fix: getting dynamic credentials before parsing locals block (#3279)

gruntwork-io · Jul 18, 2024 · 05dc2e9 · 05dc2e9
1 parent 4d7e896
commit 05dc2e9
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 4 deletions.
diff --git a/cli/commands/terraform/action.go b/cli/commands/terraform/action.go
@@ -86,15 +86,16 @@ func RunWithTarget(ctx context.Context, opts *options.TerragruntOptions, target
 }
 
 func runTerraform(ctx context.Context, terragruntOptions *options.TerragruntOptions, target *Target) error {
-	if err := checkVersionConstraints(ctx, terragruntOptions); err != nil {
-		return target.runErrorCallback(terragruntOptions, nil, err)
-	}
-
+	// We need to get the credentials from auth-provider-cmd at the very beginning, since the locals block may contain `get_aws_account_id()` func.
 	credsGetter := creds.NewGetter()
 	if err := credsGetter.ObtainAndUpdateEnvIfNecessary(ctx, terragruntOptions, externalcmd.NewProvider(terragruntOptions)); err != nil {
 		return err
 	}
 
+	if err := checkVersionConstraints(ctx, terragruntOptions); err != nil {
+		return target.runErrorCallback(terragruntOptions, nil, err)
+	}
+
 	terragruntConfig, err := config.ReadTerragruntConfig(ctx, terragruntOptions, config.DefaultParserOptions(terragruntOptions))
 	if err != nil {
 		return target.runErrorCallback(terragruntOptions, terragruntConfig, err)

diff --git a/test/fixture-auth-provider-cmd/remote-state/terragrunt.hcl b/test/fixture-auth-provider-cmd/remote-state/terragrunt.hcl
@@ -1,3 +1,7 @@
+locals {
+  aws_account_id = "${get_aws_account_id()}"
+}
+
 remote_state {
   backend = "s3"
   generate = {