S3 Backend does not work with `aws login` when using `source_profile` in the AWS CLI config

[ssilvidi]

Terraform Version

Terraform v1.15.1
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v6.43.0

Terraform Configuration Files

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6"
    }
  }

  backend "s3" {
    bucket       = "test-bucket"
    key          = "test/key"
    region       = "us-east-2"
    profile      = "test"
  }
}

provider "aws" {
  region = "us-east-2"

  profile = "test"
}

data "aws_caller_identity" "ci" {}

output "caller_identity" {
  value = data.aws_caller_identity.ci
}

Debug Output

https://gist.github.com/ssilvidi/ba80eb684f9a584bc0e65c58075ef109

Expected Behavior

The AWS CLI supports using source_profile to assume that profile's role from another profile. (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-settings)

You can use aws login for your default profile, then rely on source_profile for your other profiles. This works fine for AWS CLI commands.

This source_profile method has traditionally worked as expected with terraform, except when using the new aws login command.

Example ~/.aws/config:

[default]
region = us-east-2

[profile test]
source_profile = default
role_arn = arn:aws:iam::123456789000:role/terraform-deployment-role
region = us-east-2

Actual Behavior

Terraform fails to initialize the backend (or plan, etc.) if the profile uses source_profile to the default AWS profile.

Initializing provider plugins found in the configuration...
- Reusing previous version of hashicorp/aws from the dependency lock file
- Using previously-installed hashicorp/aws v6.43.0

Initializing the backend...

╷
│ Error: failed to load assume role arn:aws:iam::123456789000:role/terraform-deployment-role, of profile default, <nil>
│ 
│ 
╵

I notice that the error message says it failed to load the assume role "of profile default" even though it's the test profile's role ARN, but maybe that's just wording.

Steps to Reproduce

1. With no AWS_PROFILE set (for default), run aws login
2. Choose the correct AWS session in the browser popup
3. terraform init

Additional Context

This problem also applies to the AWS provider in general, but there's already an open issue for that in the provider repo. (hashicorp/terraform-provider-aws#45817)

References

• S3 Backend: Support authentication via aws login #37976
• Differing behaviour when using aws login credentials between Terraform and AWS CLI terraform-provider-aws#45817
• Support AWS CLI v2.32.0+ 'aws login' credentials (console credentials for local development) terraform-provider-aws#45316

Generative AI / LLM assisted development?

No response

[crw]

Thanks for this report! I will notify the AWS Provider team at HashiCorp (an IBM company) who manages the S3 backend.