Fix | Credentials configure fails when run after project init

.github/workflows/tests-integration.yaml

@@ -51,6 +51,9 @@ jobs:
 
   integration_tests_cli_refarch:
     runs-on: ubuntu-latest
+    env:
+      TERRAFORM_VERSION: 1.9.8
+      OPENTOFU_VERSION: 1.9.1
     strategy:
       max-parallel: 1
       matrix:
@@ -79,6 +82,18 @@ jobs:
           export PATH="${PATH}:${HOME}/.poetry/bin"
           poetry install --with=dev
 
+      - name: Install terraform and tofu
+        run: |
+          echo "[INFO] Installing terraform ${TERRAFORM_VERSION} and tofu ${OPENTOFU_VERSION}"
+          curl -fsSL -o /tmp/terraform.zip \
+            "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
+          curl -fsSL -o /tmp/tofu.zip \
+            "https://github.com/opentofu/opentofu/releases/download/v${OPENTOFU_VERSION}/tofu_${OPENTOFU_VERSION}_linux_amd64.zip"
+          sudo unzip -q -o /tmp/terraform.zip terraform -d /usr/local/bin
+          sudo unzip -q -o /tmp/tofu.zip tofu -d /usr/local/bin
+          terraform version
+          tofu version
+
       - name: Build Leverage CLI
         run: |
           echo "[INFO] Building Leverage CLI"
@@ -131,6 +146,10 @@ jobs:
           aws configure set output json --profile bb-apps-devstg-devops
           aws configure set role_arn arn:aws:iam::${{ secrets.AWS_DEVSTG_ACCOUNT_ID }}:role/DeployMaster --profile bb-apps-devstg-devops
           aws configure set source_profile bb-deploymaster --profile bb-apps-devstg-devops
+          aws configure set region us-east-1 --profile bb-security-oaar
+          aws configure set output json --profile bb-security-oaar
+          aws configure set role_arn arn:aws:iam::${{ secrets.AWS_SECURITY_ACCOUNT_ID }}:role/DeployMaster --profile bb-security-oaar
+          aws configure set source_profile bb-deploymaster --profile bb-security-oaar
           cat << EOF > ~/.aws/credentials
           [bb-deploymaster]
           aws_access_key_id = ${{ secrets.AWS_ACCESS_KEY_ID }}

leverage/leverage.py

@@ -6,7 +6,7 @@
 
 from leverage import __version__, conf
 from leverage._internals import pass_state
-from leverage.path import NotARepositoryError, PathsHandler
+from leverage.path import NotARepositoryError, build_paths_and_environment, is_project_yaml_only_bootstrap
 from leverage.modules import aws, credentials, run, project, tofu, terraform, tfautomv, kubectl
 
 
@@ -34,11 +34,14 @@ def leverage(context, state, verbose):
     if context.invoked_subcommand == project.name:
         return
 
-    state.paths = PathsHandler(state.config)
-    state.environment = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-    }
+    # `credentials configure` can legitimately run right after `project init` and before
+    # `project create`: only project.yaml exists, so no project name can be resolved yet and
+    # PathsHandler would abort. The `credentials` group callback derives the project name from
+    # project.yaml and builds state.paths itself in that case.
+    if context.invoked_subcommand == credentials.name and is_project_yaml_only_bootstrap():
+        return
+
+    state.paths, state.environment = build_paths_and_environment(state.config)
 
 
 # Add modules to leverage

leverage/modules/credentials.py

@@ -16,13 +16,14 @@
 from questionary import Choice
 from click.exceptions import Exit
 
-from leverage import logger
+from leverage import conf, logger
 from leverage._utils import ExitError
 from leverage.modules.runner import Runner
 from leverage._internals import State, pass_runner, pass_paths, pass_state
 from leverage.path import (
     NotARepositoryError,
     PathsHandler,
+    build_paths_and_environment,
     get_global_config_path,
     get_project_root_or_current_dir_path,
 )
@@ -265,6 +266,20 @@ def credentials(state):
         if short_name is None or not re.match("^[a-z]{2,4}$", short_name):
             logger.error("Invalid or missing project short name in project.yaml file.")
             raise Exit(1)
+
+        if not build_env.exists():
+            # Completes this branch's own docstring promise, mirroring the common.tfvars branch
+            # below. Guarded so a mature project that still has project.yaml on disk never has
+            # its real build.env clobbered (project create never deletes project.yaml).
+            logger.info("Writing project short name to build.env.")
+            build_env.write_text(f"PROJECT={short_name}\nTF_IMAGE_TAG=1.1.9")
+
+        if state.paths is None:
+            # Upstream (leverage.py) skipped PathsHandler because only project.yaml existed.
+            # build.env now has a project name (or already did) - reload config from disk and
+            # build real, project-scoped paths here instead of leaving state.paths/environment None.
+            state.config = conf.load()
+            state.paths, state.environment = build_paths_and_environment(state.config)
     elif not build_env.exists():
         # project_config is not empty
         # and build.env does not exist
@@ -372,7 +387,7 @@ def _profile_is_configured(awscli: Runner, profile: str):
     Returns:
         bool: Whether the profile was already configured or not.
     """
-    exit_code, _, _ = awscli.exec("configure", "list", "--profile", profile)
+    exit_code, _, _ = awscli.exec("configure", "list", "--profile", profile, raises=False)
 
     return not exit_code
 
@@ -446,7 +461,7 @@ def configure_credentials(
     values = {"aws_access_key_id": key_id, "aws_secret_access_key": secret_key}
 
     for key, value in values.items():
-        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile)
+        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile, raises=False)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
@@ -467,7 +482,7 @@ def _credentials_are_valid(awscli: Runner, profile: str):
     Returns:
         bool: Whether the credentials are valid.
     """
-    error_code, output, _ = awscli.exec("sts", "get-caller-identity", "--profile", profile)
+    error_code, output, _ = awscli.exec("sts", "get-caller-identity", "--profile", profile, raises=False)
 
     return error_code != 255 and "InvalidClientTokenId" not in output
 
@@ -482,7 +497,9 @@ def _get_management_account_id(awscli: Runner, profile: str):
     Returns:
         str: Management account id.
     """
-    exit_code, caller_identity, _ = awscli.exec("sts", "get-caller-identity", "--output", "json", "--profile", profile)
+    exit_code, caller_identity, _ = awscli.exec(
+        "sts", "get-caller-identity", "--output", "json", "--profile", profile, raises=False
+    )
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {caller_identity}")
 
@@ -502,7 +519,7 @@ def _get_organization_accounts(awscli: Runner, profile: str, project_name: str):
         dict: Mapping of organization accounts names to ids.
     """
     exit_code, organization_accounts, _ = awscli.exec(
-        "organizations", "list-accounts", "--output", "json", "--profile", profile
+        "organizations", "list-accounts", "--output", "json", "--profile", profile, raises=False
     )
 
     if exit_code:
@@ -530,7 +547,9 @@ def _get_mfa_serial(awscli: Runner, profile: str):
     Returns:
         str: MFA device serial.
     """
-    exit_code, mfa_devices, _ = awscli.exec("iam", "list-mfa-devices", "--output", "json", "--profile", profile)
+    exit_code, mfa_devices, _ = awscli.exec(
+        "iam", "list-mfa-devices", "--output", "json", "--profile", profile, raises=False
+    )
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {mfa_devices}")
     mfa_devices = json.loads(mfa_devices)
@@ -558,7 +577,7 @@ def configure_profile(awscli: Runner, profile: str, values: dict):
     """
     logger.info(f"\tConfiguring profile [bold]{profile}[/bold]")
     for key, value in values.items():
-        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile)
+        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile, raises=False)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
@@ -613,8 +632,9 @@ def configure_accounts_profiles(
         # A profile identifier looks like `le-security-oaar`
         account_profiles[f"{short_name}-{account_name}-{PROFILES[_type]['profile_role']}-mfa"] = account_profile
 
-    logger.info("Backing up account profiles file.")
-    shutil.copy(paths.aws_config_file, paths.aws_config_file.with_suffix(".bkp"))
+    if paths.aws_config_file.exists():
+        logger.info("Backing up account profiles file.")
+        shutil.copy(paths.aws_config_file, paths.aws_config_file.with_suffix(".bkp"))
 
     for profile_identifier, profile_values in account_profiles.items():
         configure_profile(profile_identifier, profile_values)

leverage/modules/tf.py

@@ -485,7 +485,7 @@ def _make_layer_backend_key(cwd, account_dir, account_name):
 
 @pass_paths
 def _validate_layout(paths, layer: str):
-    paths.check_for_layer_location()
+    paths.check_for_layer_location(Path(layer))
 
     # Check for `environment = <account name>` in account.tfvars
     account_name = paths.account_conf.get("environment")

leverage/path.py

@@ -157,7 +157,7 @@ def __init__(self, env_conf: dict):
         self.backend_conf = hcl2.loads(backend_config.read_text()) if backend_config.exists() else {}
 
         # Get MFA enabled status
-        self.mfa_enabled = env_conf.get("MFA_ENABLED", "false")
+        self.mfa_enabled = str(env_conf.get("MFA_ENABLED", "false")).strip().lower() == "true"
 
         # Get project name
         self.project = self.common_conf.get("project", env_conf.get("PROJECT", False))
@@ -183,11 +183,13 @@ def __init__(self, env_conf: dict):
 
     @property
     def common_tfvars(self):
-        return f"{self.root_dir}/config/{self.COMMON_TF_VARS}"
+        # return f"{self.root_dir}/config/{self.COMMON_TF_VARS}"
+        return self.root_dir / "config" / self.COMMON_TF_VARS
 
     @property
     def account_tfvars(self):
-        return f"{self.account_dir}/config/{self.ACCOUNT_TF_VARS}"
+        # return f"{self.account_dir}/config/{self.ACCOUNT_TF_VARS}"
+        return self.account_dir / "config" / self.ACCOUNT_TF_VARS
 
     @property
     def backend_tfvars(self):
@@ -267,3 +269,25 @@ def get_project_root_or_current_dir_path() -> Path:
         root = Path.cwd()
 
     return root
+
+
+def is_project_yaml_only_bootstrap() -> bool:
+    """Whether only `project.yaml` exists yet: `project init` has run but `project create`
+    hasn't, so neither `build.env` nor `config/common.tfvars` exist. PathsHandler can't resolve
+    a project name in this state; callers should skip it and derive the name from project.yaml.
+    """
+    root = get_project_root_or_current_dir_path()
+    build_env = root / "build.env"
+    common_tfvars = Path(get_global_config_path()) / "common.tfvars"
+    return (root / "project.yaml").exists() and not build_env.exists() and not common_tfvars.exists()
+
+
+def build_paths_and_environment(config: dict) -> tuple[PathsHandler, dict]:
+    """Build a PathsHandler and the AWS cli environment variables derived from it. Shared by any
+    group callback that needs to resolve project paths from `state.config`."""
+    paths = PathsHandler(config)
+    environment = {
+        "AWS_SHARED_CREDENTIALS_FILE": str(paths.aws_credentials_file),
+        "AWS_CONFIG_FILE": str(paths.aws_config_file),
+    }
+    return paths, environment