[Version 2 Release] provider: Return error if AWS account ID cannot be determined with skip_requesting_account_id = false

[bflad]

Description

Tracking issue for: https://www.terraform.io/docs/providers/aws/guides/version-2-upgrade.html#skip_requesting_account_id-argument-now-required-to-skip-account-id-lookup-errors

If the provider is unable to determine the AWS account ID from a provider assume role configuration or the STS GetCallerIdentity call used to verify the credentials (if skip_credentials_validation = false), it will attempt to lookup the AWS account ID via EC2 metadata, IAM GetUser, IAM ListRoles, and STS GetCallerIdentity. Previously, the provider would silently allow the failure of all the above methods.

The provider will now return an error to ensure operators understand the implications of the missing AWS account ID in the provider.

If necessary, the AWS account ID lookup logic can be skipped via:

provider "aws" {
  # ... other configuration ...

  skip_requesting_account_id = true
}

Remediation

Previously, this pull request would have handled this change: #5795

We are now migrating to a shared AWS Go SDK Client instantiation library between the Terraform AWS Provider and Terraform S3 Backend: #7653

The log message conversion to an error now needs to occur upstream and the library dependency updated with the change.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!