1.217 regression: atmos list or describe try and fail to access remote tfstate
- Dominant language
- Go
- Stars
- 1.4k
- Forks
- 175
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 134
Description
### Describe the Bug
Starting with atmos 1.217, various commands such as
- atmos list stacks
- atmos list components
- atmos describe stacks
fail at trying to read a tfstate bucket they don't have access to.
### Expected Behavior
Getting the state is not necessary to perform these commands successfully, or at least, atmos up to 1.216 was able to executes those commands successfully in the same context.
### Steps to Reproduce
This happens to me In a project with 2 stages, each containing 2 components (global and customer) with customer depending on global: `data_bucket_name: !terraform.state global "{{ .vars.environment }}-{{ .settings.context.instance }}-global" data_bucket_name`
In this project, each stack specifies the default identity it requires (each stage being in a distinct account, as well as the related state bucket).
As a result, running the command with the identity required for stage A fails getting the state of stage B and vice versa:
```shell
$ atmos list stacks --identity prd-bastille-access
WARN Failed to read Terraform state after all retries exhausted file=global/dev-pen-global/terraform.tfstate bucket=dev-pen-tfstate attempts=3 error_code=AccessDenied error="operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::222222222222:assumed-role/00000000000/me@corp.com is not authorized to perform: s3:GetObject on resource: \"arn:aws:s3:::dev-pen-tfstate/global/dev-pen-global/terraform.tfstate\" because no resource-based policy allows the s3:GetObject action"
Error
Error: failed to execute describe stacks: failed to read Terraform state for component global in stack dev-pen-global
in YAML function: !terraform.state global "dev-pen-global" data_bucket_name
failed to get object from S3: operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::222222222222:assumed-role/00000000000/me@corp.com mailto:AdministratorAccess_3f83b7a4b982c403/me@corp.com is not authorized to perform: s3:GetObject on resource: "arn:aws:s3:::dev-pen-tfstate/global/dev-pen-global/terraform.tfstate" because no resource-based policy allows the s3:GetObject action
$ atmos list stacks --identity dev-pen-access
WARN Failed to read Terraform state after all retries exhausted file=global/prd-bastille-global/terraform.tfstate bucket=prd-bastille-tfstate attempts=3 error_code=AccessDenied error="operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_00000000000/me@corp.com is not authorized to perform: s3:GetObject on resource: \"arn:aws:s3:::prd-bastille-tfstate/global/prd-bastille-global/terraform.tfstate\" because no resource-based policy allows the s3:GetObject action"
Error
Error: failed to execute describe stacks: failed to read Terraform state for component global in stack prd-bastille-global
in YAML function: !terraform.state global "prd-bastille-global" data_bucket_name
failed to get object from S3: operation error S3: GetObject, https response error StatusCode: 403, api error AccessDenied: User: arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_00000000000/me@corp.com mailto:AdministratorAccess_00000000000/me@corp.com is not authorized to perform: s3:GetObject on resource: "arn:aws:s3:::prd-bastille-tfstate/global/prd-bastille-global/terraform.tfstate" because no resource-based policy allows the s3:GetObject action
```
### Screenshots
_No response_
### Environment
_No response_
### Additional Context
_No response_
Contributor guide
Research direction
Start with the atmos list stacks, atmos list components, and atmos describe stacks entry points, then trace how the !terraform.state function reads remote Terraform state from S3. Reproduce the failure with the two identities described in the issue; done means these commands succeed without requiring access to unrelated remote state.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, terraform
- Domain
- cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100