Answers: <p>The answer to this question is no. I merely forgot to export the AWS_SECRET_ACCESS_KEY variable in the before_script section.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-05-04T14:53:15.927Z
Answers: :-) Funny how often I write up an answer and the brain shifts to reveal its block like I see here. Thanks for coming back and answering your own question!
Answers: Josiah
Answers: CC BY-SA 4.0
Answers: 2021-04-22T09:49:26.097Z
Answers: 2021-04-22T09:49:26.097Z
Answers: Lucky
Answers: <p>In our terraform pipeline we use the aws cli command to assume a role and get the credential variables, the EC2 instance for the pipeline worker is using a profile which can assume the role.</p>
  <pre><code>creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --role-session-name tf-pipeline | jq -r '.Credentials')
  export AWS_ACCESS_KEY_ID=$(echo $creds | jq -r '.AccessKeyId')
  export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq -r '.SecretAccessKey')
  export AWS_SESSION_TOKEN=$(echo $creds | jq -r '.SessionToken')
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-06-16T10:23:06.807Z
Answers: 2021-06-16T10:23:06.807Z
Answers: Alastair Montgomery
Answers: <p>in the case of using GitLab ci ENV var, if u are testing in branches other than main/master, make sure your variables are not <strong>PROTECTED</strong></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-08-16T09:41:12.367Z
Answers: 2021-08-16T09:41:12.367Z
Answers: Sina Miandashti
Body: <p>I am trying to set up a pipeline, which is supposed to deploy terraform code into an aws account. The code works fine locally, and I have setup and imported the state bucket and dynamodb table which enables state locking.</p>
  <p>However, when I run the code in a gitlab ci, I get the following error message:</p>
  <blockquote>
  <p>Error: error configuring S3 Backend: no valid credential sources for S3 Backend found.
  │
  │ Please see <a href="https://www.terraform.io/docs/language/settings/backends/s3.html" rel="nofollow noreferrer">https://www.terraform.io/docs/language/settings/backends/s3.html</a>
  │ for more information about providing credentials.
  │
  │ Error: NoCredentialProviders: no valid providers in chain. Deprecated.
  │   For verbose messaging see aws.Config.CredentialsChainVerboseErrors</p>
  </blockquote>
  <p>I export the aws credentials as variables in the before_script like so:</p>
  <pre><code>before_script:
    - rm -rf .terraform
    - terraform --version
    - export AWS_ACCESS_KEY_ID
    - export AWS_ROLE_ARN
    - export AWS_DEFAULT_REGION
    - export AWS_ROLE_ARN
  </code></pre>
  <p>Is there another step that I am missing, or do I maybe have to include the credential variables in the terraform code?</p>
  
Tags: <continuous-integration><terraform><gitlab><gitlab-ci-runner><continuous-delivery>
Title: Do I have to include gitlab variables in my terraform code in order for my credentials to be recognized?
UserDisplayName: Lucky
ThreadText: # Do I have to include gitlab variables in my terraform code in order for my credentials to be recognized?
  
  (Asked by: username_0 on 2021-04-22)
  
  I am trying to set up a pipeline, which is supposed to deploy terraform code into an aws account. The code works fine locally, and I have setup and imported the state bucket and dynamodb table which enables state locking.
  
  However, when I run the code in a gitlab ci, I get the following error message:
  
  > Error: error configuring S3 Backend: no valid credential sources for S3 Backend found.
  > │
  > │ Please see <https://www.terraform.io/docs/language/settings/backends/s3.html>
  > │ for more information about providing credentials.
  > │
  > │ Error: NoCredentialProviders: no valid providers in chain. Deprecated.
  > │ For verbose messaging see aws.Config.CredentialsChainVerboseErrors
  
  I export the aws credentials as variables in the before\_script like so:
  
  ```
  before_script:
    - rm -rf .terraform
    - terraform --version
    - export AWS_ACCESS_KEY_ID
    - export AWS_ROLE_ARN
    - export AWS_DEFAULT_REGION
    - export AWS_ROLE_ARN
  
  ```
  
  Is there another step that I am missing, or do I maybe have to include the credential variables in the terraform code?
  
  **Tags:** continuous-integration, terraform, gitlab, gitlab-ci-runner, continuous-delivery
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2021-04-22. Score: 2 | Accepted answer
  
  The answer to this question is no. I merely forgot to export the AWS\_SECRET\_ACCESS\_KEY variable in the before\_script section.
  
  > **Comments:**
  > **username_1**: :-) Funny how often I write up an answer and the brain shifts to reveal its block like I see here. Thanks for coming back and answering your own question!  
  
  ---
  
  ### Answer by username_2 on 2021-06-16. Score: 0
  
  In our terraform pipeline we use the aws cli command to assume a role and get the credential variables, the EC2 instance for the pipeline worker is using a profile which can assume the role.
  
  ```
  creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --role-session-name tf-pipeline | jq -r '.Credentials')
  export AWS_ACCESS_KEY_ID=$(echo $creds | jq -r '.AccessKeyId')
  export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq -r '.SecretAccessKey')
  export AWS_SESSION_TOKEN=$(echo $creds | jq -r '.SessionToken')
  
  ```
  
  
  ---
  
  ### Answer by username_3 on 2021-08-16. Score: 0
  
  in the case of using GitLab ci ENV var, if u are testing in branches other than main/master, make sure your variables are not **PROTECTED**
  
  
  ---
  
  