From b48c4997d9d01cff9ee663f757d7bb434f897957 Mon Sep 17 00:00:00 2001 From: Andrej Podhradsky Date: Fri, 24 Jul 2026 17:39:50 +0200 Subject: [PATCH] fix(aws): stop storing credentials in Pulumi provider state AWS credentials (access key, secret key, session token) were being set via Pulumi config, which caused them to be persisted in the provider resource state. When destroying a cluster provisioned with an older session token, Pulumi would use the expired credentials from state instead of the fresh ones from the environment, causing destroy to fail with ExpiredToken errors. Let the AWS SDK resolve credentials through its default credential chain (env vars, shared credentials file, IAM roles) instead of explicitly setting them in Pulumi config. Only the region is configured explicitly. Co-Authored-By: Claude Opus 4.6 --- pkg/provider/aws/aws.go | 9 +++++---- pkg/provider/aws/constants/constants.go | 3 --- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/pkg/provider/aws/aws.go b/pkg/provider/aws/aws.go index 05733d934..94c923a44 100644 --- a/pkg/provider/aws/aws.go +++ b/pkg/provider/aws/aws.go @@ -71,12 +71,13 @@ func manageRemoteState(ctx context.Context, backedURL string) error { } // pulumi config key : aws env credential +// Only region is set via Pulumi config; credentials (access key, secret key, +// session token) are resolved by the AWS SDK's default credential chain so +// that expired tokens stored in the Pulumi provider state never shadow +// fresh environment credentials on later operations (e.g. destroy). var envCredentials = map[string]string{ awsConstants.CONFIG_AWS_REGION: "AWS_DEFAULT_REGION", - awsConstants.CONFIG_AWS_NATIVE_REGION: "AWS_DEFAULT_REGION", - awsConstants.CONFIG_AWS_ACCESS_KEY: "AWS_ACCESS_KEY_ID", - awsConstants.CONFIG_AWS_SECRET_KEY: "AWS_SECRET_ACCESS_KEY", - awsConstants.CONFIG_AWS_SESSION_TOKEN: "AWS_SESSION_TOKEN"} + awsConstants.CONFIG_AWS_NATIVE_REGION: "AWS_DEFAULT_REGION"} var DefaultCredentials = GetClouProviderCredentials(nil) diff --git a/pkg/provider/aws/constants/constants.go b/pkg/provider/aws/constants/constants.go index 535646164..9ac855db3 100644 --- a/pkg/provider/aws/constants/constants.go +++ b/pkg/provider/aws/constants/constants.go @@ -3,9 +3,6 @@ package constants const ( CONFIG_AWS_REGION string = "aws:region" CONFIG_AWS_NATIVE_REGION string = "aws-native:region" - CONFIG_AWS_ACCESS_KEY string = "aws:accessKey" - CONFIG_AWS_SECRET_KEY string = "aws:secretKey" - CONFIG_AWS_SESSION_TOKEN string = "aws:token" ) const (