Hello I ve got a followup problem to my above one arrow up I

Question

Hello I ve got a followup problem to my above one arrow up I circumvented the dependency problem hard by disabling the broken provider using the missing ARNs and running the update then activate them again But much worse my problem still exists Quite consitently Pulumi keeps telling me that the TF Provider cannot assume the configured role I broke the code out of my base setup stack and moved it over into a new one no effect

sticky-bear-14421 · Answer

Then I tried a different approach to narrow down the cause for the error and it broke in a different way cry ``` The default provider current err = aws GetCallerIdentity ctx nil nil if err = nil return err fmt Println current Arn ``` This will return the AWS SSO Role I login to

sticky-bear-14421 · Answer

``` Second provider intermediateProvider err = aws NewProvider ctx intermediateProvider amp aws ProviderArgs AssumeRole amp aws ProviderAssumeRoleArgs RoleArn pulumi String fmt Sprintf arn aws iam s roles intermediateRole current AccountId SessionName pulumi String intermediateProviderSession Region pulumi String region Name if err = nil return err ``` And based upon this I again call aws GetCallerIdentity ``` current err = aws GetCallerIdentity ctx nil pulumi Provider intermediateProvider if err = nil return err fmt Println current Arn ```

sticky-bear-14421 · Answer

Then into the third one in a different AWS account which gave me the headache before ``` peeringProvider err = aws NewProvider ctx fmt Sprintf peeringProvider s peer Name amp aws ProviderArgs AssumeRole amp aws ProviderAssumeRoleArgs RoleArn pulumi String fmt Sprintf arn aws iam s role s peer AccountID peer AssumeRoleName SessionName pulumi String PeeringProviderSession Region pulumi String region Name pulumi Provider provider if err = nil fmt Println err current err = aws GetCallerIdentity ctx nil pulumi Provider peeringProvider if err = nil return err fmt Println current Arn ```

sticky-bear-14421 · Answer

And guess what happens This time I get the error message that my intermediate provider is the one breaking the run

billowy-army-68599 · Answer

if I m understanding the problem correctly which it s highly possible I m not the expected flow is your base role assume role into the intermediate provider then from the intermediate provider assume role into the peering provider is that right

sticky-bear-14421 · Answer

Correct

sticky-bear-14421 · Answer

The intermediate provider s role is only allowed to assume into the destination roles

billowy-army-68599 · Answer

in your peering provider you do this ```pulumi Provider provider ``` I believe this should be ```pulumi Provider intermediateProvider ```

sticky-bear-14421 · Answer

When copying the destination code I broke it out into it s own function

sticky-bear-14421 · Answer

the function interface is provider aws Provider

sticky-bear-14421 · Answer

But it is the intermediate one that gets stuffed into it

billowy-army-68599 · Answer

what error do you get

sticky-bear-14421 · Answer

``` error program failed 1 error occurred rpc error code = Unknown desc = invocation of aws index getCallerIdentity getCallerIdentity returned an error 1 error occurred error configuring Terraform AWS Provider IAM Role arn aws iam 123456789012 roles intermediateRole cannot be assumed There are a number of possible causes of this the most common are The credentials used in order to assume the role are invalid The credentials do not have appropriate permission to assume the role The role ARN is not valid Error NoCredentialProviders no valid providers in chain Deprecated For verbose messaging see aws Config CredentialsChainVerboseErrors exit status 1```

sticky-bear-14421 · Answer

My larger code base creates the intermediate provider in the main function and puts it into two different functions one that does aws account peering and the other one does operate on our TransitGateway The TGW one is working with its destinationProvider whereas the Peering Code fails with its particular destination provider

billowy-army-68599 · Answer

it s really hard to help debug this unfortunately because your setup is so unique to you disappointed what I will say is every time this comes up it s a misconfiguration this is known to work and lots of people are doing it The best I can do is suggest you go through each role permissions and provider config as best as possible

sticky-bear-14421 · Answer

That is the funny part we did the sts assume role within the cli permissions with the iam roles in use are correct

sticky-bear-14421 · Answer

my SSO Role is allowed to assume the intermediate and this worked before whereas it now failes

sticky-bear-14421 · Answer

How do I attach dlv debugger to a pulumi run Do you have an idea how to achieve this

sticky-bear-14421 · Answer

I found this nice article <https samcogan com debugging pulumi code in visual studio >

sticky-bear-14421 · Answer

But his approach is with C wink

billowy-army-68599 · Answer

i have personally never done it but it should be the same as any other Go code

sticky-bear-14421 · Answer

Hmm I always do a pulumi up vs go build o my binary amp amp my binary

billowy-army-68599 · Answer

pulumi up with go does a `go run` in the background you can build the binary and point to it in your `Pulumi yaml` see runtime binary here <https www pulumi com docs reference pulumi yaml >

sticky-bear-14421 · Answer

Ahh the Pulumi yaml is the missing project I get ``` peering error program failed missing project name```

billowy-army-68599 · Answer

what does your `pulumi yaml` look like

sticky-bear-14421 · Answer

``` cat Pulumi yaml name infrastructure runtime go description VPC Peering options binary peering```

billowy-army-68599 · Answer

should be ```runtime name go options binary peering```

sticky-bear-14421 · Answer

This will force pulumi to build the binary or use the before built peering binary

sticky-bear-14421 · Answer

Doing a pulumi up answers my question must be pre built

sticky-bear-14421 · Answer

wink

sticky-bear-14421 · Answer

For the reference I found this issue that talks about options for debugging Pulumi go code <https github com pulumi pulumi issues 1372>