From 64372c754c0e7a33aa65108d65b2a466d9dbfe4a Mon Sep 17 00:00:00 2001 From: cloudneutral Date: Wed, 10 Dec 2025 15:28:46 +0800 Subject: [PATCH] Harden AliCloud bootstrap provider authentication --- .../ali-cloud/bootstrap/identity/main.tf | 4 ++-- .../ali-cloud/bootstrap/identity/variables.tf | 5 +++++ .../terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf | 4 ++-- .../ali-cloud/bootstrap/lock/variables.tf | 5 +++++ .../terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf | 4 ++-- .../ali-cloud/bootstrap/state/variables.tf | 5 +++++ .../terraform-hcl-standard/ali-cloud/templates/provider.tf | 4 ++-- .../terraform-hcl-standard/ali-cloud/templates/variables.tf | 5 +++++ 8 files changed, 28 insertions(+), 8 deletions(-) diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf index 6f1f4f8c..78655cc5 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf @@ -9,8 +9,8 @@ terraform { provider "alicloud" { region = var.region - access_key = coalesce(var.access_key, "mock-access-key") - secret_key = coalesce(var.secret_key, "mock-secret-key") + access_key = var.access_key + secret_key = var.secret_key security_token = var.security_token dynamic "assume_role" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf index cc703ebf..b076f822 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf @@ -8,6 +8,11 @@ variable "access_key" { description = "Alibaba Cloud Access Key ID" type = string default = null + + validation { + condition = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null) + error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials." + } } variable "secret_key" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf index 30470cf5..9a2970e4 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf @@ -9,8 +9,8 @@ terraform { provider "alicloud" { region = var.region - access_key = coalesce(var.access_key, "mock-access-key") - secret_key = coalesce(var.secret_key, "mock-secret-key") + access_key = var.access_key + secret_key = var.secret_key security_token = var.security_token dynamic "assume_role" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf index eb8a7e3a..e8c4b4c1 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf @@ -8,6 +8,11 @@ variable "access_key" { description = "Alibaba Cloud Access Key ID" type = string default = null + + validation { + condition = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null) + error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials." + } } variable "secret_key" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf index d749e564..9ef5a294 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf @@ -9,8 +9,8 @@ terraform { provider "alicloud" { region = var.region - access_key = coalesce(var.access_key, "mock-access-key") - secret_key = coalesce(var.secret_key, "mock-secret-key") + access_key = var.access_key + secret_key = var.secret_key security_token = var.security_token dynamic "assume_role" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf index 427ebf8b..609f52af 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf @@ -8,6 +8,11 @@ variable "access_key" { description = "Alibaba Cloud Access Key ID" type = string default = null + + validation { + condition = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null) + error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials." + } } variable "secret_key" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf b/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf index d473b461..c6db216c 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf @@ -9,8 +9,8 @@ terraform { provider "alicloud" { region = var.region - access_key = coalesce(var.access_key, "mock-access-key") - secret_key = coalesce(var.secret_key, "mock-secret-key") + access_key = var.access_key + secret_key = var.secret_key security_token = var.security_token dynamic "assume_role" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/templates/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/templates/variables.tf index 2ef885ad..14e09412 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/templates/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/templates/variables.tf @@ -8,6 +8,11 @@ variable "access_key" { description = "Alibaba Cloud Access Key ID" type = string default = null + + validation { + condition = (var.access_key == null && var.secret_key == null) || (var.access_key != null && var.secret_key != null) + error_message = "Provide both access_key and secret_key, or leave both null to rely on environment-sourced credentials." + } } variable "secret_key" {