AssumRoleWithOidc Configuration does not work as described in the doc

[lucklove]

Describe what happened

Refer to assumeRoleWithOidc Configuration Block.

export ALIBABA_CLOUD_OIDC_TOKEN_FILE=/tmp/oidc_token # this file stored the oidc token
export ALIBABA_CLOUD_ROLE_ARN="acs:ram::***:role/***"
export ALIBABA_CLOUD_OIDC_PROVIDER_ARN="acs:ram::***:oidc-provider/***"
pulumi preview

It seems that pulumi doesn't read the env variables at all:

error: configuring Terraform Alibaba Cloud Provider: no valid credential sources for Terraform Alibaba Cloud Provider found.

Sample program

name: configuration-example
runtime: nodejs

import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";

const config = new pulumi.Config();
const name = config.get("name") || "pulumi-example";
const default = alicloud.getZones({
    availableDiskCategory: "cloud_efficiency",
    availableResourceCreation: "VSwitch",
});
// Create a new ECS instance for VPC
const vpc = new alicloud.vpc.Network("vpc", {
    vpcName: name,
    cidrBlock: "172.16.0.0/16",
});
const vswitch = new alicloud.vpc.Switch("vswitch", {
    vpcId: vpc.id,
    cidrBlock: "172.16.0.0/24",
    zoneId: _default.then(_default => _default.zones?.[0]?.id),
    vswitchName: name,
});
// Create a new Security in a VPC
const group = new alicloud.ecs.SecurityGroup("group", {
    name: name,
    description: "foo",
    vpcId: vpc.id,
});
// Create a kms to encrypt the disk
const key = new alicloud.kms.Key("key", {
    description: "Hello KMS",
    pendingWindowInDays: 7,
    status: "Enabled",
});
const instance = new alicloud.ecs.Instance("instance", {
    availabilityZone: _default.then(_default => _default.zones?.[0]?.id),
    securityGroups: [group].map(__item => __item.id),
    instanceType: "ecs.n4.large",
    systemDiskCategory: "cloud_efficiency",
    systemDiskName: name,
    systemDiskDescription: "system_disk_description",
    imageId: "ubuntu_18_04_64_20G_alibase_20190624.vhd",
    instanceName: name,
    vswitchId: vswitch.id,
    internetMaxBandwidthOut: 10,
    dataDisks: [{
        name: "data-disk",
        size: 20,
        category: "cloud_efficiency",
        description: "disk-description",
        encrypted: true,
        kmsKeyId: key.id,
    }],
});

Log output

No response

Affected Resource(s)

No response

Output of pulumi about

CLI          
Version      3.72.2
Go Version   go1.20.5
Go Compiler  gc

Plugins
NAME    VERSION
nodejs  unknown

Host     
OS       darwin
Version  14.1.1
Arch     arm64

This project is written in nodejs: executable='/usr/local/bin/node' version='v20.14.0'

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[t0yv0]

Thanks for reporting this. When I try to reproduce I just get this:

  alicloud:vpc:Network (vpc):
    error: configuring Terraform Alibaba Cloud Provider: no valid credential sources for Terraform Alibaba Cloud Provider found.
    
    Please see https://registry.terraform.io/providers/aliyun/alicloud/latest/docs#authentication
    for more information about providing credentials.

Perhaps there are some extra env vars necessary for a repro?

Digging in the code a bit I find:

https://github.com/aliyun/terraform-provider-alicloud/blob/v1.242.0/alicloud/provider.go#L1977

and this gates the code location that reads the token file:

https://github.com/aliyun/terraform-provider-alicloud/blob/v1.242.0/alicloud/provider.go#L3911

Default connection to env var is specified here:

https://github.com/aliyun/terraform-provider-alicloud/blob/v1.242.0/alicloud/provider.go#L2571

[t0yv0]

OK it appears that this behavior is indeed peculiar to the upstream provider. It will not even attempt to consult ALIBABA_CLOUD_OIDC_TOKEN_FILE env var unless assume_role_with_oidc is present as an empty object, e.g. to trigger the environment parsing I need to pass something to assume_role_with_oidc in:

package alicloud

import (
	"github.com/hashicorp/terraform-plugin-sdk/terraform"
	"testing"
)

func TestP(t *testing.T) {
	t.Setenv("ALIBABA_CLOUD_OIDC_TOKEN_FILE", "/tmp/oidc_token")
	t.Setenv("ALIBABA_CLOUD_ROLE_ARN", "acs:ram::***:role/***")
	t.Setenv("ALIBABA_CLOUD_OIDC_PROVIDER_ARN", "acs:ram::***:oidc-provider/***")

	p := Provider()
	err := p.Configure(&terraform.ResourceConfig{
		Raw: map[string]any{"assume_role_with_oidc": []any{
			map[string]any{},
		}},
		Config: map[string]any{"assume_role_with_oidc": []any{
			map[string]any{},
		}},
	})
	if err != nil {
		t.Error(err)
		t.FailNow()
	}
}

It maybe possible to trigger this from Pulumi by setting this:

config:
  alicloud:assumeRoleWithOidc: {}

However it sounds fairly brittle. Another option you may consider is to pass the config explicitly with the https://www.pulumi.com/docs/iac/concepts/resources/providers/#explicit-provider-configuration setting

[lucklove]

OK it appears that this behavior is indeed peculiar to the upstream provider. It will not even attempt to consult ALIBABA_CLOUD_OIDC_TOKEN_FILE env var unless assume_role_with_oidc is present as an empty object, e.g. to trigger the environment parsing I need to pass something to assume_role_with_oidc in:

package alicloud

import (
"github.com/hashicorp/terraform-plugin-sdk/terraform"
"testing"
)

func TestP(t testing.T) {
t.Setenv("ALIBABA_CLOUD_OIDC_TOKEN_FILE", "/tmp/oidc_token")
t.Setenv("ALIBABA_CLOUD_ROLE_ARN", "acs:ram:::role/")
t.Setenv("ALIBABA_CLOUD_OIDC_PROVIDER_ARN", "acs:ram:::oidc-provider/*")

p := Provider()
err := p.Configure(&terraform.ResourceConfig{
Raw: map[string]any{"assume_role_with_oidc": []any{
map[string]any{},
}},
Config: map[string]any{"assume_role_with_oidc": []any{
map[string]any{},
}},
})
if err != nil {
t.Error(err)
t.FailNow()
}
}
It maybe possible to trigger this from Pulumi by setting this:

config:
  alicloud:assumeRoleWithOidc: {}

However it sounds fairly brittle. Another option you may consider is to pass the config explicitly with the https://www.pulumi.com/docs/iac/concepts/resources/providers/#explicit-provider-configuration setting

Thanks for reply, explicit provider configuration is too intrusive to the code. I tried to set alicloud:assumeRoleWithOidc with empty dict as:

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: nodejs
config:
  alicloud:assumeRoleWithOidc: {}

But it report:

error: could not unmarshal '/tmp/pulumi/Pulumi.yaml': Configuration key 'alicloud:assumeRoleWithOidc' is namespaced and must provide an attribute 'value'

Then I tried:

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: nodejs
config:
  alicloud:assumeRoleWithOidc:
    value: {}

And it reports:

Message: code: 400, Parameter OIDCProviderArn is not valid request id: ***

[lucklove]

Thanks for reporting this. When I try to reproduce I just get this:

  alicloud:vpc:Network (vpc):
    error: configuring Terraform Alibaba Cloud Provider: no valid credential sources for Terraform Alibaba Cloud Provider found.
    
    Please see https://registry.terraform.io/providers/aliyun/alicloud/latest/docs#authentication
    for more information about providing credentials.

Perhaps there are some extra env vars necessary for a repro?

Digging in the code a bit I find:

https://github.com/aliyun/terraform-provider-alicloud/blob/v1.242.0/alicloud/provider.go#L1977

and this gates the code location that reads the token file:

https://github.com/aliyun/terraform-provider-alicloud/blob/v1.242.0/alicloud/provider.go#L3911

Default connection to env var is specified here:

https://github.com/aliyun/terraform-provider-alicloud/blob/v1.242.0/alicloud/provider.go#L2571

Sorry, I got wrong error message due to extra unrelated envs. I've modify the issue body to make it clear.

[t0yv0]

Hm I was wondering why alicloud:assumeRoleWithOidc:{} works on my machine and looking carefully the section:

config:
  alicloud:assumeRoleWithOidc: {}

Does not go in Pulumi.yaml but Pulumi.dev.yaml (the stack configuration file, I have a stack called dev, this might be different for your case). This can also be edited with pulumi config set.

[t0yv0]

Thanks for reply, explicit provider configuration is too intrusive to the code.

That would still be my recommendation. There are some resource inheritance options such as when you have a resource tree you can set the explicit provider on the top-level node only and have the children inherit it to reduce verbosity.

In terms of provider-side fixes, I do not think we can make easy progress on this issue in pulumi-alicloud; it might be possible though to file an issue upstream and get the behavior fixed up (e..g https://github.com/aliyun/terraform-provider-alicloud/blob/v1.242.0/alicloud/provider.go#L1977 to check the env vars anyway even if no config keys are set), and the Pulumi provider would inherit the fix from upstream.