Terraform Cloud / Enterprise - How to use AWS Assume Roles

Question

I would like to use AWS Assume Roles, with Terraform Cloud / Enterprise

In Terraform Open Source, you would typically just do an Assume Role, leveraging the .aws/Credential Profile on the CLI, which is the initial authentication, and performing the Assume Role:

provider "aws" {
  assume_role {
    role_arn     = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
    session_name = "SESSION_NAME"
    external_id  = "EXTERNAL_ID"
  }
}

The issue is, with Terraform Enterprise or Cloud, you cannot reference a profile, as the immutable infrastructure will not have that file in its directory.

Terraform Cloud/Enterprise needs to have an Access Key ID, and Secret Access Key, set as a variable, so its infrastructure can perform the Terraform RUN, via its Pipeline, and authenticate to what ever AWS Account you would like to provision within.

So the question is: How can I perform an AWS Assume Role, leveraging the Access Key ID, and Secret Access Key, of the AWS account with the "Action": "sts:AssumeRole", Policy?

I would think, the below would work, however Terraform is doing the initial authentication via the AWS Credential Profile creds, for the account which has the sts:AssumeRole policy

Can Terraform look at the access_key, and secret_key, to determine what AWS account to use, when trying to assume the role, rather than use the AWS Credential Profile?

provider "aws" {
  region                  = var.aws_region
  access_key              = var.access_key_id
  secret_key              = var.secret_access_key

    assume_role {
    role_arn     = "arn:aws:iam::566264069176:role/RemoteAdmin"
    #role_arn     = "arn:aws:iam::<awsaccount>:role/<rolename>" # Do a replace in "file_update_automation.ps1"
    session_name = "RemoteAdminRole"
  }
}

In order to allow Terraform Cloud/Enterprise to get new Assume Role Session Tokens, it would need to use the Access_key and Secret_key, to tell it what AWS Account has the sts:assume role, linking to the member AWS Account to be provisioned, and not an AWS Creds Profile

Thank you

Answer 1

I used the exact same provider configuration minus the explicit adding of the acces keys. The access keys were added in the Terraform Cloud workspace as environment variables.

Answer 2

This can be achive if you have a business plan enabled and implement self hosted terraform agents in you infrastructure.See video.