S3 go getter doesn't work w/ CodeBuild Service Role Creds

[sdmichelini]

Issue that was fixed in the aws provider(https://github.com/terraform-providers/terraform-provider-aws/pull/1425/files) does not seem to be fixed here. The issue arises when you true to import a module from s3 while you are running inside CodeBuild.

[m13t]

I can confirm this also does not work from within an ECS container. It seems the code is explicitly looking for EC2 instance metadata URLs and does not check for AWS_EXECUTION_ENV=AWS_ECS_EC2 environment variables to ascertain whether to get credentials from AWS_CONTAINER_CREDENTIALS_RELATIVE_URI instead.

[solarmosaic-kflorence]

It is terribly confusing that all other places in Terraform work, and this one fails. Took me awhile to figure out what the root issue was. Please prioritize this fix!

[solarmosaic-kflorence]

Here is a workaround, in accordance with https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html (it can be sourced within a CodeBuild buildspec, for example in the pre_build phase).

#!/usr/bin/env bash
AWS_ACCESS_KEY_ID=$(curl --silent http://169.254.170.2:80$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | jq -r '.AccessKeyId')
AWS_SECRET_ACCESS_KEY=$(curl --silent http://169.254.170.2:80$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | jq -r '.SecretAccessKey')
AWS_SESSION_TOKEN=$(curl --silent http://169.254.170.2:80$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | jq -r '.Token')
export AWS_ACCESS_KEY_ID
export AWS_SECRET_ACCESS_KEY
export AWS_SESSION_TOKEN

Here is the corresponding ticket in terraform: hashicorp/terraform#20439

[solarmosaic-kflorence]

@azr I believe this has been resolved by #218