https://pulumi.com
Join Slack
This message was deleted.
# general
s
This message was deleted.
f
Are you using that key to setup the encryption provider or are you accessing it in your code?
If for the encryption provider, I believe you’d have to have the auth setup locally to work similar to if you were using the 
go-sdk
. See: https://www.pulumi.com/docs/intro/concepts/config/#aws-key-management-service-kms. This is separate from the 
aws-profile
config value. That value is used for any resources in the stack itself.
I think if you set the profile environment variable like so it should work: 
AWS_PROFILE=pa-prod
I do think this seems like a valid point though. It wouldn’t be a bad assumption that if you’re using kms for encryption that it should respect the stack values as well.
b
yes, it's for the encryption provider
setting the profile env variable is producing the same results 😕
f
Hmm, that’s odd.. what region is the key in?
b
us-east-1
f
AWS_REGION=us-east-1
can you try to set that as well for the sake of debugging?
b
sure thing, 1 sec
Same issue
Just closed my console out and reopened it -- getting a new error now:
Copy code
error: getting secrets manager: secrets (code=Unknown): InvalidSignatureException: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.
        status code: 400, request id: 257a0c7f-303e-4a72-8ec8-a83bd6e19e9f
brb rebooting.
ok.. After rebooting setting the ENV variables directly is working
Second attempt is not working - ugh
l
@best-lifeguard-91445 your yaml lists 
prod-pa
where your command line mentions 
pa-prod
. Mismatch?
b
@limited-rainbow-51650 -- I corrected that already 🙂 thanks tho
f
you need to get your auth in a state where this works: 
aws kms describe-key --key-id={{key-id}}
does that currently work for you?
b
That works after setting the AWS_SECRET_ACCESS_KEY and ID in the current session
l
Is the KMS key in the same region as the resources being created? I once filed this against the underlying Terraform provider: https://github.com/terraform-providers/terraform-provider-aws/issues/7750 Could be related.
b
yes same region
RIngo "up" works, if I explicitly set the AWS credentials as env variables
FYI - The aforementioned errors were from a powershell prompt The CMD prompt is working differently: Setting AWS_PROFILE=pa-prod
Copy code
c:\Repos\pa\pa_infrastructure>pulumi up
error: getting secrets manager: secrets (code=Unknown): AccessDenied: User: arn:aws:iam::057043601195:user/pulumi-admin is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::057043601195:role/OrganizationAccountAccessRole
        status code: 403, request id: d634ecf0-d009-48a4-8d23-37ca566e371f
l
What do you get with using the 
AWS_ACCESS_KEY_ID
and 
AWS_SECRET_ACCES_KEY
environment variables from the 
pa-prod
profile in CMD prompt, also unsetting 
AWS_PROFILE
?
b
works fine
l
I would file a GH issue if I were you. This is definitely something to track down.
b
Will do! thanks @limited-rainbow-51650
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by