Which is the "calling entity" when invoking Terraform with a role from another account?

user_1198321 0
Viewed 47

I am using cross-account authorisation to create AWS resources with Terraform. That is to say:

  • I have an account "A" where I have a user.
  • I also have an account "B" where I have a role that is authorised to deploy resources within account "B".
  • My user account in "A" is authorised to assume the role in account "B".
  • When I run Terraform (with the "aws" provider), I have the credentials for user "A" in the aws credentials file.
  • My Terraform configuration has the provider block like this:
provider "aws" {
  assume_role {
    role_arn = "<ARN of roleB>"
  }
}

The documentation for the aws_caller_identity data source says that it exposes details about "the calling entity", but it is unclear to me which "entity" this should be in my case: is it userA or roleB?

terraform-provider-aws
1 Answers

While I have been unable to find any official documentation that specifies which entity this refers to, by experimentation I have determined that "the calling entity" in this case is the role session in account "B" (note that while this is related to the role, it is not actually the role itself).

The ARN exposed by this data source looks like

"arn:aws:sts::<account B ID>:assumed-role/<name of role B>/<session name>"

The session name can be specified explicitly in the assume_role block, but if it is omitted then it is a semi-random-looking 19-digit number (I'm not sure whether this number is generated by Terraform or AWS).

user_11983210
Related