Repository navigation
feat(profiles): load AWS terraform credentials in load-tf-secrets - #183
Merged
Merged
Conversation
The aws Terraform workspace was only ever planned and applied by CI (static key secrets, then OIDC roles); no loader exported credentials for local runs. Adds the terraform service account's access key pair from the Enpass AWS entry so load-tf-secrets fully provisions a shell for local plans of the aws workspace. All three AWS lookups use -exact (hazcod/enpass-cli#161): other vault entries contain "AWS" in their titles, making substring filters fail with "multiple entries match filter".
wpfleger96
pushed a commit
that referenced
this pull request
Sep 22, 2026
🤖 I have created a release *beep* *boop* --- ## [0.69.0](v0.68.0...v0.69.0) (2026-09-22) ### Features * **profiles:** load AWS terraform credentials in load-tf-secrets ([#183](#183)) ([e4dee92](e4dee92)) ### Bug Fixes * **profiles:** export MEOWDB_S3_BUCKET in load-meowdb-secrets ([#176](#176)) ([f82b86a](f82b86a)) ### Chores * **deps:** Lock file maintenance ([#173](#173)) ([a9f70e7](a9f70e7)) * **deps:** Lock file maintenance ([#175](#175)) ([ffaa70f](ffaa70f)) * **deps:** Lock file maintenance ([#177](#177)) ([aadf5e3](aadf5e3)) * **deps:** Lock file maintenance ([#178](#178)) ([7beb958](7beb958)) * **deps:** Lock file maintenance ([#179](#179)) ([571e25e](571e25e)) * **deps:** Lock file maintenance ([#180](#180)) ([2ff1edf](2ff1edf)) * **deps:** Lock file maintenance ([#181](#181)) ([0b16dbe](0b16dbe)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: wpfleger-release-bot[bot] <282999489+wpfleger-release-bot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The aws Terraform workspace has only ever been planned and applied by CI — first via the static-key GitHub secrets, then via the OIDC roles — so no loader exported AWS credentials for local runs, and a local
terraform planof the workspace had nothing to authenticate with. This adds the terraform service account's key pair (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, from theTerraform Access Key/Terraform Secret Keyfields of the Enpass AWS entry) toload-tf-secretsin the personal profile, so it fully provisions a shell for local plans of the aws workspace the same way it already does for the cloudflare and homelab ones (#156 closed the same gap for cloudflare).All three AWS-entry lookups now pass
-exact: other vault entries contain "AWS" in their titles, so the default substring filter is ambiguous and fails withmultiple entries match filter.-exactrequires an enpass-cli build with hazcod/enpass-cli#161 — currently the fork'sdevbuild; machines on the stock v1.12.0 release will fail these three lookups withflag provided but not defined: -exactuntil that lands in a pinned release (they already fail today with the ambiguity error, so nothing regresses).