fix(aws): skip STS pre-validation for ambient (OIDC) providers; don't bake creds#354
Merged
Merged
Conversation
Cre-eD
requested review from
Laboratory,
smecsia and
universe-ops
as code owners
Semgrep Scan ResultsRepository:
Scanned at 2026-06-30 15:45 UTC |
Security Scan ResultsRepository:
Scanned at 2026-06-30 15:45 UTC |
📊 Statement coverageMeasured on the documented included set (see
Baseline: |
… bake creds Re-deploying a stack that was previously deployed with static keys, now under ambient GitHub-OIDC creds, fails at the explicit pulumi-aws provider with 'Invalid credentials configured'. In pulumi-aws v6.83.4 that message means INCOMPLETE creds (not 'no creds' -> that is 'No valid credential sources found'): the eager STS pre-validation chokes on the static->ambient provider transition, even though the runner's ambient env creds are complete (incl. AWS_SESSION_TOKEN, which does reach the plugin) and authorize the real calls. Fix: in ambient mode (empty static keys) keep the provider credential-less so the AWS default chain resolves env creds at call time, and set SkipCredentialsValidation=true to skip the brittle pre-validation. Static keys keep validation on. Shared applyAWSProviderCreds helper (Provider() + cloudtrail region provider) + tests. Deliberately does NOT copy the rotating ambient creds (incl. session token) onto provider inputs: that persists ephemeral creds in the Pulumi checkpoint and diffs the provider every run. Supersedes the first approach after a Codex + Gemini review rejected credential-baking. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Cre-eD
force-pushed
the
fix/aws-ambient-explicit-provider-creds
branch
from
f53cd2d to
3c7848e
Compare
Cre-eD
changed the title
smecsia
approved these changes
Jun 30, 2026
universe-ops
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A real GitHub-OIDC
sc deployto a throwaway env failed at the explicit AWS provider:Everything else under ambient creds worked — OIDC federation, the S3 Pulumi state backend, KMS, StackReference reads.
Root cause (verified, not guessed)
No valid credential sources found). The provider does fall back to env (tokenelseAWS_SESSION_TOKEN), and the runner env had complete creds incl. the session token (confirmed in the run log).awsprovider resource hasaccessKey+secretKeybaked in (from prior static-key deploys),skipCredentialsValidation: false, notoken.Fix
In ambient mode (empty static keys): leave the provider credential-less (default chain resolves env creds at call time) and set
SkipCredentialsValidation: trueto skip the brittle pre-validation. Static keys keep validation on. SharedapplyAWSProviderCredshelper forProvider()+ the CloudTrail region provider. Tests cover both paths.The first ambient deploy self-heals the state (provider becomes creds-less +
skipCredentialsValidation: true); no manual state surgery.What this deliberately does NOT do
The original version of this PR baked the ambient env creds (incl. the rotating
AWS_SESSION_TOKEN) onto the provider inputs. A Codex (gpt-5.5) + Gemini review rejected that: it persists ephemeral creds in the encrypted checkpoint and produces a provider diff every run. Dropped.Verification
go build/go vet/go test ./pkg/clouds/pulumi/aws/green.testtmpre-deploy on this build (preview or post-release) — the ambient code path is dormant for every current caller (only reached whenaws-oidc-roleis set), so there is no production exposure from merging.Follow-up to #349.