Making calls to provider on startup, triggering authentication prompts #1778
Comments
|
Hi @Michagogo, To confirm this theory, can you try running If you confirm that auth is triggered by In general - as with most VS Code extensions - the extension will do nothing until/unless it is activated. In this case, it can be activated by opening a folder (workspace in VS Code terms) with appropriate file extensions, such as The extension may also execute |
|
Hi, sorry, if it wasn’t clear this is indeed happening when the extension is being activated — e.g. when I open VSC in the morning and it loads the folders I’ve previously had active. The credential process isn’t a wrapper for anything, it’s a command line configured in the AWS config file for each profile that’s invoked by the SDK, CLI, etc. to fetch/generate credentials when necessary.
|
|
I'm also seeing this with AWS SSO. For a [profile test]
sso_start_url=https://d-foobar.awsapps.com/start
sso_account_id=1234567890
sso_role_name=foo
sso_region=us-east-1
region=us-east-1and a terraform configuration like this, where both the AWS provider and the S3 backend use the above profile: terraform {
required_version = ">= 1.9.2"
backend "s3" {
region = "us-east-1"
bucket = "foo"
key = "bar"
profile = "test"
}
required_providers {
aws = {
source = "hashicorp/aws"
version = "5.63.0"
}
}
}
provider "aws" {
region = "us-east-1"
profile = "test"
}Just opening VSCode in a workspace that includes this directory will trigger the SSO authentication prompts. It only happens if the directory already had I can confirm that The authentication prompts are surprising when opening VSCode, and its not 100% clear to the user that the auth prompts are originating from VSCode's terraform-ls versus any other process on the workstation. If I don't complete the auth prompt, terraform-ls logs this: |
|
That seems surprising to me - this is with the standard AWS SDK/CLI? My
experience with the first-party tools is that they don’t initiate login
automatically, they just throw an error message if there isn’t a valid
token and you need to manually run `aws sso login`. I was using SSO
previously, and while I suppose this was probably happening in the
background, it was invisible to me until I installed and set up Granted,
which can be configured to automatically initiate SSO login when necessary.
…On Tue, Aug 20, 2024 at 1:10 AM Peter Rifel ***@***.***> wrote:
I'm also seeing this with AWS SSO. For a ~/.aws/config profile that looks
like this:
[profile test]sso_start_url=https://d-foobar.awsapps.com/startsso_account_id=1234567890sso_role_name=foosso_region=us-east-1region=us-east-1
and a terraform configuration like this, where both the AWS provider and
the S3 backend use the above profile:
terraform {
required_version = ">= 1.9.2"
backend "s3" {
region = "us-east-1"
bucket = "foo"
key = "bar"
profile = "test"
}
required_providers {
aws = {
source = "hashicorp/aws"
version = "5.63.0"
}
}
}
provider "aws" {
region = "us-east-1"
profile = "test"
}
Just opening VSCode in a workspace that includes this directory will
trigger the SSO authentication prompts. It only happens if the directory
already had terraform init ran previously and the SSO session expired or
was cleared since then. It also only happens if a .tf file in the directory
is open in VSCode, including if you use the "window.restoreWindows": "all"
VSCode setting and close and re-open a VSCode workspace.
I can confirm that terraform version does not trigger the prompts but terraform
providers schema -json does. Here are the trace logs:
2024-08-19T16:58:55.264-0500 [INFO] CLI command args: []string{"providers", "schema", "-json"}
2024-08-19T16:58:55.265-0500 [TRACE] Meta.Backend: BackendOpts.Config not set, so using settings loaded from main.tf:4,3-15
2024-08-19T16:58:55.265-0500 [TRACE] Meta.Backend: built configuration for "s3" backend with hash value 2638453018
2024-08-19T16:58:55.265-0500 [TRACE] Meta.Backend: working directory was previously initialized for "s3" backend
2024-08-19T16:58:55.265-0500 [TRACE] backendConfigNeedsMigration: given configuration matches cached configuration, so no migration is required
2024-08-19T16:58:55.265-0500 [TRACE] Meta.Backend: using already-initialized "s3" backend configuration
2024-08-19T16:58:55.265-0500 [TRACE] backend-s3.aws-base: Resolving AWS configuration: tf_backend.operation=Configure tf_backend.req_id=REDACTED tf_backend.s3.bucket=REDACTED tf_backend.s3.path=REDACTED
2024-08-19T16:58:55.265-0500 [DEBUG] backend-s3.aws-base: Resolving credentials provider: tf_backend.operation=Configure tf_backend.req_id=REDACTED tf_backend.s3.bucket=REDACTED tf_backend.s3.path=REDACTED
2024-08-19T16:58:55.265-0500 [TRACE] backend-s3.aws-base: Building default HTTP client: tf_backend.operation=Configure tf_backend.req_id=REDACTED tf_backend.s3.bucket=REDACTED tf_backend.s3.path=REDACTED
2024-08-19T16:58:55.265-0500 [DEBUG] backend-s3.aws-base: Setting profile: tf_backend.operation=Configure tf_backend.req_id=REDACTED tf_backend.s3.bucket=REDACTED tf_backend.s3.path=REDACTED tf_aws.profile=test tf_aws.profile.source=provider
2024-08-19T16:58:55.265-0500 [DEBUG] backend-s3.aws-base: Loading configuration: tf_backend.operation=Configure tf_backend.req_id=REDACTED tf_backend.s3.bucket=REDACTED tf_backend.s3.path=REDACTED
2024-08-19T16:58:55.277-0500 [DEBUG] backend-s3.aws-base: Retrieving credentials: tf_backend.operation=Configure tf_backend.req_id=REDACTED tf_backend.s3.bucket=REDACTED tf_backend.s3.path=REDACTED
The authentication prompts are surprising when opening VSCode, and its not
100% clear to the user that the auth prompts are originating from VSCode's
terraform-ls versus any other process on the workstation.
If I don't complete the auth prompt, terraform-ls logs this:
2024/08/19 17:01:43 jobs.go:487: JOBS: Finishing job "4":
"OpTypeObtainSchema" for {"file:///REDACTED"} (err = Execution of
"ProviderSchemas" timed out after 30s, deferredJobs: [])
—
Reply to this email directly, view it on GitHub
<#1778 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AATQ3HX645NWLTBFMDZKPUTZSJUNHAVCNFSM6AAAAABLSYLSIGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOJXGU2DSMJQHE>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Language Server Version
Unknown - LS installed via VS Code extension, doesn’t seem to be in path
Terraform Version
Terraform v1.6.2 on windows_amd64
Client Version
HashiCorp Terraform v2.32.1 in VS Code 1.91.1
Terraform Configuration
Steps to Reproduce
Open a folder containing Terraform configuration (in my case, involving AWS)
Expected Behavior
Nothing special - the extension/LS should initialize and just work.
Actual Behavior
For some reason, there seems to be some kind of call being made using the AWS SDK. The credential-process I use in my profiles gets invoked, bringing up interactive prompts to sign in, supply MFA, authorize the CLI, etc. etc.
Gist
No response
Workarounds
No response
References
No response
Help Wanted
Community Note
The text was updated successfully, but these errors were encountered: