[Bug] v5.x.x vs v4.x.x `aws-cli/setup` changes broke Terragrunt setup

[carlosjgp]

Using the orb version circleci/aws-cli@4 the pipeline works but when upgraded to @5 it fails

An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.

the configuration is the same

      - aws-cli/setup:
          profile_name: terraform
          role_arn: arn:aws:iam::111111111111:role/circleci-terragrunt
          role_session_name: ${CIRCLE_PROJECT_REPONAME}
          region: eu-west-1

the command is the same

make plan

where plan looks like

	export AWS_PROFILE=terraform; \
	export ENV=my-env; \
	export ACCOUNT_ALIAS=some-alias \
	export REGION=eu-west-1; \
	export LAYER=github; \
	terragrunt $@ \
		--working-dir ./$${ENV}/$${ACCOUNT_ALIAS}/$${REGION}/$${LAYER} \
		--non-interactive \
		--queue-include-external \
		--provider-cache --log-level debug \
		--provider-cache-dir ./.terragrunt-cache

[marboledacci]

Hi @carlosjgp the command you use should be working, are you able to run this command after the setup to validate if the authentication is being done correctly:
aws sts get-caller-identity --profile terraform

[carlosjgp]

Hi @carlosjgp the command you use should be working, are you able to run this command after the setup to validate if the authentication is being done correctly: aws sts get-caller-identity --profile terraform

I can't.

Terragrunt can use hooks and I was running that command in one of the hooks

aws sts get-caller-identity

with v4 works as expected

with v5 fails with

An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.

[marboledacci]

What exact versions are you using to compare v5 and v4?

[marboledacci]

Another thing, the profile is importante here, otherwise it could be trying to authenticate with access_key which wouldn't work in this case

Terragrunt can use hooks and I was running that command in one of the hooks

aws sts get-caller-identity

[carlosjgp]

What exact versions are you using to compare v5 and v4?

the error

" in ./.terragrunt-cache/t_iJlhLNtAdex1_LJMHQ6AzIhRQ/3Qd147_b-faHvVwRaVhsCBvmLrM

An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.

exit status 254
11:31:04.654 ERROR  Errors encountered running before_hooks. Not running 'terraform'.
11:31:04.654 DEBUG  Detected 1 Hooks
11:31:04.654 INFO   Shutting down Terragrunt Cache server...
11:31:04.655 INFO   Terragrunt Cache server stopped
11:31:04.655 ERROR  error occurred:

* Failed to execute "bash -c aws sts get-caller-identity
  " in ./.terragrunt-cache/t_iJlhLNtAdex1_LJMHQ6AzIhRQ/3Qd147_b-faHvVwRaVhsCBvmLrM
  
  An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.
  
  exit status 254

make: *** [Makefile:51: plan] Error 254

The version compiled was 5.4.1

[marboledacci]

Did you validate that the authentication is using the profile?

[carlosjgp]

Did you validate that the authentication is using the profile?

yes, same exact code with orb version 4 works just fine

[marboledacci]

This working on version on version 4 is not a guarantee of your hook being correctly configured for version 5. I'm very insistent on the profile configuration, because that's the main change between version 4 and 5 regarding authentication.
I haven't been able to replicate your issue, so the problem must be on some of the terragrunt configuration for the auth.

If you don't see anything to change there, or you cannot do it, I think setting set_aws_env_vars to true, could help with your problem.