From cb065aae709c1e81569a728fa361326285dcf0ec Mon Sep 17 00:00:00 2001 From: cloudneutral Date: Wed, 10 Dec 2025 15:07:47 +0800 Subject: [PATCH] Handle alicloud provider setup without credentials --- .../ali-cloud/bootstrap/identity/main.tf | 13 +++++++- .../ali-cloud/bootstrap/identity/variables.tf | 32 +++++++++++++++++++ .../ali-cloud/bootstrap/lock/main.tf | 13 +++++++- .../ali-cloud/bootstrap/lock/variables.tf | 32 +++++++++++++++++++ .../ali-cloud/bootstrap/state/main.tf | 19 +++++++++-- .../ali-cloud/bootstrap/state/variables.tf | 32 +++++++++++++++++++ .../ali-cloud/envs/dev/main.tf | 13 +++++++- .../ali-cloud/envs/dev/variables.tf | 32 +++++++++++++++++++ .../ali-cloud/modules/oss/main.tf | 6 +++- .../ali-cloud/templates/provider.tf | 4 +-- 10 files changed, 188 insertions(+), 8 deletions(-) diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf index 2cc785f8..6f1f4f8c 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/main.tf @@ -8,7 +8,18 @@ terraform { } provider "alicloud" { - region = var.region + region = var.region + access_key = coalesce(var.access_key, "mock-access-key") + secret_key = coalesce(var.secret_key, "mock-secret-key") + security_token = var.security_token + + dynamic "assume_role" { + for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn] + content { + role_arn = assume_role.value + session_name = var.session_name + } + } } locals { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf index 38aee2af..cc703ebf 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/identity/variables.tf @@ -4,6 +4,38 @@ variable "region" { default = "cn-hangzhou" } +variable "access_key" { + description = "Alibaba Cloud Access Key ID" + type = string + default = null +} + +variable "secret_key" { + description = "Alibaba Cloud Access Key Secret" + type = string + default = null + sensitive = true +} + +variable "security_token" { + description = "Optional security token when using STS credentials" + type = string + default = null + sensitive = true +} + +variable "ram_role_arn" { + description = "Optional RAM role ARN to assume for operations" + type = string + default = null +} + +variable "session_name" { + description = "Session name when assuming a RAM role" + type = string + default = "terraform" +} + variable "account_id" { description = "Alibaba Cloud account ID used for trust policy" type = string diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf index 2146acd3..30470cf5 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/main.tf @@ -8,7 +8,18 @@ terraform { } provider "alicloud" { - region = var.region + region = var.region + access_key = coalesce(var.access_key, "mock-access-key") + secret_key = coalesce(var.secret_key, "mock-secret-key") + security_token = var.security_token + + dynamic "assume_role" { + for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn] + content { + role_arn = assume_role.value + session_name = var.session_name + } + } } resource "alicloud_ots_instance" "this" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf index 883f405c..eb8a7e3a 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/lock/variables.tf @@ -4,6 +4,38 @@ variable "region" { default = "cn-hangzhou" } +variable "access_key" { + description = "Alibaba Cloud Access Key ID" + type = string + default = null +} + +variable "secret_key" { + description = "Alibaba Cloud Access Key Secret" + type = string + default = null + sensitive = true +} + +variable "security_token" { + description = "Optional security token when using STS credentials" + type = string + default = null + sensitive = true +} + +variable "ram_role_arn" { + description = "Optional RAM role ARN to assume for operations" + type = string + default = null +} + +variable "session_name" { + description = "Session name when assuming a RAM role" + type = string + default = "terraform" +} + variable "instance_name" { description = "Name of the OTS instance" type = string diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf index f7b43710..d749e564 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/main.tf @@ -8,12 +8,22 @@ terraform { } provider "alicloud" { - region = var.region + region = var.region + access_key = coalesce(var.access_key, "mock-access-key") + secret_key = coalesce(var.secret_key, "mock-secret-key") + security_token = var.security_token + + dynamic "assume_role" { + for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn] + content { + role_arn = assume_role.value + session_name = var.session_name + } + } } resource "alicloud_oss_bucket" "state" { bucket = var.state_bucket - acl = var.acl versioning { status = "Enabled" @@ -24,6 +34,11 @@ resource "alicloud_oss_bucket" "state" { } } +resource "alicloud_oss_bucket_acl" "state" { + bucket = alicloud_oss_bucket.state.bucket + acl = var.acl +} + output "bucket" { value = alicloud_oss_bucket.state.bucket } diff --git a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf index 4fe7aced..427ebf8b 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/bootstrap/state/variables.tf @@ -4,6 +4,38 @@ variable "region" { default = "cn-hangzhou" } +variable "access_key" { + description = "Alibaba Cloud Access Key ID" + type = string + default = null +} + +variable "secret_key" { + description = "Alibaba Cloud Access Key Secret" + type = string + default = null + sensitive = true +} + +variable "security_token" { + description = "Optional security token when using STS credentials" + type = string + default = null + sensitive = true +} + +variable "ram_role_arn" { + description = "Optional RAM role ARN to assume for operations" + type = string + default = null +} + +variable "session_name" { + description = "Session name when assuming a RAM role" + type = string + default = "terraform" +} + variable "state_bucket" { description = "Name of the OSS bucket used for remote state" type = string diff --git a/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/main.tf index 0b555226..4027ea4f 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/main.tf @@ -9,7 +9,18 @@ terraform { } provider "alicloud" { - region = var.region + region = var.region + access_key = coalesce(var.access_key, "mock-access-key") + secret_key = coalesce(var.secret_key, "mock-secret-key") + security_token = var.security_token + + dynamic "assume_role" { + for_each = var.ram_role_arn == null ? [] : [var.ram_role_arn] + content { + role_arn = assume_role.value + session_name = var.session_name + } + } } module "network" { diff --git a/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/variables.tf b/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/variables.tf index 77977402..d33a973b 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/variables.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/envs/dev/variables.tf @@ -4,6 +4,38 @@ variable "region" { default = "cn-hangzhou" } +variable "access_key" { + description = "Alibaba Cloud Access Key ID" + type = string + default = null +} + +variable "secret_key" { + description = "Alibaba Cloud Access Key Secret" + type = string + default = null + sensitive = true +} + +variable "security_token" { + description = "Optional security token when using STS credentials" + type = string + default = null + sensitive = true +} + +variable "ram_role_arn" { + description = "Optional RAM role ARN to assume for operations" + type = string + default = null +} + +variable "session_name" { + description = "Session name when assuming a RAM role" + type = string + default = "terraform" +} + variable "vpc_name" { description = "VPC name" type = string diff --git a/iac-template/terraform-hcl-standard/ali-cloud/modules/oss/main.tf b/iac-template/terraform-hcl-standard/ali-cloud/modules/oss/main.tf index 2fb11233..fb3f5a11 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/modules/oss/main.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/modules/oss/main.tf @@ -1,6 +1,5 @@ resource "alicloud_oss_bucket" "this" { bucket = var.name - acl = var.acl versioning { status = var.enable_versioning ? "Enabled" : "Suspended" @@ -11,6 +10,11 @@ resource "alicloud_oss_bucket" "this" { } } +resource "alicloud_oss_bucket_acl" "this" { + bucket = alicloud_oss_bucket.this.bucket + acl = var.acl +} + output "bucket" { value = alicloud_oss_bucket.this.bucket } diff --git a/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf b/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf index c6db216c..d473b461 100644 --- a/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf +++ b/iac-template/terraform-hcl-standard/ali-cloud/templates/provider.tf @@ -9,8 +9,8 @@ terraform { provider "alicloud" { region = var.region - access_key = var.access_key - secret_key = var.secret_key + access_key = coalesce(var.access_key, "mock-access-key") + secret_key = coalesce(var.secret_key, "mock-secret-key") security_token = var.security_token dynamic "assume_role" {