Terraform:Autenticação do Terraform

provider "alicloud" {
  access_key = "<Your AccessKey ID>"
  secret_key = "<Your AccessKey secret>"
  # If you use an STS credential, configure security_token.
  # security_token = "<Your STS token>"
}

variable "access_key_id" {
  description = "The AccessKey ID for operating your infrastructure"
}
variable "access_key_secret" {
  description = "The AccessKey Secret for operating your infrastructure"
}
variable "security_token" {
  description = "The Security Token for operating your infrastructure"
}
provider "alicloud" {
  access_key = var.access_key_id
  secret_key = var.access_key_secret
  # If you use an STS credential, configure security_token.
  # security_token = var.security_token
}

$ terraform plan -var access_key_id="<Your AccessKey ID>" -var access_key_secret="<Your AccessKey secret>" -var security_token="<Your STS token>"

Linux/macOS

# AccessKey ID
$ export ALICLOUD_ACCESS_KEY="<Your AccessKey ID>"
# AccessKey Secret
$ export ALICLOUD_SECRET_KEY="<Your AccessKey secret>"
# If you use an STS credential, configure security_token.
$ export ALICLOUD_SECURITY_TOKEN="<Your STS token>"

Windows

1. Clique com o botão direito em This PC na área de trabalho e selecione Properties > Advanced system settings > Environment Variables.

2. Em System variables ou User variables, clique em New para criar as seguintes variáveis de ambiente: ALICLOUD_ACCESS_KEY, ALICLOUD_SECRET_KEY e ALICLOUD_SECURITY_TOKEN (opcional).

Após definir as variáveis de ambiente, declare apenas as informações que não sejam credenciais no bloco provider:

provider "alicloud" {
  region = "cn-hangzhou"
}

Também é possível definir a região por meio da variável de ambiente ALICLOUD_REGION. Caso nenhuma região seja especificada no bloco provider ou na variável de ambiente, cn-beijing será usado por padrão.

As variáveis de ambiente são mais práticas e seguras do que a configuração estática.

provider "alicloud" {
  ecs_role_name = "<Name of the RAM role attached to the ECS instance>"
}

provider "alicloud" {
  assume_role_with_oidc {
    oidc_provider_arn  = "<ARN of the OIDC IdP>"
    oidc_token         = "<OIDC token issued by the external IdP>"
    role_arn           = "<ARN of the RAM role>"
    policy             = "<Content of the RAM access policy>"
    role_session_name  = "<Custom role session name>"
    session_expiration = <Maximum validity period of the temporary access credential>
  }
}

provider "alicloud" {
  region = "cn-hangzhou"
  assume_role_with_oidc {
    policy             = <<EOF
    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "oss:ListBuckets",
          "Resource": "acs:oss:oss-cn-hangzhou:*:*"
        }
      ]
    }
    EOF
    session_name = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

provider "alicloud" {
  region = "cn-hangzhou"
  assume_role_with_oidc {
    session_name = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

provider "alicloud" {
  # The AccessKey ID of the RAM user that calls AssumeRole.
  access_key = "<AccessKey ID of the RAM user>"
  # The AccessKey secret of the RAM user that calls AssumeRole.
  secret_key = "<AccessKey secret of the RAM user>"
  assume_role {
    role_arn           = "<ARN of a RAM role>"
    policy             = "<Content of a RAM access policy>"
    session_name       = "<Custom role session name>"
    session_expiration = <Maximum validity period of the temporary access credential>
  }
}

provider "alicloud" {
  # For security, the access_key and secret_key here are set as environment variables.
  region = "cn-hangzhou"
  assume_role {
    role_arn           = "acs:ram::11827xxxxxx:role/tf-assume-role"
    policy             = <<EOF
    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "oss:ListBuckets",
          "Resource": "acs:oss:oss-cn-hangzhou:*:*"
        }
      ]
    }
    EOF
    session_name       = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

provider "alicloud" {
  ecs_role_name = "<Name of the RAM role attached to the ECS instance>"
  region        = "cn-hangzhou"
  assume_role {
    role_arn           = "acs:ram::11827xxxxxx:role/tf-assume-role"
    policy             = <<EOF
    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "oss:ListBuckets",
          "Resource": "acs:oss:oss-cn-hangzhou:*:*"
        }
      ]
    }
    EOF
    session_name       = "terraform-assume-role-session"
    session_expiration = 1000
  }
}

provider "alicloud" {
  region = "cn-hangzhou"
  credentials_url= "http://credentials.uri/"
}