aws / aws/aws-toolkit-azure-devops
Cannot use runtime variable reference for awsCredentials
- Dominant language
- TypeScript
- Stars
- 258
- Forks
- 114
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
I am attempting to use a runtime variable reference to specify the name of the AWS service connection based on the branch being built. When the pipeline is run, it fails automatically with the following error:
`The pipeline is not valid. Job build_service_client_review_notes: Step AWSShellScript input awsCredentials references service connection $(aws_service_connection) which could not be found. The service connection does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.`
My template is defined as follows:
```
parameters:
- name: 'serviceDirectory'
type: string
- name: 'serviceName'
type: string
- name: 'jobId'
type: string
jobs:
- job: 'build_service_${{ parameters.jobId }}'
displayName: 'Build, Test, and Package Service - ${{ parameters.serviceName }}'
pool: 'xxxx'
container: 'xxxx'
variables:
is_ci_build: $[in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI')]
package_dir: 'dist'
aws_region: 'us-east-2'
aws_service_connection: 'AWSDevServiceConnection'
steps:
- task: ShellScript@2
displayName: 'Configure build variables'
inputs:
scriptPath: '.devops/scripts/configure-build-environment.sh'
- template: '/.devops/templates/steps/build-and-test-project.yml'
parameters:
projectDirectory: ${{ parameters.serviceDirectory }}
projectName: ${{parameters.serviceName}}
- script: |
sls package --stage $(env) --package $(package_dir)
displayName: 'Package'
workingDirectory: ${{ parameters.serviceDirectory }}
- task: AWSShellScript@1
displayName: 'Deploy'
inputs:
awsCredentials: $(aws_service_connection)
regionName: $(aws_region)
scriptType: 'inline'
disableAutoCwd: true
workingDirectory: ${{ parameters.serviceDirectory }}
inlineScript: |
sls deploy --package $(package_dir) --force
condition: and(succeeded(), or(eq(variables['force_deploy'], true), and(eq(variables['is_ci_build'], true), eq(variables['should_sls_deploy'], true))))
```
The variables is static right now, but the hope is to dynamically set it in a script to the correct environment based on the branch.
Any guidance would be appreciated. Thanks!
**To reproduce**
1. Create a pipeline that uses the template above, and replace the `aws_service_connection` variable with the name of a valid service connection from your account.
2. Run a build
3. Observe the error occur
**Expected behavior**
The runtime variable expression is evaluated at runtime.
**Screenshots**

**Your Environment**
Using Azure DevOps at https://dev.azure.com
Contributor guide
Research direction
Reproduce the failure using the pipeline template shown, including the aws_service_connection variable and AWSShellScript@1 task. Read .devops/scripts/configure-build-environment.sh and the referenced build-and-test-project.yml template, then determine whether runtime assignment of awsCredentials is supported. Done means the pipeline can select the intended service connection dynamically, or the limitation and supported behavior are clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, azure, yaml
- Domain
- ci-cd, cloud, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100