This message was deleted.

sparse-intern-71089

04/22/2021, 9:25 PM

This message was deleted.

billowy-army-68599

04/22/2021, 9:29 PM

hey Tony! I could be wrong, but i think there's a typo here?

Copy code

[dev-pulumi]
aws_access_key_id = redacted
aws_secret_access_key = redacted

[profile dev-pulumi]
source_profile = dev_pulumi
role_arn = arn:aws:iam::redacted:role/redacted-TEMP

billowy-army-68599

04/22/2021, 9:30 PM

shouldn't this be

dev-pulumi

(dash, not underscore?) I don't see any

dev_pulumi

profile

purple-orange-91853

04/22/2021, 9:39 PM

well that's horribly embarassing

purple-orange-91853

04/22/2021, 9:40 PM

that totally was the issue. thank you much!

billowy-army-68599

04/22/2021, 9:42 PM

glad it was simple!

purple-orange-91853

04/22/2021, 9:45 PM

well maybe not... just realized in testing I created a user out of scope in the dev account to test that it worked and it worked with the user/role being in the same account. When I switch the awsprofile in the Pulumi.dev.yaml to just

dev

file it fails with

Copy code

error: unable to discover AWS AccessKeyID and/or SecretAccessKey - see <https://pulumi.io/install/aws.html> for details on configuration

purple-orange-91853

04/22/2021, 9:47 PM

this is the one that is logging in to the identity account and then role switching to another account entirely. for example the identity account number is 123456, and the dev account number is 098765

Copy code

[profile prod]
source_profile = prod-main
role_arn = arn:aws:iam::123456:role/role-TEMP
mfa_serial = arn:aws:iam::123456:mfa/tony

[profile dev]
source_profile = prod-main
role_arn = arn:aws:iam::098765:role/role-TEMP
mfa_serial = arn:aws:iam::123456:mfa/tony

billowy-army-68599

04/22/2021, 10:19 PM

i'm not totally sure of the answer to that, it seems you're using profiles in a fairly unique way and I'm unfortunately not familiar with it - ultimately Pulumi will use the profile if it's set up correctly, it uses the AWS GO SDK

ambitious-father-68746

04/23/2021, 9:00 AM

@purple-orange-91853 Check the Pulumi section here, maybe it will help: https://gist.github.com/Sodki/95b04ee9f4f44ed81de23b0cff3a4685

purple-orange-91853

04/23/2021, 3:12 PM

for context I am using the standard method by AWS to authenticate against different accounts. The roles and policies are configured correctly as I can switch via the AWS CLI and have access to the correct resources when using

--profile

in my cli strings. See

Example scenario: Allow an instance profile role to switch to a role in another account

in this AWS doc for reference. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-cli.html

purple-orange-91853

04/23/2021, 3:16 PM

Also see here for configuration of this method. https://www.1strategy.com/blog/2017/05/30/using-the-cli-with-cross-account-roles-mfa/

billowy-army-68599

04/23/2021, 4:21 PM

@purple-orange-91853 it might be easier to jump on a call to get this configured, can you grab some time from here for next week? https://calendly.com/d/mxtb-bs7b/30-minute-meeting

19 Views

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.