cloudposse / cloudposse/atmos

1.217 regression: atmos list or describe try and fail to access remote tfstate

Open
#2,566 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
1.4k
Forks
175
Avg merge
2d 3h
Merged PRs (30d)
134

Description

### Describe the Bug

Starting with atmos 1.217, various commands such as
- atmos list stacks
- atmos list components
- atmos describe stacks

fail at trying to read a tfstate bucket they don't have access to.

### Expected Behavior

Getting the state is not necessary to perform these commands successfully, or at least, atmos up to 1.216 was able to executes those commands successfully in the same context.

### Steps to Reproduce

This happens to me In a project with 2 stages, each containing 2 components (global and customer) with customer depending on global: `data_bucket_name: !terraform.state global "{{ .vars.environment }}-{{ .settings.context.instance }}-global" data_bucket_name`

In this project, each stack specifies the default identity it requires (each stage being in a distinct account, as well as the related state bucket).

As a result, running the command with the identity required for stage A fails getting the state of stage B and vice versa:

```shell
$ atmos list stacks --identity prd-bastille-access
WARN Failed to read Terraform state after all retries exhausted file=global/dev-pen-global/terraform.tfstate bucket=dev-pen-tfstate attempts=3 error_code=AccessDenied error="operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::222222222222:assumed-role/00000000000/me@corp.com is not authorized to perform: s3:GetObject on resource: \"arn:aws:s3:::dev-pen-tfstate/global/dev-pen-global/terraform.tfstate\" because no resource-based policy allows the s3:GetObject action"

Error

Error: failed to execute describe stacks: failed to read Terraform state for component global in stack dev-pen-global
in YAML function: !terraform.state global "dev-pen-global" data_bucket_name
failed to get object from S3: operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::222222222222:assumed-role/00000000000/me@corp.com mailto:AdministratorAccess_3f83b7a4b982c403/me@corp.com is not authorized to perform: s3:GetObject on resource: "arn:aws:s3:::dev-pen-tfstate/global/dev-pen-global/terraform.tfstate" because no resource-based policy allows the s3:GetObject action

$ atmos list stacks --identity dev-pen-access
WARN Failed to read Terraform state after all retries exhausted file=global/prd-bastille-global/terraform.tfstate bucket=prd-bastille-tfstate attempts=3 error_code=AccessDenied error="operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_00000000000/me@corp.com is not authorized to perform: s3:GetObject on resource: \"arn:aws:s3:::prd-bastille-tfstate/global/prd-bastille-global/terraform.tfstate\" because no resource-based policy allows the s3:GetObject action"

Error

Error: failed to execute describe stacks: failed to read Terraform state for component global in stack prd-bastille-global
in YAML function: !terraform.state global "prd-bastille-global" data_bucket_name
failed to get object from S3: operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_00000000000/me@corp.com mailto:AdministratorAccess_00000000000/me@corp.com is not authorized to perform: s3:GetObject on resource: "arn:aws:s3:::prd-bastille-tfstate/global/prd-bastille-global/terraform.tfstate" because no resource-based policy allows the s3:GetObject action
```

### Screenshots

_No response_

### Environment

_No response_

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the atmos list stacks, atmos list components, and atmos describe stacks entry points, then trace how the !terraform.state function reads remote Terraform state from S3. Reproduce the failure with the two identities described in the issue; done means these commands succeed without requiring access to unrelated remote state.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, terraform
Domain
cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.