GitHub Actions多AWS账号Terraform部署凭证报错排查

Terraform报凭证错误的直接原因是AWS访问密钥根本没有被注入到运行环境，配置存在以下硬错误：

• 输入参数名拼写不匹配：workflow_dispatch块中定义的账号选择参数名为accounts（末尾带s），但后续条件判断逻辑里全部错误引用为github.event.inputs.account（末尾无s），该引用值始终为空，两个if判断分支都不会执行，密钥从未被写入$GITHUB_ENV。Terraform拿不到静态密钥后会尝试读取EC2 IMDS服务的实例角色凭证，而GitHub Actions托管运行器不是AWS EC2实例，IMDS请求必然失败，最终抛出无有效凭证的错误。
• 冗余配置：写入$GITHUB_ENV的环境变量会默认注入后续所有步骤的运行上下文，不需要在每个Terraform步骤中重复通过env块声明传递同名变量，多余的写法反而增加排查干扰。

name: "Terraform"
on:
  workflow_dispatch:
    inputs:
      accounts:
        description: account to use
        type: choice
        default: PROD
        options:
        - PROD
        - DEV
      action:
        description: 'Terraform Action to Perform'
        type: choice
        options:
        - Terraform_plan
jobs:
  terraform_plan:
    name: "Terraform plan"
    if: ${{ github.event.inputs.action == 'Terraform_plan' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1

      - name: Inject AWS credentials
        run: |
          if [[ "${{ github.event.inputs.accounts }}" == "PROD" ]]; then
            echo "AWS_ACCESS_KEY_ID=${{ secrets.PROD_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
            echo "AWS_SECRET_ACCESS_KEY=${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
          fi
          if [[ "${{ github.event.inputs.accounts }}" == "DEV" ]]; then
            echo "AWS_ACCESS_KEY_ID=${{ secrets.DEV_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
            echo "AWS_SECRET_ACCESS_KEY=${{ secrets.DEV_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
          fi

      - name: Terraform Init
        id: init
        run: terraform -chdir=vpc init

      - name: Terraform Plan
        run: terraform -chdir=vpc plan

• 确认仓库Secrets中已正确配置4个密钥值：PROD_AWS_ACCESS_KEY_ID、PROD_AWS_SECRET_ACCESS_KEY、DEV_AWS_ACCESS_KEY_ID、DEV_AWS_SECRET_ACCESS_KEY，密钥名无拼写错误
• 确认存储的AWS密钥处于生效状态，未被禁用、删除或超出轮换有效期
• 确认密钥对应的IAM身份拥有VPC资源操作的足够权限，避免后续出现权限类报错

内容的提问来源于stack exchange，提问作者Eveline Ribka Nelwan