https://pulumi.com logo
Join Slack
Powered by
Hello, I'm was getting `unable to validate AWS cr...
# general
n
Hello, I'm was getting 
unable to validate AWS credentials
error during pulumi deployment of a stack with newly added Deployment Settings (python) I was expecting pulumi deployments to use the ESC 
environment:
configured in the 
pulumi.<stack>.yaml
but while writing this post to ask for help I actually found out my original issue 💪 but I have another 😞 It turns out that having 
config.aws:profile
in 
pulumi.<stack>.yaml
can interfere with Pulumi Deployments loading of ESC environment, my workflow was to do local infra development, with valid local aws session, and now I started working on getting the stack automated with deployments. thus I was using 
aws:profile
to target a specific profile in my 
~/.aws/config
, I fixed the error by commenting out this 'local' configuration, and letting pulumi use 
environment
with ESC without targeting a profile.. But now I cannot run 
pulumi preview
locally to iterate fast on new code before committing to a side-branch, I'm now getting 
unable to validate AWS credentials.
locally, how can I use the esc environment and use the dynamic oidc based credentials locally?
✅ 1
🏁 1
I now know that my 
ESC
environment is missing 
pulumiConfig
but I'm unsure what I should put there
testing:
Copy code
values:
  pulumiConfig:
    aws:accessKey: ${aws.login.accessKeyId}
    aws:secretKey: ${aws.login.secretAccessKey}
    aws:token: ${aws.login.sessionToken}
not working 😞
the environment already included:
Copy code
environmentVariables:
    AWS_ACCESS_KEY_ID: ${aws.login.accessKeyId}
    AWS_SECRET_ACCESS_KEY: ${aws.login.secretAccessKey}
    AWS_SESSION_TOKEN: ${aws.login.sessionToken}
as well
although the env does work 🤔 🤷‍♂️
Copy code
esc run aws-login/development-env -- aws sts get-caller-identity
{
    "UserId": "FOOBAR:pulumi-environments-session",
    "Account": "012345678",
    "Arn": "arn:aws:sts::012345678:assumed-role/pulumi-esc-oidc-org-AdministratorAccess-role/pulumi-environments-session"
}
Finally Found it, I had this in 
~/.aws/config
Copy code
[default]
source_profile = dev
region = us-east-1
source_profile
was messing up pulumi's aws invocation
I had this configuration to always have implicit aws cli commands target my aws 
dev
account 🙂
96 Views
Open in Slack
PreviousNext
Powered by