Release test for AWS IAM Redis passwordless #189
Draft
+31
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Add redis_passwordless_aws_use_iam variable to enable AWS IAM Redis auth - Add redis_passwordless_aws_region variable for region specification - Configure TFE_REDIS_PASSWORDLESS_AWS_USE_IAM environment variable - Configure TFE_REDIS_SIDEKIQ_PASSWORDLESS_AWS_USE_IAM for Sidekiq - Configure TFE_REDIS_PASSWORDLESS_AWS_REGION environment variable These changes enable TFE to use AWS IAM authentication for Redis connections instead of password-based authentication, following the same pattern as Azure MSI Redis authentication.
|
|
|
Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement Learn more about why HashiCorp requires a CLA and what the CLA includes Have you signed the CLA already but the status is still pending? Recheck it. |
- Add TFE_REDIS_SIDEKIQ_* environment variables for separate Sidekiq Redis - Add TFE_REDIS_SIDEKIQ_PASSWORDLESS_AWS_* variables for IAM authentication - Add TFE_REDIS_PASSWORDLESS_AWS_HOST_NAME for cluster name extraction - Support separate Redis instances for main and Sidekiq with fallback to main Redis - Add variables: redis_sidekiq_host, redis_sidekiq_user, redis_sidekiq_password - Enable dual Redis passwordless authentication (main + Sidekiq)
- Add debug output for all Redis environment variables - Add debug output for input variables received - Track Redis username propagation to TFE container
- Add redis_passwordless_aws_use_iam variable to variables.tf - Add TFE_REDIS_PASSWORDLESS_AWS_USE_IAM and TFE_REDIS_SIDEKIQ_PASSWORDLESS_AWS_USE_IAM environment variables to redis_config.tf - Add debug outputs for Redis environment variables and input variables - Ensures Redis IAM authentication is properly configured for AWS ElastiCache
…_config - Fix alignment and indentation in debug_redis_env_vars and debug_redis_input_vars outputs - Standardize spacing to align equals signs consistently with terraform formatting standards - Resolves terraform fmt check failure in CI pipeline
…m-tfe-utility into pravi/IND-5861
| } | ||
|
|
||
| output "debug_redis_env_vars" { | ||
| value = { |
Contributor
There was a problem hiding this comment.
we can remove this debug outpus
| description = "Debug output for Redis environment variables" | ||
| } | ||
|
|
||
| output "debug_redis_input_vars" { |
| TFE_REDIS_PASSWORDLESS_AZURE_USE_MSI = var.redis_passwordless_azure_use_msi | ||
| TFE_REDIS_SIDEKIQ_PASSWORDLESS_AZURE_USE_MSI = var.redis_passwordless_azure_use_msi | ||
| TFE_REDIS_PASSWORDLESS_AZURE_CLIENT_ID = var.redis_passwordless_azure_client_id | ||
| TFE_REDIS_PASSWORDLESS_AWS_USE_IAM = var.redis_passwordless_aws_use_iam |
Contributor
There was a problem hiding this comment.
This is incorrect
config values - https://developer.hashicorp.com/terraform/enterprise/deploy/reference/configuration#tfe_redis_passwordless_aws_use_instance_profile
ajmera-naman
requested changes
Nov 13, 2025
Contributor
ajmera-naman
left a comment
ajmera-naman
left a comment
There was a problem hiding this comment.
Configuration seems incorrect
kkavish
reviewed
Nov 17, 2025
| TFE_REDIS_SIDEKIQ_PASSWORDLESS_AZURE_USE_MSI = var.redis_passwordless_azure_use_msi | ||
| TFE_REDIS_PASSWORDLESS_AZURE_CLIENT_ID = var.redis_passwordless_azure_client_id | ||
| TFE_REDIS_PASSWORDLESS_AWS_USE_IAM = var.redis_passwordless_aws_use_iam | ||
| TFE_REDIS_SIDEKIQ_PASSWORDLESS_AWS_USE_IAM = var.redis_passwordless_aws_use_iam |
Contributor
There was a problem hiding this comment.
same as @ajmera-naman mentioned above, the problem I feel now is deeper. If the configs are incorrect, the Passwordless auth shouldn't work at all. These are either working with standard auth or we are looking at the incorrect test case.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
These changes enable TFE to use AWS IAM authentication for Redis connections instead of password-based authentication, following the same pattern as Azure MSI Redis authentication.
Background
Part of AWS redis passwordless release test
Relates https://github.com/hashicorp/terraform-enterprise/pull/3149
How has this been tested?
CI/CD: https://github.com/hashicorp/terraform-enterprise/actions/runs/19146818577/job/54726521821