infernet-deploy
infernet-deploy copied to clipboard
fix: update procure/aws to use AWS credentials provider chain
Hi
I noticed we had taken the option to specify aws_access_key_id and aws_secret_access_key in the procure/aws example. This is somewhat of an anti-pattern and incompatible with more modern security best practices to only use short lived or temporary access tokens.
I have modifed the provider to not specify this, and instead rely on the AWS credentials provider chain which will cascade through a handful of possible places the credentials might be provisioned.
This means each user/invoker can choose how to provisiion credentials, ie:
export AWS_ACCESS_KEY_ID=foo
export AWS_SECRET_ACCESS_KEY=bar
terraform init
or
AWS_PROFILE=my-profile-entry terraform init if credentials are in ~/.aws/credentials, or other areas if necessary (ie: instance temporary credentials).
Thank you