266 aws native config

builtin/providers/aws/provider.go

@@ -1,34 +1,33 @@
 package aws
 
 import (
+ "os"
+
  "github.com/hashicorp/terraform/helper/schema"
  "github.com/hashicorp/terraform/terraform"
+ goamz "github.com/mitchellh/goamz/aws"
 )
 
 // Provider returns a terraform.ResourceProvider.
 func Provider() terraform.ResourceProvider {
  // TODO: Move the validation to this, requires conditional schemas
  // TODO: Move the configuration to this, requires validation
 
+ auth := awsAuthSource{}
+
  return &schema.Provider{
  Schema: map[string]*schema.Schema{
  "access_key": &schema.Schema{
- Type: schema.TypeString,
- Required: true,
- DefaultFunc: schema.MultiEnvDefaultFunc([]string{
- "AWS_ACCESS_KEY",
- "AWS_ACCESS_KEY_ID",
- }, nil),
+ Type: schema.TypeString,
+ Required: true,
+ DefaultFunc: auth.accessKeyResolver(),
  Description: descriptions["access_key"],
  },
 
  "secret_key": &schema.Schema{
- Type: schema.TypeString,
- Required: true,
- DefaultFunc: schema.MultiEnvDefaultFunc([]string{
- "AWS_SECRET_KEY",
- "AWS_SECRET_ACCESS_KEY",
- }, nil),
+ Type: schema.TypeString,
+ Required: true,
+ DefaultFunc: auth.secretKeyResolver(),
  Description: descriptions["secret_key"],
  },
 
@@ -88,6 +87,58 @@ func init() {
  }
 }
 
+type awsAuthSource struct {
+ conventionalAuth goamz.Auth
+ attemptedConventionalAuth bool
+}
+
+func (a *awsAuthSource) awsSourcedAuth() goamz.Auth {
+ if a.attemptedConventionalAuth == false {
+ auth, err := goamz.EnvAuth()
+
+ if err != nil {
+ auth, _ = goamz.SharedAuth()
+ }
+
+ a.conventionalAuth = auth
+ a.attemptedConventionalAuth = true
+ }
+
+ return a.conventionalAuth
+}
+
+func (a *awsAuthSource) accessKeyResolver() schema.SchemaDefaultFunc {
+ return func() (interface{}, error) {
+ // NOTE: Do not remove this until AWS_ACCESS_KEY support has been removed
+ // https://github.com/hashicorp/terraform/issues/866
+ if accessKey := os.Getenv("AWS_ACCESS_KEY"); accessKey != "" {
+ return accessKey, nil
+ }
+
+ if auth := a.awsSourcedAuth(); auth.AccessKey != "" {
+ return auth.AccessKey, nil
+ }
+
+ return nil, nil
+ }
+}
+
+func (a *awsAuthSource) secretKeyResolver() schema.SchemaDefaultFunc {
+ return func() (interface{}, error) {
+ // NOTE: Do not remove this until AWS_SECRET_KEY support has been removed
+ // https://github.com/hashicorp/terraform/issues/866
+ if secretKey := os.Getenv("AWS_SECRET_KEY"); secretKey != "" {
+ return secretKey, nil
+ }
+
+ if auth := a.awsSourcedAuth(); auth.SecretKey != "" {
+ return auth.SecretKey, nil
+ }
+
+ return nil, nil
+ }
+}
+
 func providerConfigure(d *schema.ResourceData) (interface{}, error) {
  config := Config{
  AccessKey: d.Get("access_key").(string),

builtin/providers/aws/provider_test.go

@@ -1,6 +1,8 @@
 package aws
 
 import (
+ "fmt"
+ "io/ioutil"
  "log"
  "os"
  "testing"
@@ -29,6 +31,152 @@ func TestProvider_impl(t *testing.T) {
  var _ terraform.ResourceProvider = Provider()
 }
 
+func prepareFakeCredentialFile(access_key_id string, secret_key string) (*os.File, error) {
+ credentialFile, err := ioutil.TempFile("", "aws_credential_test")
+
+ if err != nil {
+ return nil, err
+ }
+
+ contents := fmt.Sprintf(`[default]
+aws_access_key_id = %s
+aws_secret_access_key = %s
+`, access_key_id, secret_key)
+
+ credentialFile.Write([]byte(fmt.Sprintf(contents)))
+ credentialFile.Close()
+
+ return credentialFile, nil
+
+}
+
+func cleanAwsEnvConfig() func() {
+ oldAccessKey := os.Getenv("AWS_ACCESS_KEY")
+ oldSecretKey := os.Getenv("AWS_SECRET_KEY")
+ oldAccessKeyId := os.Getenv("AWS_ACCESS_KEY_ID")
+ oldSecretAccessKey := os.Getenv("AWS_SECRET_ACCESS_KEY")
+
+ os.Setenv("AWS_ACCESS_KEY", "")
+ os.Setenv("AWS_SECRET_KEY", "")
+ os.Setenv("AWS_ACCESS_KEY_ID", "")
+ os.Setenv("AWS_SECRET_ACCESS_KEY", "")
+
+ return func() {
+ os.Setenv("AWS_ACCESS_KEY", oldAccessKey)
+ os.Setenv("AWS_SECRET_KEY", oldSecretKey)
+ os.Setenv("AWS_ACCESS_KEY_ID", oldAccessKeyId)
+ os.Setenv("AWS_SECRET_ACCESS_KEY", oldSecretAccessKey)
+ }
+}
+
+func TestEnvVarsOverrideCredentialsFile(t *testing.T) {
+ resetEnvVars := cleanAwsEnvConfig()
+ defer resetEnvVars()
+
+ os.Setenv("AWS_ACCESS_KEY_ID", "access_key_id_from_aws_cli_env_var")
+ os.Setenv("AWS_SECRET_ACCESS_KEY", "secret_access_key_from_aws_cli_env_var")
+
+ credentialFile, err := prepareFakeCredentialFile("access_key_id_from_config", "secret_access_key_from_config")
+
+ if err != nil {
+ t.Fatalf("Could not create temporary AWS config file: '%s'", err)
+ }
+
+ os.Setenv("AWS_CREDENTIAL_FILE", credentialFile.Name())
+ defer os.Remove(credentialFile.Name())
+
+ auth := awsAuthSource{}
+
+ access_key, _ := auth.accessKeyResolver()()
+
+ if access_key != "access_key_id_from_aws_cli_env_var" {
+ t.Errorf("expected: %s, got: %#v", "access_key_id_from_aws_cli_env_var", access_key)
+ }
+
+ secret_key, _ := auth.secretKeyResolver()()
+
+ if secret_key != "secret_access_key_from_aws_cli_env_var" {
+ t.Errorf("expected: %#v, got: %#v", "secret_access_key_from_aws_cli_env_var", secret_key)
+ }
+}
+
+// See:
+// - https://github.com/hashicorp/terraform/pull/851
+// - https://github.com/hashicorp/terraform/issues/866
+//
+// We should not change default behaviour in a minor release, if end-user has both variations
+// of the env key set in their environment then we should give preference to the legacy one.
+func TestDeprecatedEnvVarsOverrideOfficialOnes(t *testing.T) {
+ resetEnvVars := cleanAwsEnvConfig()
+ defer resetEnvVars()
+
+ os.Setenv("AWS_ACCESS_KEY", "access_key_id_from_legacy_env_var")
+ os.Setenv("AWS_SECRET_KEY", "secret_access_key_from_legacy_env_var")
+ os.Setenv("AWS_ACCESS_KEY_ID", "access_key_id_from_aws_cli_env_var")
+ os.Setenv("AWS_SECRET_ACCESS_KEY", "secret_access_key_from_aws_cli_env_var")
+
+ auth := awsAuthSource{}
+
+ access_key, _ := auth.accessKeyResolver()()
+
+ if access_key != "access_key_id_from_legacy_env_var" {
+ t.Errorf("expected: %s, got: %#v", "access_key_id_from_legacy_env_var", access_key)
+ }
+
+ secret_key, _ := auth.secretKeyResolver()()
+
+ if secret_key != "secret_access_key_from_legacy_env_var" {
+ t.Errorf("expected: %s, got: %#v", "secret_access_key_from_legacy_env_var", secret_key)
+ }
+}
+
+func TestLoadCredentialsFromFileWhenNoConfigInEnv(t *testing.T) {
+ resetEnvVars := cleanAwsEnvConfig()
+ defer resetEnvVars()
+
+ credentialFile, err := prepareFakeCredentialFile("access_key_id_from_config", "secret_access_key_from_config")
+
+ if err != nil {
+ t.Fatalf("Could not create temporary AWS config file: '%s'", err)
+ }
+
+ os.Setenv("AWS_CREDENTIAL_FILE", credentialFile.Name())
+ defer os.Remove(credentialFile.Name())
+
+ auth := awsAuthSource{}
+
+ access_key, _ := auth.accessKeyResolver()()
+
+ if access_key != "access_key_id_from_config" {
+ t.Errorf("expected: %s, got: %#v", "access_key_id_from_config", access_key)
+ }
+
+ secret_key, _ := auth.secretKeyResolver()()
+
+ if secret_key != "secret_access_key_from_config" {
+ t.Errorf("expected: %s, bad: %#v", "secret_access_key_from_config", secret_key)
+ }
+}
+
+func TestAuthSourcerReturnsNilWhenDefaultsCannotBeFound(t *testing.T) {
+ resetEnvVars := cleanAwsEnvConfig()
+ defer resetEnvVars()
+
+ auth := awsAuthSource{}
+
+ access_key, _ := auth.accessKeyResolver()()
+
+ if access_key != nil {
+ t.Errorf("expected: nil, got: %#v", access_key)
+ }
+
+ secret_key, _ := auth.secretKeyResolver()()
+
+ if secret_key != nil {
+ t.Errorf("expected: nil, got: %#v", secret_key)
+ }
+}
+
 func testAccPreCheck(t *testing.T) {
  if v := os.Getenv("AWS_ACCESS_KEY_ID"); v == "" {
  t.Fatal("AWS_ACCESS_KEY_ID must be set for acceptance tests")

website/source/docs/providers/aws/index.html.markdown

@@ -35,10 +35,16 @@ resource "aws_instance" "web" {
 The following arguments are supported:
 
 * `access_key` - (Required) This is the AWS access key. It must be provided, but
- it can also be sourced from the `AWS_ACCESS_KEY_ID` environment variable.
+ it can also be sourced from the `AWS_ACCESS_KEY_ID` environment variable, or the
+ [AWS cli credentials file](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files).
 
 * `secret_key` - (Required) This is the AWS secret key. It must be provided, but
- it can also be sourced from the `AWS_SECRET_ACCESS_KEY` environment variable.
+ it can also be sourced from the `AWS_SECRET_ACCESS_KEY` environment variable, or the
+ [AWS cli credentials file](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files).
 
 * `region` - (Required) This is the AWS region. It must be provided, but
  it can also be sourced from the `AWS_DEFAULT_REGION` environment variables.
+
+It's possible to load credentials from a [specific profile](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-multiple-profiles)
+within the AWS cli's credentials file by setting the `AWS_PROFILE` environment variable.
+The `default` profile will be used if this variable is not set.