Terragrunt访问公开S3模块源时触发HTTPS转s3协议凭证错误

我使用第三方公开S3桶中的Terraform模块，该模块可通过HTTPS直接访问，用curl或wget无需凭证就能正常下载。但使用Terragrunt时，模块的HTTPS URL被自动解析为s3::https协议，由于我通过AWS SSO操作（未导出AWS_ACCESS_KEY_ID等环境变量，也无~/.aws/credentials凭证文件），导致下载失败。

我的Terragrunt配置代码 #

terraform {
  source = "https://s3-us-east-2.amazonaws.com/wizio-public/deployment-v2/aws/wiz-aws-cloud-events-terraform-module.zip"
}

inputs = {
  integration_type      = <redacted_value>
  cloudtrail_bucket_arn = <redacted_value>
  cloudtrail_kms_arn    = <redacted_value>
  wiz_access_role_arn   = <redacted_value>
}

执行plan命令时的报错信息 #

INFO[0000] Downloading Terraform configurations from s3::https://s3-us-east-2.amazonaws.com/wizio-public/deployment-v2/aws/wiz-aws-cloud-events-terraform-module.zip into /Users/marco/.terragrunt-cache/bj1DtPSzfD2L7xtoscLsClD9TJ4/J5rSBBFtvLMrstC7CVu_4ibhzvo
ERRO[0005] downloading source url s3::https://s3-us-east-2.amazonaws.com/wizio-public/deployment-v2/aws/wiz-aws-cloud-events-terraform-module.zip
1 error occurred:
    * NoCredentialProviders: no valid providers in chain
caused by: EnvAccessKeyNotFound: AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY not found in environment
SharedCredsAccessKey: shared credentials ... in /Users/marco/.aws/credentials did not contain aws_access_key_id
EC2RoleRequestError: no EC2 instance role found
caused by: RequestError: send request failed

解决方案 #

Terragrunt默认会识别S3域名并自动切换到s3协议处理，要强制用HTTPS下载，有两种可行方法：

方法1：给URL添加查询参数绕过S3协议识别

在HTTPS URL末尾添加任意无效查询参数（比如?force-https），让Terragrunt无法识别为S3路径，从而使用普通HTTPS协议下载：

terraform {
  source = "https://s3-us-east-2.amazonaws.com/wizio-public/deployment-v2/aws/wiz-aws-cloud-events-terraform-module.zip?force-https"
}

方法2：启用skip_aws_provider配置

在Terragrunt配置中添加skip_aws_provider = true，禁用Terragrunt的AWS相关自动处理逻辑，强制使用HTTPS下载模块：

terraform {
  source = "https://s3-us-east-2.amazonaws.com/wizio-public/deployment-v2/aws/wiz-aws-cloud-events-terraform-module.zip"
}

skip_aws_provider = true

inputs = {
  integration_type      = <redacted_value>
  cloudtrail_bucket_arn = <redacted_value>
  cloudtrail_kms_arn    = <redacted_value>
  wiz_access_role_arn   = <redacted_value>
}

当前环境信息 #

• Terragrunt版本：0.58.3
• Terraform版本：1.5.7
• 操作系统：OSX darwin_arm64

内容的提问来源于stack exchange，提问作者Marco Caberletti