title: How to pass aws provider credentials to null_resource local-exec provisioner?
body: <p>Has anyone come up with a decent way to do this?</p>
  
  <p>In short, you have a <code>provider "aws"</code>, configured via env vars or profile, with or without <code>sts</code>, it doesn't matter. Maybe you have several.</p>
  
  <p>Now you want to call out to the <code>aws</code> cli because something isn't well implemented in the aws provider. In my case, I need to generate and upload some sensitive information directly to an S3 bucket that I do not want in the state file. In any case, it was <code>s3 sync</code>, so the action is idempotent.</p>
  
  <p>However, there appears to be no way to pass the provider credentials - permanent, env var, profile to temporary sts - to a <code>null_resource</code> clause:</p>
  
  <pre><code>provider "aws" {
    # set using explicit setting or profile or however
    alias = "myaws"
  }
  
  resource "null_resource" "cli" {
    provisioner "local-exec" {
      command = "aws &lt;do something&gt;"
      environment {
        # happy to pass AWS_PROFILE or AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY here...
        # if there were a way to retrieve it from the "myaws" provider
      }
    }
  }
  </code></pre>