Open julian-koho opened 2 years ago
For 1., this is never going to work: the sops provider (actually sops itself) doesn't know anything about the AWS provider and the settings you configure in the AWS provider are only local to that provider.
So, if the AWS provider manages to assume a new role and get temporary credentials for this role, it will not set anything "outside" of the provider and you can't reuse it for sops.
For 2., you are almost there:
aws_profile
, I suppose it has to be a profile that you configure inside your AWS configuration file. The profile may then contain the name of the role it will try to assume.aws_profile
, simply use role: "arn:aws:iam::{account-id}:role/{role-id}"
and it should do what you want to do. You can read more here: Assuming roles and using KMS in various AWS accounts
Hello, I’m facing an issue currently where I get the following error
This appears to be tied to a lack of AWS permissions to use the key. I’m not sure what I’m missing or need to do to make this function. I’ve tried the following:
variable “access_key” {} variable “secret_key” {} variable “aws_region” {} variable "role_arn" {} variable "external_id" {}
The user here has the permission for the role specified in the associated sops file:
These two methods did not resolve the issue, so I feel like I'm either missing something foundational, or there is unexpected behaviour here.
My theories are around the way the provider (via sops, via the aws SDK) is acting is somehow misbehaving, but I admit that my attempts to follow the code and debug stalled out a bit in the middle of the sops decrypt package.