Ignore certain values when detecting a changed backend

[gwkunze]

Current Terraform Version

Terraform 0.12.3

Use-cases

We have a terraform S3 backend which requires assuming a specific role to access the bucket. This role requires an MFA token to access. Since Terraform doesn't support MFA (as far as I know) we have a small script that generates the backend configuration (and provider configuration as well), specifically by asking for an mfa value and assuming the role using the sts:AssumeRole API call and getting the temporary access key, secret and token.

Unfortunately, every time you run this script the backend configuration is considered changed and terraform init wants to "migrate" using the old (expired) credentials to the new ones which obviously fails. Technically there is nothing to migrate, it's just that we have new credentials to access the same AWS account.

Attempted Solutions

What we currently do is just delete the .terraform directory prior to running terraform init but this isn't very efficient.

Proposal

It would be nice if we could either declare certain variables in the backend config as "don't try to migrate backend if these change" or add a command line option to terraform to not try to migrate when running terraform init.

[pselle]

Hi @gwkunze! If I were to attempt to shorthand this: would "ignore_changes, but for backends" be what you're asking for?

Also, linking this related issue, which is similar, but perhaps more general than your request #20866

[gwkunze]

I would argue that "ignore_changes, but for backends" is such a fundamentally different concept that calling it ignore_changes for backends might be confusing as its in a completely separate context during a different subcommand of terraform even.

[pselle]

Yes, I'm referring to a different part of Terraform: https://www.terraform.io/docs/configuration/resources.html#ignore_changes, I was asking if this was similar functionality to what you're describing.

Unfortunately, every time you run this script the backend configuration is considered changed

It sounds like what you're asking is for a means to say "ignore this part of the configuration." Is that incorrect?

[gwkunze]

Apologies for the late reaction.

Yes, one of the options is technically similar behavior to the ignore_changes functionality. My argument was mostly not to conflate the two as that could potentially lead to confusion.