A potential scenario is to have a single Terraform template repository where you need to manage AWS resources across a number of different AWS Accounts. However, because each AWS Account is the edge of its authentication and authorisation profile, there is a need to be able cross this boundary within your Terraform to be able to manage resources cross-account. A method of doing this is by the use of “aliases” within your Terraform, however you need to have your workstation’s AWS Configuration configured appropriately and specify the aliases on each resource to ensure Terraform is managing the expected resource where it is located. <\/p>\n\n\n\n
It is possible to have a “provider of last resort”, i.e. a provider which you have no aliases defined for, by doing this if you don’t include an alias\/provider in the resource definition, it is assumed by Terraform to use this “last resort”, if you chose to do this is mostly down to your own preferences, however if you do manage accounts across AWS Account boundaries, being explicit in each resource can reduce the likelihood of unexpected results!<\/p>\n\n\n\n
Although your locations and requirements will vary here is a simple example where I have an SSO (Single Sign On) based configuration along with two AWS Accounts (which I’ll use to create resources). My AWS configuration file was located in:<\/p>\n\n\n\n
~\\.aws\\config<\/code><\/pre>\n\n\n\nSo we define the SSO session followed by the two profiles for our two AWS Accounts (~\\.aws\\config).<\/p>\n\n\n\n
[sso-session mysso]\nsso_start_url = https:\/\/3dfbv5d671.awsapps.com\/start#\nsso_region = eu-west-2\nsso_role_name = AWSAdministratorAccess\nsso_registration_scopes = sso:account:access\n\n[profile hub-account]\nsso_session = mysso\nsso_account_id = 12345678910\nsso_role_name = AWSAdministratorAccess\nregion = eu-west-2\n\n[profile spoke-account]\nsso_session = mysso\nsso_account_id = 10987654321\nsso_role_name = AWSAdministratorAccess\nregion = eu-west-2<\/code><\/pre>\n\n\n\nOnce those are added, you would authenticate as you normally would be using specifying a profile if you so require, although this is not mandatory because we’ll be specifying the actual profile (i.e. AWS Accounts) we want to use explicitly.<\/p>\n\n\n\n
export AWS_PROFILE=hub-account\naws sso login --profile=$AWS_PROFILE<\/code><\/pre>\n\n\n\nDefine Providers (with Aliases) in your Terraform<\/h2>\n\n\n\n
We next need to define the “providers” within our Terraform. Within these definitions we include the “alias” for which we want to refer to the AWS Account when creating AWS resources within our Terraform. (providers.tf)<\/p>\n\n\n\n
...\n\n# Hub\nprovider \"aws\" {\n alias = \"hub\"\n region = \"eu-west-2\"\n profile = \"hub-account\"\n}\n\n# Spoke\nprovider \"aws\" {\n alias = \"spoke\"\n region = \"eu-west-2\"\n profile = \"spoke-account\"\n}\n\n...<\/code><\/pre>\n\n\n\nAs you can see, we are using a simple example as Hub and Spoke, our first definition is for a “Hub” Account where some network resources (e.g. TGW) will be deployed, then we’ll have a “Spoke” account where we’ll run some workloads, that will need to be “connected” to network resources (i.e. the TGW) within the “Hub” Account, although the mechanics of doing this are outside the scope of this document; this focusses on how you can refer to resources when using the Aliases.<\/p>\n\n\n\n
Notice that the names specified in the “profile” line refer to the same name as is used within your AWS config file.<\/p>\n\n\n\n
Define AWS Resources with Aliases to the Required Account<\/h2>\n\n\n\n
OK, so now we are ready to define the AWS Resources within the “Hub” and “Spoke” accounts. Let’s just use something really simple, a VPC (Virtual Private Cloud) definition. We’ll create one in each AWS Account and use the “Alias” (Provider) to tell Terraform which of the two profiles (i.e. providers) to use to create the VPC.<\/p>\n\n\n\n
resource \"aws_vpc\" \"hub_vpc\" {\n provider = aws.hub\n cidr_block = \"10.0.0.0\/16\"\n instance_tenancy = \"default\"\n enable_dns_support = true\n enable_dns_hostnames = true\n\n tags = {\n Name = \"hub_vpc\"\n }\n}\n\nresource \"aws_vpc\" \"spoke_vpc\" {\n provider = aws.spoke\n cidr_block = \"10.1.0.0\/16\"\n instance_tenancy = \"default\"\n enable_dns_support = true\n enable_dns_hostnames = true\n\n tags = {\n Name = \"spoke_vpc\"\n }\n}<\/code><\/pre>\n\n\n\nAnd that’s it, now when you run the Terraform Apply, it will use the two different Aliases (providers) to create the resources in the appropriate AWS account. Of course, you need to have logged in via SSO first!<\/p>\n","protected":false},"excerpt":{"rendered":"
A potential scenario is to have a single Terraform template repository where you need to manage AWS resources across a number of different AWS Accounts. However, because each AWS Account is the edge of its authentication and authorisation profile, there is a need to be able cross this boundary within your Terraform to be able … Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4373,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,45],"tags":[],"class_list":["post-4646","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aws","category-terraform"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4646"}],"version-history":[{"count":1,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4646\/revisions"}],"predecessor-version":[{"id":4647,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4646\/revisions\/4647"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4373"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}