Terraform:Terraform authentication

Define access credentials directly in the provider block of a Terraform configuration file.

Parameters

provider "alicloud" {
  access_key = "<Your AccessKey ID>"
  secret_key = "<Your AccessKey secret>"
  # If you use an STS credential, configure security_token.
  # security_token = "<Your STS token>"
}

Example configuration

For security, pass credentials as variables instead of hard-coding them. Do not set default values:

variable "access_key_id" {
  description = "The AccessKey ID for operating your infrastructure"
}
variable "access_key_secret" {
  description = "The AccessKey Secret for operating your infrastructure"
}
variable "security_token" {
  description = "The Security Token for operating your infrastructure"
}
provider "alicloud" {
  access_key = var.access_key_id
  secret_key = var.access_key_secret
  # If you use an STS credential, configure security_token.
  # security_token = var.security_token
}

Use the terraform command with the -var option to pass variable values:

$ terraform plan -var access_key_id="<Your AccessKey ID>" -var access_key_secret="<Your AccessKey secret>" -var security_token="<Your STS token>"

Store credentials in environment variables. Terraform reads these when no static configuration exists.

Parameters

Example configuration

# AccessKey ID
$ export ALICLOUD_ACCESS_KEY="<Your AccessKey ID>"
# AccessKey Secret
$ export ALICLOUD_SECRET_KEY="<Your AccessKey secret>"
# If you use an STS credential, configure security_token.
$ export ALICLOUD_SECURITY_TOKEN="<Your STS token>"

provider "alicloud" {
  region = "cn-hangzhou"
}

When Terraform runs on an ECS instance, authenticate using an instance RAM role. The instance automatically obtains and refreshes temporary credentials, eliminating AccessKey configuration. Instance RAM roles.

Parameters

Example configuration

1. Prepare an ECS instance that has public network access.

2. Create a RAM role and attach it to the ECS instance.

3. In the provider block, set the ecs_role_name parameter to the name of the RAM role:

provider "alicloud" {
  ecs_role_name = "<Name of the RAM role attached to the ECS instance>"
}

You can also set this parameter using the ALICLOUD_ECS_ROLE_NAME environment variable.

Instance RAM role authentication is recommended when running Terraform on ECS.

OIDC role assumption obtains temporary credentials by assuming a RAM role using an OIDC identity, rather than an AccessKey. Manage OIDC IdPs.

Parameters

Configure the following parameters in the assume_role_with_oidc block:

Example configuration

This method calls AssumeRoleWithOIDC - Obtain a temporary credential for a RAM role of an OIDC IdP for role-based SSO. Before configuring, prepare:

1. Create an OIDC IdP, obtain an OIDC token from the external IdP, and record the OIDC IdP's ARN and the OIDC token.

2. Create a RAM role with an identity provider as the trusted entity, grant the role the required permissions (such as AliyunOSSFullAccess), and record the ARN of the role.

3. (Optional) Write a custom RAM policy for fine-grained access control. This policy intersects with the role's attached permissions.

Add the following to the provider block:

provider "alicloud" {
  assume_role_with_oidc {
    oidc_provider_arn  = "<ARN of the OIDC IdP>"
    oidc_token         = "<OIDC token issued by the external IdP>"
    role_arn           = "<ARN of the RAM role>"
    policy             = "<Content of the RAM access policy>"
    role_session_name  = "<Custom role session name>"
    session_expiration = <Maximum validity period of the temporary access credential>
  }
}

ACK supports RRSA (RAM Roles for Service Accounts) to automatically create OIDC IdPs and issue tokens. Use RRSA to authorize different pods to access different cloud services. After enabling RRSA, the ack-pod-identity-webhook component injects the ALIBABA_CLOUD_OIDC_PROVIDER_ARN, ALIBABA_CLOUD_OIDC_TOKEN_FILE, and ALIBABA_CLOUD_ROLE_ARN environment variables into pods. In an ACK pod, the configuration simplifies to:

provider "alicloud" {
  region = "cn-hangzhou"
  assume_role_with_oidc {
    policy             = <<EOF
    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "oss:ListBuckets",
          "Resource": "acs:oss:oss-cn-hangzhou:*:*"
        }
      ]
    }
    EOF
    session_name = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

Without a custom policy, grant permissions directly to the RAM role:

provider "alicloud" {
  region = "cn-hangzhou"
  assume_role_with_oidc {
    session_name = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

Role assumption (AssumeRole) enables permission separation and cross-account access. An existing identity (RAM user or ECS instance role) assumes a RAM role to obtain temporary credentials.

Parameters

Supported parameters:

1. access_key and secret_key: The AccessKey of the RAM user assuming the role. The user must have sts:AssumeRole permission. Can also be set via environment variables.

2. assume_role: A configuration block with the following parameters:

Example configuration

This method calls AssumeRole - Obtain a temporary credential for a RAM role. Before configuring, prepare:

1. Create a RAM user and grant the AliyunSTSAssumeRoleAccess policy (or a custom policy that contains the sts:AssumeRole permission).

2. Create an AccessKey for the RAM user.

3. Create a RAM role whose trusted entity is an Alibaba Cloud account, grant it the required permissions (such as AliyunOSSFullAccess), and record its ARN.

4. (Optional) Write a custom RAM policy for fine-grained access control.

Configure the provider block:

provider "alicloud" {
  # The AccessKey ID of the RAM user that calls AssumeRole.
  access_key = "<AccessKey ID of the RAM user>"
  # The AccessKey secret of the RAM user that calls AssumeRole.
  secret_key = "<AccessKey secret of the RAM user>"
  assume_role {
    role_arn           = "<ARN of a RAM role>"
    policy             = "<Content of a RAM access policy>"
    session_name       = "<Custom role session name>"
    session_expiration = <Maximum validity period of the temporary access credential>
  }
}

This example lists OSS buckets in cn-hangzhou using role assumption. The access_key and secret_key are set via environment variables:

provider "alicloud" {
  # For security, the access_key and secret_key here are set as environment variables.
  region = "cn-hangzhou"
  assume_role {
    role_arn           = "acs:ram::11827xxxxxx:role/tf-assume-role"
    policy             = <<EOF
    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "oss:ListBuckets",
          "Resource": "acs:oss:oss-cn-hangzhou:*:*"
        }
      ]
    }
    EOF
    session_name       = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

On an ECS instance, use an instance RAM role instead of hard-coding credentials. Grant AliyunSTSAssumeRoleAccess to the instance's RAM role:

provider "alicloud" {
  ecs_role_name = "<Name of the RAM role attached to the ECS instance>"
  region        = "cn-hangzhou"
  assume_role {
    role_arn           = "acs:ram::11827xxxxxx:role/tf-assume-role"
    policy             = <<EOF
    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "oss:ListBuckets",
          "Resource": "acs:oss:oss-cn-hangzhou:*:*"
        }
      ]
    }
    EOF
    session_name       = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

Retrieves credentials from a specified URI.

Parameters

Example configuration

provider "alicloud" {
  region = "cn-hangzhou"
  credentials_url= "http://credentials.uri/"
}