aws / aws/aws-toolkit-azure-devops

Cannot use runtime variable reference for awsCredentials

Open
#326 7 comments 3 reactions 0 assignees View on GitHub
guidance
Dominant language
TypeScript
Stars
258
Forks
114
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
I am attempting to use a runtime variable reference to specify the name of the AWS service connection based on the branch being built. When the pipeline is run, it fails automatically with the following error:

`The pipeline is not valid. Job build_service_client_review_notes: Step AWSShellScript input awsCredentials references service connection $(aws_service_connection) which could not be found. The service connection does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.`

My template is defined as follows:

```
parameters:
- name: 'serviceDirectory'
type: string
- name: 'serviceName'
type: string
- name: 'jobId'
type: string

jobs:
- job: 'build_service_${{ parameters.jobId }}'
displayName: 'Build, Test, and Package Service - ${{ parameters.serviceName }}'
pool: 'xxxx'
container: 'xxxx'
variables:
is_ci_build: $[in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI')]
package_dir: 'dist'
aws_region: 'us-east-2'
aws_service_connection: 'AWSDevServiceConnection'
steps:
- task: ShellScript@2
displayName: 'Configure build variables'
inputs:
scriptPath: '.devops/scripts/configure-build-environment.sh'

- template: '/.devops/templates/steps/build-and-test-project.yml'
parameters:
projectDirectory: ${{ parameters.serviceDirectory }}
projectName: ${{parameters.serviceName}}

- script: |
sls package --stage $(env) --package $(package_dir)
displayName: 'Package'
workingDirectory: ${{ parameters.serviceDirectory }}

- task: AWSShellScript@1
displayName: 'Deploy'
inputs:
awsCredentials: $(aws_service_connection)
regionName: $(aws_region)
scriptType: 'inline'
disableAutoCwd: true
workingDirectory: ${{ parameters.serviceDirectory }}
inlineScript: |
sls deploy --package $(package_dir) --force
condition: and(succeeded(), or(eq(variables['force_deploy'], true), and(eq(variables['is_ci_build'], true), eq(variables['should_sls_deploy'], true))))
```
The variables is static right now, but the hope is to dynamically set it in a script to the correct environment based on the branch.

Any guidance would be appreciated. Thanks!

**To reproduce**
1. Create a pipeline that uses the template above, and replace the `aws_service_connection` variable with the name of a valid service connection from your account.
2. Run a build
3. Observe the error occur

**Expected behavior**

The runtime variable expression is evaluated at runtime.

**Screenshots**

Screen Shot 2020-02-18 at 6 02 27 PM

**Your Environment**
Using Azure DevOps at https://dev.azure.com

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure using the pipeline template shown, including the aws_service_connection variable and AWSShellScript@1 task. Read .devops/scripts/configure-build-environment.sh and the referenced build-and-test-project.yml template, then determine whether runtime assignment of awsCredentials is supported. Done means the pipeline can select the intended service connection dynamically, or the limitation and supported behavior are clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, azure, yaml
Domain
ci-cd, cloud, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.