Harden AliCloud bootstrap provider authentication

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf

@@ -9,8 +9,8 @@ terraform {
 
 provider "alicloud" {
   region         = var.region
-  access_key     = coalesce(var.access_key, "mock-access-key")
-  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  access_key     = var.access_key
+  secret_key     = var.secret_key
   security_token = var.security_token
 
   dynamic "assume_role" {

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf

@@ -8,6 +8,11 @@ variable "access_key" {
   description = "Alibaba Cloud Access Key ID"
   type        = string
   default     = null
+
+  validation {
+    condition     = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null)
+    error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials."
+  }
 }
 
 variable "secret_key" {

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf

@@ -9,8 +9,8 @@ terraform {
 
 provider "alicloud" {
   region         = var.region
-  access_key     = coalesce(var.access_key, "mock-access-key")
-  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  access_key     = var.access_key
+  secret_key     = var.secret_key
   security_token = var.security_token
 
   dynamic "assume_role" {

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf

@@ -8,6 +8,11 @@ variable "access_key" {
   description = "Alibaba Cloud Access Key ID"
   type        = string
   default     = null
+
+  validation {
+    condition     = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null)
+    error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials."
+  }
 }
 
 variable "secret_key" {

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf

@@ -9,8 +9,8 @@ terraform {
 
 provider "alicloud" {
   region         = var.region
-  access_key     = coalesce(var.access_key, "mock-access-key")
-  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  access_key     = var.access_key
+  secret_key     = var.secret_key
   security_token = var.security_token
 
   dynamic "assume_role" {

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf

@@ -8,6 +8,11 @@ variable "access_key" {
   description = "Alibaba Cloud Access Key ID"
   type        = string
   default     = null
+
+  validation {
+    condition     = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null)
+    error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials."
+  }
 }
 
 variable "secret_key" {

iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf

@@ -9,8 +9,8 @@ terraform {
 
 provider "alicloud" {
   region         = var.region
-  access_key     = coalesce(var.access_key, "mock-access-key")
-  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  access_key     = var.access_key
+  secret_key     = var.secret_key
   security_token = var.security_token
 
   dynamic "assume_role" {

iac-template/terraform-hcl-standard/ali-cloud/templates/variables.tf

@@ -8,6 +8,11 @@ variable "access_key" {
   description = "Alibaba Cloud Access Key ID"
   type        = string
   default     = null
+
+  validation {
+    condition     = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null)
+    error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials."
+  }
 }
 
 variable "secret_key" {