[Bug]: Regression of S3 backend configuration partial configuration for version 1.10.0

[olahouze]

Terraform Version

1.10.0

Terraform Configuration Files

terraform {
  backend "s3" {
    # ...
  }
}

Debug Output

Error: Missing attribute separator
│
│ on -backend-config="assume_role={role_arn=arn:xxxxxx}" line 1:
│ (source code not available)
│
│ Expected a newline or comma to mark the beginning of the next attribute.

Expected Behavior

I use the “partial configuration” system in cli to supply parameters to my backend dynamically during terraform init.

This system only takes into account key/value pairs in cli mode (https://developer.hashicorp.com/terraform/language/backend#command-line-key-value-pairs)

Since the latest version of terraform, when I use an S3 as my backend, I have to specify the following parameters for assumes roles

terraform {
  backend "s3" {
  ...
    assume_role = {
          role_arn = “arn:xxxx”
        }
  }
}

The old way of working with only the “role_arn” field is no longer supported.

The cli backend configuration should be able to take in charge key/value pairs whose vlue is an object (in this case, a map).

Actual Behavior

I can therefore no longer dynamically provide the role to be used for my cli backend

Steps to Reproduce

terraform init --backend-config="key=xxx" -backend-config="assume_role={role_arn=arn:xxxx}"

Additional Context

No response

References

No response

[crw]

Thanks for this report, I am assuming it has to do with the changes listed in the upgrade guide: https://developer.hashicorp.com/terraform/language/upgrade-guides#root-assume-role-attribute-removal

You may also want to upgrade to 1.10.2, as the two releases have had some important bug fixes, however, that should not impact this issue here.

[gdavison]

Thanks for reporting this, @olahouze. This was a planned change to centralize all parameters for assuming a role under assume_role. Did you get any deprecation warnings when using just role_arn? If not, that's a bug with warnings being passed from state backends to the user.

Based on the error message you're getting in 1.10,

Expected a newline or comma to mark the beginning of the next attribute

there's a bug with handing object values passed on the command line.

[gdavison]

As a temporary workaround, you might be able to do something like

terraform {
  backend "s3" {
  ...
    assume_role = {
          role_arn = var.assume_role_arn
        }
  }
}

variable "assume_role_arn" {
  type = string
}

If you only assume a role in some cases, you could do something like

terraform {
  backend "s3" {
  ...
  dynamic "assume_role" {
    for_each = var.assume_role_arn[*]
    content {
      role_arn = assume_role.value
    }
  }
}

variable "assume_role_arn" {
  type     = string
  nullable = true
}

[jhourque]

Hi @gdavison, thanks for your help.
I had the same issue but your temporary workaround can't be used if backend is set through command line.

Hopefully, @olahouze was not far from the solution.
This command line works well for me with version 1.10.3:
terraform init --backend-config="key=xxx" -backend-config="assume_role={role_arn="arn:xxxx"}"