq -r '.SessionToken')

Answer 3

in the case of using GitLab ci ENV var, if u are testing in branches other than main/master, make sure your variables are not PROTECTED