<p>The answer to this question is no. I merely forgot to export the AWS_SECRET_ACCESS_KEY variable in the before_script section.</p>

CC BY-SA 4.0
2021-05-04T14:53:15.927Z
:-) Funny how often I write up an answer and the brain shifts to reveal its block like I see here. Thanks for coming back and answering your own question!
Josiah
CC BY-SA 4.0
2021-04-22T09:49:26.097Z
2021-04-22T09:49:26.097Z
Lucky
<p>In our terraform pipeline we use the aws cli command to assume a role and get the credential variables, the EC2 instance for the pipeline worker is using a profile which can assume the role.</p>
<pre><code>creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --role-session-name tf-pipeline | jq -r '.Credentials')
export AWS_ACCESS_KEY_ID=$(echo $creds | jq -r '.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq -r '.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $creds | jq -r '.SessionToken')
</code></pre>

CC BY-SA 4.0
2021-06-16T10:23:06.807Z
2021-06-16T10:23:06.807Z
Alastair Montgomery
<p>in the case of using GitLab ci ENV var, if u are testing in branches other than main/master, make sure your variables are not <strong>PROTECTED</strong></p>

CC BY-SA 4.0
2021-08-16T09:41:12.367Z
2021-08-16T09:41:12.367Z
Sina Miandashti
<p>I am trying to set up a pipeline, which is supposed to deploy terraform code into an aws account. The code works fine locally, and I have setup and imported the state bucket and dynamodb table which enables state locking.</p>
<p>However, when I run the code in a gitlab ci, I get the following error message:</p>
<blockquote>
<p>Error: error configuring S3 Backend: no valid credential sources for S3 Backend found.
│
│ Please see <a href="https://www.terraform.io/docs/language/settings/backends/s3.html" rel="nofollow noreferrer">https://www.terraform.io/docs/language/settings/backends/s3.html</a>
│ for more information about providing credentials.
│
│ Error: NoCredentialProviders: no valid providers in chain. Deprecated.
│   For verbose messaging see aws.Config.CredentialsChainVerboseErrors</p>
</blockquote>
<p>I export the aws credentials as variables in the before_script like so:</p>
<pre><code>before_script:
  - rm -rf .terraform
  - terraform --version
  - export AWS_ACCESS_KEY_ID
  - export AWS_ROLE_ARN
  - export AWS_DEFAULT_REGION
  - export AWS_ROLE_ARN
</code></pre>
<p>Is there another step that I am missing, or do I maybe have to include the credential variables in the terraform code?</p>

<continuous-integration><terraform><gitlab><gitlab-ci-runner><continuous-delivery>
Do I have to include gitlab variables in my terraform code in order for my credentials to be recognized?
Lucky
# Do I have to include gitlab variables in my terraform code in order for my credentials to be recognized?

(Asked by: username_0 on 2021-04-22)

I am trying to set up a pipeline, which is supposed to deploy terraform code into an aws account. The code works fine locally, and I have setup and imported the state bucket and dynamodb table which enables state locking.
However, when I run the code in a gitlab ci, I get the following error message:

Error: error configuring S3 Backend: no valid credential sources for S3 Backend found.
│
│ Please see https://www.terraform.io/docs/language/settings/backends/s3.html
│ for more information about providing credentials.
│
│ Error: NoCredentialProviders: no valid providers in chain. Deprecated.
│   For verbose messaging see aws.Config.CredentialsChainVerboseErrors

I export the aws credentials as variables in the before_script like so:
before_script:
  - rm -rf .terraform
  - terraform --version
  - export AWS_ACCESS_KEY_ID
  - export AWS_ROLE_ARN
  - export AWS_DEFAULT_REGION
  - export AWS_ROLE_ARN

Is there another step that I am missing, or do I maybe have to include the credential variables in the terraform code?

**Tags:** continuous-integration, terraform, gitlab, gitlab-ci-runner, continuous-delivery


---

## 3 answers

### Answer by username_0 on 2021-04-22. Score: 2 | Accepted answer

The answer to this question is no. I merely forgot to export the AWS\_SECRET\_ACCESS\_KEY variable in the before\_script section.

> **Comments:**
> **username_1**: :-) Funny how often I write up an answer and the brain shifts to reveal its block like I see here. Thanks for coming back and answering your own question!  

---

### Answer by username_2 on 2021-06-16. Score: 0

In our terraform pipeline we use the aws cli command to assume a role and get the credential variables, the EC2 instance for the pipeline worker is using a profile which can assume the role.
creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --role-session-name tf-pipeline | jq -r '.Credentials')
export AWS_ACCESS_KEY_ID=$(echo $creds | jq -r '.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq -r '.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $creds | jq -r '.SessionToken')


---

### Answer by username_3 on 2021-08-16. Score: 0

in the case of using GitLab ci ENV var, if u are testing in branches other than main/master, make sure your variables are not **PROTECTED**


---

