Support Terraform dynamic provider credentials

[wellsiau-aws]

Describe the outcome you'd like

Terraform Cloud (TFC) recently announced the new dynamic provider credentials. By using this new feature, you no longer need to store long-lived static AWS credentials as workspace variables. Instead, TFC will AssumeRoleWithWebIdentity via IAM OIDC provider, using the specified role ARN.

Is your feature request related to a problem you are currently experiencing? If so, please describe.

By implementing dynamic provider credentials support in AFT, each AFT managed workspaces no longer need to store static AWS credentials.

Additional positive impact: Terraform Cloud drift detection can run normally, previously this was not possible because AFT provided static AFT credentials will expires.

Additional context

To implement this, AFT needs to inject two environment variables in the workspace:

• TFC_AWS_RUN_ROLE_ARN set to AWSAFTAdmin role
• TFC_AWS_PROVIDER_AUTH set to true

Example how to bootstrap OIDC provider: https://github.com/hashicorp/terraform-dynamic-credentials-setup-examples/tree/main/aws

[stumins]

Hi @wellsiau-aws,

Thank you for the enhancement request. I've created a backlog item for the team to explore supporting this TFC feature.

[gautambaghel]

Any updates on this @stumins ?