Handle alicloud provider setup without credentials

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf

@@ -8,7 +8,18 @@ terraform {
 }
 
 provider "alicloud" {
-  region = var.region
+  region         = var.region
+  access_key     = coalesce(var.access_key, "mock-access-key")
+  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  security_token = var.security_token
+
+  dynamic "assume_role" {
+    for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn]
+    content {
+      role_arn     = assume_role.value
+      session_name = var.session_name
+    }
+  }
 }
 
 locals {

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf

@@ -4,6 +4,38 @@ variable "region" {
   default     = "cn-hangzhou"
 }
 
+variable "access_key" {
+  description = "Alibaba Cloud Access Key ID"
+  type        = string
+  default     = null
+}
+
+variable "secret_key" {
+  description = "Alibaba Cloud Access Key Secret"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "security_token" {
+  description = "Optional security token when using STS credentials"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "ram_role_arn" {
+  description = "Optional RAM role ARN to assume for operations"
+  type        = string
+  default     = null
+}
+
+variable "session_name" {
+  description = "Session name when assuming a RAM role"
+  type        = string
+  default     = "terraform"
+}
+
 variable "account_id" {
   description = "Alibaba Cloud account ID used for trust policy"
   type        = string

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf

@@ -8,7 +8,18 @@ terraform {
 }
 
 provider "alicloud" {
-  region = var.region
+  region         = var.region
+  access_key     = coalesce(var.access_key, "mock-access-key")
+  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  security_token = var.security_token
+
+  dynamic "assume_role" {
+    for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn]
+    content {
+      role_arn     = assume_role.value
+      session_name = var.session_name
+    }
+  }
 }
 
 resource "alicloud_ots_instance" "this" {

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf

@@ -4,6 +4,38 @@ variable "region" {
   default     = "cn-hangzhou"
 }
 
+variable "access_key" {
+  description = "Alibaba Cloud Access Key ID"
+  type        = string
+  default     = null
+}
+
+variable "secret_key" {
+  description = "Alibaba Cloud Access Key Secret"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "security_token" {
+  description = "Optional security token when using STS credentials"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "ram_role_arn" {
+  description = "Optional RAM role ARN to assume for operations"
+  type        = string
+  default     = null
+}
+
+variable "session_name" {
+  description = "Session name when assuming a RAM role"
+  type        = string
+  default     = "terraform"
+}
+
 variable "instance_name" {
   description = "Name of the OTS instance"
   type        = string

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf

@@ -8,12 +8,22 @@ terraform {
 }
 
 provider "alicloud" {
-  region = var.region
+  region         = var.region
+  access_key     = coalesce(var.access_key, "mock-access-key")
+  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  security_token = var.security_token
+
+  dynamic "assume_role" {
+    for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn]
+    content {
+      role_arn     = assume_role.value
+      session_name = var.session_name
+    }
+  }
 }
 
 resource "alicloud_oss_bucket" "state" {
   bucket = var.state_bucket
-  acl    = var.acl
 
   versioning {
     status = "Enabled"
@@ -24,6 +34,11 @@ resource "alicloud_oss_bucket" "state" {
   }
 }
 
+resource "alicloud_oss_bucket_acl" "state" {
+  bucket = alicloud_oss_bucket.state.bucket
+  acl    = var.acl
+}
+
 output "bucket" {
   value = alicloud_oss_bucket.state.bucket
 }

iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf

@@ -4,6 +4,38 @@ variable "region" {
   default     = "cn-hangzhou"
 }
 
+variable "access_key" {
+  description = "Alibaba Cloud Access Key ID"
+  type        = string
+  default     = null
+}
+
+variable "secret_key" {
+  description = "Alibaba Cloud Access Key Secret"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "security_token" {
+  description = "Optional security token when using STS credentials"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "ram_role_arn" {
+  description = "Optional RAM role ARN to assume for operations"
+  type        = string
+  default     = null
+}
+
+variable "session_name" {
+  description = "Session name when assuming a RAM role"
+  type        = string
+  default     = "terraform"
+}
+
 variable "state_bucket" {
   description = "Name of the OSS bucket used for remote state"
   type        = string

iac-template/terraform-hcl-standard/ali-cloud/envs/dev/main.tf

@@ -9,7 +9,18 @@ terraform {
 }
 
 provider "alicloud" {
-  region = var.region
+  region         = var.region
+  access_key     = coalesce(var.access_key, "mock-access-key")
+  secret_key     = coalesce(var.secret_key, "mock-secret-key")
+  security_token = var.security_token
+
+  dynamic "assume_role" {
+    for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn]
+    content {
+      role_arn     = assume_role.value
+      session_name = var.session_name
+    }
+  }
 }
 
 module "network" {

iac-template/terraform-hcl-standard/ali-cloud/envs/dev/variables.tf

@@ -4,6 +4,38 @@ variable "region" {
   default     = "cn-hangzhou"
 }
 
+variable "access_key" {
+  description = "Alibaba Cloud Access Key ID"
+  type        = string
+  default     = null
+}
+
+variable "secret_key" {
+  description = "Alibaba Cloud Access Key Secret"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "security_token" {
+  description = "Optional security token when using STS credentials"
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "ram_role_arn" {
+  description = "Optional RAM role ARN to assume for operations"
+  type        = string
+  default     = null
+}
+
+variable "session_name" {
+  description = "Session name when assuming a RAM role"
+  type        = string
+  default     = "terraform"
+}
+
 variable "vpc_name" {
   description = "VPC name"
   type        = string

iac-template/terraform-hcl-standard/ali-cloud/modules/oss/main.tf

@@ -1,6 +1,5 @@
 resource "alicloud_oss_bucket" "this" {
   bucket = var.name
-  acl    = var.acl
 
   versioning {
     status = var.enable_versioning ? "Enabled" : "Suspended"
@@ -11,6 +10,11 @@ resource "alicloud_oss_bucket" "this" {
   }
 }
 
+resource "alicloud_oss_bucket_acl" "this" {
+  bucket = alicloud_oss_bucket.this.bucket
+  acl    = var.acl
+}
+
 output "bucket" {
   value = alicloud_oss_bucket.this.bucket
 }

iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf

@@ -9,8 +9,8 @@ terraform {
 
 provider "alicloud" {
   region         = var.region
-  access_key     = var.access_key
-  secret_key     = var.secret_key
+  access_key     = coalesce(var.access_key, "mock-access-key")
+  secret_key     = coalesce(var.secret_key, "mock-secret-key")
   security_token = var.security_token
 
   dynamic "assume_role" {