title: Invalid Terraform AWS provider credentials when passing AWS system manager parameter store variables
body: <p><strong>Background:</strong></p>
  <p>I'm using an AWS CodeBuild buildspec.yml to iterate through directories from a GitHub repo to apply IaC using Terraform. To access the credentials needed for the Terraform AWS provider, I used AWS system manager parameter store to retrieve the access and secret key within the buildspec.yml.</p>
  <p><strong>Problem:</strong></p>
  <p>The system manager parameter store masks the access and secret key env value so when they are inherited by the Terraform AWS provider, the provider outputs that the credentials are invalid:</p>
  <pre><code>Error: error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid.
      status code: 403, request id: xxxx
  </code></pre>
  <p><strong>To reproduce the problem:</strong></p>
  <ul>
  <li><p>Create system manager parameter store variables (TF_VAR_AWS_ACCESS_KEY_ID=access, TF_AWS_SECRET_ACCESS_KEY=secret)</p>
  </li>
  <li><p>Create AWS CodeBuild project with:</p>
  </li>
  </ul>
  <pre><code> &quot;source&quot;: {
                  &quot;type&quot;: &quot;NO_SOURCE&quot;,
  }
  &quot;environment&quot;: {
                  &quot;type&quot;: &quot;LINUX_CONTAINER&quot;,
                  &quot;image&quot;: &quot;aws/codebuild/standard:4.0&quot;,
                  &quot;computeType&quot;: &quot;BUILD_GENERAL1_SMALL&quot;
  }
  </code></pre>
  <p><code>buildspec.yml</code> with the following: (modified to create .tf files instead of sourcing from github)</p>
  <pre><code>version: 0.2
  env:
    shell: bash
    parameter-store:
      TF_VAR_AWS_ACCESS_KEY_ID: TF_AWS_ACCESS_KEY_ID
      TF_VAR_AWS_SECRET_ACCESS_KEY: TF_AWS_SECRET_ACCESS_KEY
  phases:
    install:
      commands:
        - wget https://releases.hashicorp.com/terraform/0.12.28/terraform_0.12.28_linux_amd64.zip -q
        - unzip terraform_0.12.28_linux_amd64.zip &amp;&amp; mv terraform /usr/local/bin/
        - printf &quot;provider &quot;aws&quot; {\n\taccess_key = var.AWS_ACCESS_KEY_ID\n\tsecret_key = var.AWS_SECRET_ACCESS_KEY\n\tversion    = \&quot;~&gt; 3.2.0\&quot;\n}&quot; &gt;&gt; provider.tf
        - printf &quot;variable &quot;AWS_ACCESS_KEY_ID&quot; {}\nvariable &quot;AWS_SECRET_ACCESS_KEY&quot; {}&quot; &gt; vars.tf
        - printf &quot;resource \&quot;aws_s3_bucket\&quot; \&quot;test\&quot; {\n\tbucket = \&quot;test\&quot;\n\tacl = \&quot;private\&quot;\n}&quot; &gt;&gt; s3.tf
        - terraform init
        - terraform plan
  </code></pre>
  <p><strong>Attempts:</strong></p>
  <ol>
  <li>Passing creds through terraform <code>-vars</code> option:</li>
  </ol>
  <pre><code>terraform plan -var=&quot;AWS_ACCESS_KEY_ID=$TF_VAR_AWS_ACCESS_KEY_ID&quot; -var=&quot;AWS_ACCESS_KEY_ID=$TF_VAR_AWS_SECRET_ACCESS_KEY&quot;
  </code></pre>
  <p>but I get the same invalid credentials error</p>
  <ol start="2">
  <li>Export system manager parameter store credentials within buildspec.yml:</li>
  </ol>
  <pre><code>commands:
    - export AWS_ACCESS_KEY_ID=$TF_VAR_AWS_ACCESS_KEY_ID
    - export AWS_SECRET_ACCESS_KEY=$TF_VAR_AWS_SECRET_ACCESS_KEY
  </code></pre>
  <p>which results in duplicate masked variables and the same error above. <code>printenv</code> output within buildspec.yml:</p>
  <pre><code>AWS_ACCESS_KEY_ID=***
  TF_VAR_AWS_ACCESS_KEY_ID=***
  AWS_SECRET_ACCESS_KEY=***
  TF_VAR_AWS_SECRET_ACCESS_KEY=***
  </code></pre>
  <p><strong>Possible solution routes:</strong></p>
  <ul>
  <li>Somehow pass the MASKED parameter store credential values into Terraform successfully (preferred)</li>
  <li>Pass sensitive credentials into the Terraform AWS provider using a different method e.g. AWS secret manager, IAM role, etc.</li>
  <li>Unmask the parameter store variables to pass into the aws provider (probably defeats the purpose of using aws system manager in the first place)</li>
  </ul>