Fix terraform-drift: extract per-env ROLE_GITHUB instead of passing the JSON map

[akuzminsky]

Bug

The scheduled drift sweep fails at Configure AWS Credentials with:

Retry AssumeRole: attempt 1 of 12 failed: Source Account ID is needed if the Role Name is provided and not the Role Arn.

(example run)

terraform-drift.yml passed vars.ROLE_GITHUB — a JSON map keyed by environment, e.g. {"production":"arn...","sandbox":"arn..."} — straight into role-to-assume. The action expects a single ARN, so it treated the blob as a role name and demanded a source account ID. aws-region worked only because that step already extracted REGION per-env; the role was never extracted.

This is pre-existing (unrelated to the recent action-pinning work — that only changed the uses: line in this file). CI/CD resolve the role correctly; drift did not.

Fix

Extract ROLE_GITHUB for the target environment in the Extract Variables step, mirroring the existing REGION extraction, and reference the extracted output in Configure AWS Credentials — the same pattern terraform-CI.yml / terraform-CD.yml use.

Note (out of scope)

The drift workflow's Create Pull Request step references steps.app-token.outputs.token, but no app-token step exists in the workflow. That only fires when drift is actually detected, so it doesn't affect this AssumeRole failure — flagging it separately for a follow-up.

🤖 Generated with Claude Code

[github-actions]

State s3://infrahouse-github-control-state/terraform.tfstate

Affected resources counts

Success	Add	🟡 Change	Destroy
✅	0	1	0

Affected resources by action

Action	Resources
🟡	module.aws_service_infrahouse_app.github_repository_file.terraform_drift[0]

STDOUT

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.aws_service_infrahouse_app.github_repository_file.terraform_drift[0] will be updated in-place
  ~ resource "github_repository_file" "terraform_drift" {
      ~ content             = <<-EOT
            ---
            name: "Terraform Drift Detection"
            
            on:  # yamllint disable-line rule:truthy
              workflow_call:
                inputs:
                  env:
                    type: "string"
                    required: true
            
            permissions:
              id-token: "write"  # This is required for requesting the JWT
              contents: "write"
              pull-requests: "write"
              issues: "write"  # Required to create and apply labels
            
            concurrency:
              group: "terraform-drift-${{ inputs.env }}"
              cancel-in-progress: false
            
            jobs:
              terraform-drift:
                name: "Terraform Drift Detection"
                runs-on: ubuntu-24.04
                environment: "continuous-integration-${{ inputs.env }}"
                timeout-minutes: 15
                env:
                  GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
                  REGION_JSON: "${{ vars.AWS_DEFAULT_REGION }}"
          +       ROLE_GITHUB_JSON: "${{ vars.ROLE_GITHUB }}"
            
                defaults:
                  run:
                    shell: "bash"
                    working-directory: "environments/${{ inputs.env }}"
            
                steps:
                  - name: "Checkout"
                    uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"  # v6
            
                  - name: "Extract Variables"
                    id: "extract_vars"
                    env:
                      REGION_JSON_CONTENT: ${{ env.REGION_JSON }}
          +           ROLE_GITHUB_JSON_CONTENT: ${{ env.ROLE_GITHUB_JSON }}
                      TARGET_ENV: ${{ inputs.env }}
                    run: |
                      REGION=$(echo "$REGION_JSON_CONTENT" | jq -r ".${TARGET_ENV}")
                      echo "REGION=$REGION" >> "$GITHUB_OUTPUT"
          +           ROLE_GITHUB=$(echo "$ROLE_GITHUB_JSON_CONTENT" | jq -r ".${TARGET_ENV}")
          +           echo "ROLE_GITHUB=$ROLE_GITHUB" >> "$GITHUB_OUTPUT"
            
                  - name: "Configure AWS Credentials"
                    uses: "aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b"  # v6
                    with:
          -           role-to-assume: "${{ vars.ROLE_GITHUB }}"
          +           role-to-assume: "${{ steps.extract_vars.outputs.ROLE_GITHUB }}"
                      role-session-name: "github-actions-${{ inputs.env }}"
                      aws-region: "${{ steps.extract_vars.outputs.REGION }}"
            
                  - name: "Set Terraform version"
                    id: "terraform_version"
                    run: |
                      echo "IH_TF_VERSION=$(cat .terraform-version)" >> "$GITHUB_OUTPUT"
            
                  - name: "Setup Terraform"
                    uses: "hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e"  # v4
                    with:
                      terraform_version: "${{ steps.terraform_version.outputs.IH_TF_VERSION }}"
            
                  - name: "Set up Python"
                    uses: "actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1"  # v6
                    with:
                      python-version: "3.14"
            
                  - name: "Setup Python Environment"
                    run: |
                      make bootstrap-ci
            
                  - name: "Terraform Init"
                    run: |
                      terraform init -input=false
            
                  - name: "Check if any changes are planned"
                    id: "check_drift"
                    run: |
                      terraform plan -no-color -input=false -detailed-exitcode
            
                  - name: Cleanup working dir
                    run: git clean -df
            
                  - name: "Record Config Drift Log Entry"
                    if: "steps.check_drift.outputs.exitcode == 2"
                    run: |
                      git \
                      -c user.name="${{ github.actor }}" \
                      -c user.email="${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com" \
                      commit -m "Reconcile configuration drift" --allow-empty
            
                  - name: "Check for open PR with label"
                    id: "check_label"
                    if: "steps.check_drift.outputs.exitcode == 2"
                    run: |
                      LABEL="config-drift"
                      REPO="${{ github.repository }}"
                      COUNT=$(gh pr list --repo "$REPO" --label "$LABEL" --state open --json number --jq 'length')
                      echo "Found $COUNT open PR(s) with label '$LABEL'"
                      if [[ $COUNT -gt 0 ]]; then
                        echo "label_exists=true" >> $GITHUB_OUTPUT
                      else
                        echo "label_exists=false" >> $GITHUB_OUTPUT
                      fi
            
                  - name: "Create Pull Request"
                    if: "steps.check_label.outputs.label_exists == 'false'"
                    uses: "peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1"  # v8
                    with:
                      token: "${{ steps.app-token.outputs.token }}"
                      base: "main"
                      branch: "create-pull-request/config-drift"
                      title: "[config-drift] Reconcile Terraform configuration drift in ${{ inputs.env }}"
                      commit-message: "[config-drift] Configuration drift record for ${{ inputs.env }}"
                      team-reviewers: "devops-members"
                      labels: |
                        config-drift
        EOT
        id                  = "aws-service-infrahouse-app:.github/workflows/terraform-drift.yml:main"
        # (9 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.ih_8_repos.github_repository.repo,
  on modules/local-repo/repos.tf line 4, in resource "github_repository" "repo":
   4:   has_downloads        = false

This attribute is no longer in use, but it hasn't been removed yet. It will
be removed in a future version. See
https://github.com/orgs/community/discussions/102145#discussioncomment-8351756

(and 6 more similar warnings elsewhere)

Warning: Deprecated attribute

  on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
  11:     "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"

metadata

eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMCwgImNoYW5nZSI6IDEsICJkZXN0cm95IjogMH19