Persist environment variables from commands

[aacuadras]

Feature description 💡

Currently when environment variables are set in a BASH command, those variables do not persist in the flow. For example, let's say I want to assume a role in AWS and then run terraform plan. I want to accomplish this with the following template:

flow:
  - type: "terraformPlan"
    name: "Init and Plan"
    step: 100
    commands:
      - runtime: "BASH"
        priority: 100
        before: true
        script: |
          creds=$(aws sts assume-role --role-arn 'arn:aws:iam::123456789012:role/terrakube-role' --role-session-name session --output json)
          export AWS_ACCESS_KEY_ID=$(echo $creds | jq '.Credentials.AccessKeyId')
          export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq '.Credentials.SecretAccessKey')
          export AWS_SESSION_TOKEN=$(echo $creds | jq '.Credentials.SessionToken')

That way, terraform can plan and apply using the designated role

Anything else?

No response

[alfespa17]

I think you could write a "auto.tfvars" file so terraform can pick the values from there

[aacuadras]

That works if we need them as terraform variables, but this is a session that expires and our terraform code expects the user to be already authenticated to AWS, that's why there is a need for injecting these environment variables to the job.

[alfespa17]

That works if we need them as terraform variables, but this is a session that expires and our terraform code expects the user to be already authenticated to AWS, that's why there is a need for injecting these environment variables to the job.

Adding that to save the environment variables will require some work.

Another alternative will be that you use "aws dynamic credentials" so the workspace can authenticate automatically with AWS without any kind of secrets, instead of defining "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY" and "AWS_SESSION_TOKEN" terrakube will use the role that you define in the env variable "WORKLOAD_IDENTITY_ROLE_AWS" and you dont have to worry about any secrets

You could check here for the AWS dynamic credentials support:

https://docs.terrakube.io/user-guide/workspaces/dynamic-provider-credentials/aws-dynamic-provider-credentials

In that way your workspace will be "passwordless" and you will get the same effect as the above example using "aws sts assume-role --role-arn "