Howdy. I’d like my Terraform users to be able to:
- Use IAM ‘assume_role’ in automated runs (like in a CI system, running on an EC2 instance with an EC2 Instance Profile/Role)
- Use AWS CLI ‘profiles’ for local workstation Terraform runs.
However, AFAICT, I can’t use conditionals to optionally add a ‘assume_role’ block or not, based on, say, TF_VAR_ environment variables, or similar.
What are some patterns folks are using to permit the use of ‘assume_role’ blocks in the AWS provider or 'profile = ’ without modifying HCL code? Or is that the only path? I’d love to be able to just set (or unset) a shell environment variable (like “TF_VAR_is_ci”) to control this.
Thanks in advance!
P.S. I’m also using Terragrunt, but I don’t want to cloud this discussion, because I don’t think it is a problem for Terragrunt, per-se.