Both providers should works respectively but only the one with the custom endpoint_url works
Actual Behavior
The provider with the custom endpoint_url works, the classic one send http request but never get an awsner (except for the first sts getCallerIdentity request)
Relevant Error/Panic Output Snippet
No response
Terraform Configuration Files
~/.aws/config
[default]
region = eu-central-1
aws_access_key_id = 124fb9d8-4ef0-4c95-a95b-73989a9c43fb
aws_secret_access_key = 4490915d-6ef8-41d1-8177-c9360a04eded
endpoint_url = https://127.0.0.1:64483
ca_bundle = /xyz/aws-master-account-localca.pem
[profile security-aws-global] # This can be any valid profile (the only condition is that there's no custom endpoint_url)
sso_session = sso
sso_account_id = 99999999999
sso_role_name = SecurityAdministrator
region = eu-central-1
output = json
[sso-session sso]
sso_region = eu-central-1
sso_start_url = https://sso.awsapps.com/start
sso_registration_scopes = sso:account:access
providers.tf
provider "aws" {
region = "eu-central-1"
}
provider "aws" {
region = "eu-central-1"
alias = "security-aws-global"
profile = "security-aws-global"
}
- A non ending loop trying to Describe the KMS key to return the datasource, using the security-aws-global, we can see that there's only the request but any response get back
I can also mention that using two provider/profiles with different custom endpoint_url for both works, the issue is only where there's one provider that have an endpoint_url and the other not.
### References
_No response_
### Would you like to implement a fix?
None
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
Volunteering to Work on This Issue
If you are interested in working on this issue, please leave a comment.
If this would be your first contribution, please review the contribution guide.
Terraform Core Version
1.7.2
AWS Provider Version
5.47.0
Affected Resource(s)
No response
Expected Behavior
Both providers should works respectively but only the one with the custom endpoint_url works
Actual Behavior
The provider with the custom endpoint_url works, the classic one send http request but never get an awsner (except for the first sts getCallerIdentity request)
Relevant Error/Panic Output Snippet
No response
Terraform Configuration Files
~/.aws/config
providers.tf
test.tf
backend.tf
version.tf
Steps to Reproduce
the
terraform plan
will never succeed to fetch the datasource using thesecurity-aws-global
profileDebug Output
Panic Output
No response
Important Factoids
On logs we can clearly see the following
2024-03-27T17:42:52.224+0100 [DEBUG] backend-s3.aws-base: HTTP Response Received: aws.region=eu-central-1 rpc.method=GetCallerIdentity rpc.service=STS rpc.system=aws-api tf_aws.sdk=aws-sdk-go-v2 tf_aws.signing_region="" tf_backend.operation=Configure tf_backend.req_id=d6655cd8-127d-f32b-6922-1b6e014c2894 tf_backend.s3.bucket=terraform-master tf_backend.s3.path=test2 http.response.header.content_type=text/xml http.response.header.date="Wed, 27 Mar 2024 16:42:51 GMT" http.response.body= |
|
| Arn>arn:aws:sts::012345678901:assumed-role/teleport-aws-master-superadministrator/othmane.elmassari@xyz.com</Arn
| UserId>AROA*************NQQG:othmane.elmassari@xyz.com</UserId
| 012345678901
|
|
| d60a1891-1f34-4d70-b106-3df5749d6f8f
|
|
http.duration=786 http.status_code=200 http.response_content_length=505 http.response.header.x_amzn_requestid=d60a1891-1f34-4d70-b106-3df5749d6f8f
2024-03-27T17:42:53.987+0100 [DEBUG] provider.terraform-provider-aws_v5.42.0_x5: HTTP Request Sent: http.method=POST http.request.header.x_amz_date=20240327T164253Z tf_req_id=69bb6d5b-40ed-223f-bc98-c23a0e0fcbbc net.peer.name=sts.eu-central-1.amazonaws.com tf_mux_provider="*schema.GRPCProviderServer" tf_aws.signing_region="" http.request.header.amz_sdk_invocation_id=a296b1e9-7ca3-4c67-91f7-991f81e5e722 http.request.header.authorization="AWS4-HMAC-SHA256 Credential=ASIA****OCHY/20240327/eu-central-1/sts/aws4_request, SignedHeaders=amz-sdk-invocation-id;amz-sdk-request;content-length;content-type;host;x-amz-date;x-amz-security-token, Signature=" http.request.header.x_amz_security_token="" tf_rpc=ConfigureProvider @module=aws.aws-base aws.region=eu-central-1 rpc.service=STS tf_provider_addr=registry.terraform.io/hashicorp/aws @caller=github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.50/logging/tf_logger.go:47 http.user_agent="APN/1.0 HashiCorp/1.0 Terraform/1.7.5 (+https://www.terraform.io) terraform-provider-aws/5.42.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go-v2/1.26.0 os/macos lang/go#1.21.8 md/GOOS#darwin md/GOARCH#arm64 api/sts#1.28.5" rpc.method=GetCallerIdentity tf_aws.sdk=aws-sdk-go-v2 http.request.body= | Action=GetCallerIdentity&Version=2011-06-15 http.request.header.amz_sdk_request="attempt=1; max=25" http.request.header.content_type=application/x-www-form-urlencoded http.request_content_length=43 http.url=https://sts.eu-central-1.amazonaws.com/ rpc.system=aws-api timestamp="2024-03-27T17:42:53.987+0100" 2024-03-27T17:42:54.244+0100 [DEBUG] provider.terraform-provider-aws_v5.42.0_x5: HTTP Response Received: http.response.body= |
|
| Arn>arn:aws:sts::99999999999:assumed-role/AWSReservedSSO_SecurityAdministrator_2851005d414a8f55/othmane.elmassari@xyz.com</Arn
| UserId>AROA*************HVLF:othmane.elmassari@xyz.com</UserId
| 99999999999
|
|
| da10abfd-eb9b-4bbc-8084-e7b3a1a1be0e
|
|
http.response.header.date="Wed, 27 Mar 2024 16:42:54 GMT" http.response.header.x_amzn_requestid=da10abfd-eb9b-4bbc-8084-e7b3a1a1be0e http.response_content_length=520 http.status_code=200 rpc.method=GetCallerIdentity tf_aws.sdk=aws-sdk-go-v2 rpc.service=STS rpc.system=aws-api tf_provider_addr=registry.terraform.io/hashicorp/aws tf_req_id=69bb6d5b-40ed-223f-bc98-c23a0e0fcbbc tf_rpc=ConfigureProvider http.duration=256 aws.region=eu-central-1 tf_aws.signing_region="" @module=aws.aws-base http.response.header.content_type=text/xml tf_mux_provider="*schema.GRPCProviderServer" @caller=github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.50/logging/tf_logger.go:47 timestamp="2024-03-27T17:42:54.243+0100"
2024-03-27T17:42:54.254+0100 [DEBUG] provider.terraform-provider-aws_v5.42.0_x5: HTTP Request Sent: @caller=github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2@v2.0.0-beta.51/logger.go:109 http.request.header.authorization="AWS4-HMAC-SHA256 Credential=ASIA****OCHY/20240327/eu-central-1/kms/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=" net.peer.name=kms.eu-central-1.amazonaws.com http.request.header.x_amz_target=TrentService.DescribeKey http.flavor=1.1 http.request.header.content_type=application/x-amz-json-1.1 rpc.method=DescribeKey tf_rpc=ReadDataSource @module=aws http.method=POST rpc.system=aws-api tf_mux_provider="schema.GRPCProviderServer" tf_provider_addr=registry.terraform.io/hashicorp/aws aws.region=eu-central-1 http.url=https://kms.eu-central-1.amazonaws.com/ http.request.header.x_amz_date=20240327T164254Z http.request.header.x_amz_security_token="" http.user_agent="APN/1.0 HashiCorp/1.0 Terraform/1.7.5 (+https://www.terraform.io) terraform-provider-aws/5.42.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.51.4 (go1.21.8; darwin; arm64)" tf_data_source_type=aws_kms_key rpc.service=KMS tf_aws.sdk=aws-sdk-go http.request.body= | {"KeyId":"alias/kinesis_cloudtrail"} http.request_content_length=36 tf_req_id=f192440b-3d65-f583-f492-f2e2d09dec8b timestamp="2024-03-27T17:42:54.254+0100" 2024-03-27T17:42:54.422+0100 [DEBUG] provider.terraform-provider-aws_v5.42.0_x5: HTTP Request Sent: tf_provider_addr=registry.terraform.io/hashicorp/aws tf_req_id=f192440b-3d65-f583-f492-f2e2d09dec8b aws.region=eu-central-1 http.flavor=1.1 http.request_content_length=36 net.peer.name=kms.eu-central-1.amazonaws.com tf_mux_provider="schema.GRPCProviderServer" @caller=github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2@v2.0.0-beta.51/logger.go:109 http.request.header.authorization="AWS4-HMAC-SHA256 Credential=ASIA****OCHY/20240327/eu-central-1/kms/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=" http.request.header.x_amz_security_token="" http.url=https://kms.eu-central-1.amazonaws.com/ http.user_agent="APN/1.0 HashiCorp/1.0 Terraform/1.7.5 (+https://www.terraform.io) terraform-provider-aws/5.42.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.51.4 (go1.21.8; darwin; arm64)" tf_data_source_type=aws_kms_key http.method=POST http.request.header.x_amz_date=20240327T164254Z http.request.header.x_amz_target=TrentService.DescribeKey rpc.service=KMS http.request.body= | {"KeyId":"alias/kinesis_cloudtrail"} http.request.header.content_type=application/x-amz-json-1.1 rpc.system=aws-api @module=aws tf_aws.sdk=aws-sdk-go tf_rpc=ReadDataSource rpc.method=DescribeKey timestamp="2024-03-27T17:42:54.422+0100" 2024-03-27T17:42:54.543+0100 [DEBUG] provider.terraform-provider-aws_v5.42.0_x5: HTTP Request Sent: http.flavor=1.1 http.method=POST http.url=https://kms.eu-central-1.amazonaws.com/ tf_rpc=ReadDataSource http.user_agent="APN/1.0 HashiCorp/1.0 Terraform/1.7.5 (+https://www.terraform.io) terraform-provider-aws/5.42.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.51.4 (go1.21.8; darwin; arm64)" net.peer.name=kms.eu-central-1.amazonaws.com tf_mux_provider="*schema.GRPCProviderServer" http.request.header.content_type=application/x-amz-json-1.1 http.request.header.x_amz_target=TrentService.DescribeKey http.request_content_length=36 @caller=github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2@v2.0.0-beta.51/logger.go:109 aws.region=eu-central-1 tf_data_source_type=aws_kms_key tf_req_id=f192440b-3d65-f583-f492-f2e2d09dec8b http.request.header.x_amz_date=20240327T164254Z http.request.body= | {"KeyId":"alias/kinesis_cloudtrail"} rpc.method=DescribeKey rpc.system=aws-api tf_aws.sdk=aws-sdk-go @module=aws http.request.header.authorization="AWS4-HMAC-SHA256 Credential=ASIA****OCHY/20240327/eu-central-1/kms/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=" rpc.service=KMS http.request.header.x_amz_security_token="" tf_provider_addr=registry.terraform.io/hashicorp/aws timestamp="2024-03-27T17:42:54.543+0100"