Hi,
I have a problem with assuming role. I'm using this drone pipeline definition:
type: kubernetes
clone:
depth: 10
kind: pipeline
name: terraform plan - alfa
resources:
requests:
cpu: 300
memory: 300MiB
service_account_name: tf-on-drone-sa
steps:
- image: jmccann/drone-terraform:8.3-1.0.2
name: tf plan ns_system
plan: true
role_arn_to_assume: arn:aws:iam::123456789:role/tf-on-drone-access
settings:
actions: validate,plan
root_dir: eks/environments/alfa/terraform_ns_system
trigger:
branch:
- drone-terraform
event:
- push
This is run in a CI cluster on aws account for CI. There's kubernetes serviceAccount tf-on-drone-sa which is associated with IAM role on CI account that allows to assume role from ALFA account. This role in ALFA account has permissions to access s3:* and dynamodb:* to have access to a terraform remote state.
After running, I'm getting this error:
To test, if roles are correctly set up, I am running terraform plan from local with ~/.aws/credentials set to assume role from ALFA (with correct IAM permissions to allow assuming ALFA role with my aws user) and it works fine.
Also if I put role_arn_to_assume: arn:aws:iam::123456789:role/tf-on-drone-access under settings: section like this:
settings:
actions: validate,plan
role_arn_to_assume: arn:aws:iam::123456789:role/tf-on-drone-access
It's gonna use env PLUGIN_ROLE_ARN_TO_ASSUME in pod and EC2 instance for Kubernetes cluster on which is Drone running as principal will assume ALFA role (with correct IAM permissions to allow assuming ALFA role with default IAM role for CI nodes) and terraform plan works.
Hi,
I have a problem with assuming role. I'm using this drone pipeline definition:
This is run in a CI cluster on aws account for CI. There's kubernetes serviceAccount tf-on-drone-sa which is associated with IAM role on CI account that allows to assume role from ALFA account. This role in ALFA account has permissions to access s3:* and dynamodb:* to have access to a terraform remote state.
After running, I'm getting this error:
To test, if roles are correctly set up, I am running terraform plan from local with ~/.aws/credentials set to assume role from ALFA (with correct IAM permissions to allow assuming ALFA role with my aws user) and it works fine.
Also if I put role_arn_to_assume: arn:aws:iam::123456789:role/tf-on-drone-access under settings: section like this:
It's gonna use env PLUGIN_ROLE_ARN_TO_ASSUME in pod and EC2 instance for Kubernetes cluster on which is Drone running as principal will assume ALFA role (with correct IAM permissions to allow assuming ALFA role with default IAM role for CI nodes) and terraform plan works.