https://pulumi.com
Join Slack
This message was deleted.
# aws
s
This message was deleted.
l
Use different providers for this. One provider is locked to one set of creds / profile, etc.
💯 1
You can have as many providers as you like at one time though.
s
So I tried setting 2 providers
Copy code
const prodProfile = new aws.Provider('prodProvider', { profile: 'prod-admin', region: 'us-west-2', allowedAccountIds: ['########'] });
const defaultProvider = new aws.Provider('defaultProvider', { profile: 'stage-admin', region: 'us-west-2', allowedAccountIds: [awsAccount] });
but I get an assume role error
l
That's a separate problem. If the creds you're using to assume a role don't have permission to assume that role, then you'll get an assume role error.
But you can still use multiple providers to deploy resources to multiple accounts / regions within the same project.
s
so is the problem that the pulumi info in one account can't be accessed by the other because it needs assume role privelages?
Copy code
let zone = new aws.route53.Zone(name, { name, comment }, {
        provider: defaultProvider,
        protect: true,
        ignoreChanges: ['comment']
    });
const configureProdDNS = new aws.route53.Record(`${name}-prod-dns`, {
                name: zone.name,
                zoneId: zone.zoneId,
                type: "NS",
                ttl: 30,
                records: zone.nameServers,
            }, { provider: prodProfile, dependsOn: [zone, cert, certRecord] });
I figured it would pull the info on the pulumi side and share, but it sounds like it tries to access the zone info via an assume role?
l
The assume role is something you've set up. Pulumi doesn't do that. Maybe the profile you're using uses source_profile and role_arn? Or the profile you're constructing uses the assumeRole property?
Would you like to ask a new question about this code snippet?
Getting info out of a resource from one account into the constructor of a resource that will go to another account is normal. Pulumi handles this, the info itself isn't locked to any account.
s
I never setup assume role...
l
So you are doing the right thing.
If you can't use a profile because of a role assumption error, then the problem is only with the profile.
Have you checked your "prod-admin" and "stage-admin" profiles?
What sort of creds do they use?
s
they are sts roles
l
Using access key id and secret access key? Or source profile and role ARN?
s
saml sts token
l
Doesn't that assume a role?
Maybe your session token has expired
s
It uses an aws credentials profile and the tokens are not expired, but I will test with non STS key and secret
l
You need 2 profiles though, right?
You've listed 2 profiles in your snippet above.
s
yes
@little-cartoon-10569 thanks for your assistance. I realized I was putting the zoneid from a seperate account and not the one from the account I was creating it in.
👍 1
3 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by