From 9e4d73ab4cfc871eb1613acb6a82a54d6ec492aa Mon Sep 17 00:00:00 2001
From: Oleksandr Kuzminskyi <aleks@infrahouse.com>
Date: Sat, 4 Jul 2026 15:21:00 -0700
Subject: [PATCH] Fix terraform-drift: extract per-env ROLE_GITHUB instead of
 passing the JSON map
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The drift workflow passed `vars.ROLE_GITHUB` — a JSON map keyed by environment
({"production":"arn...","sandbox":"arn..."}) — directly to
aws-actions/configure-aws-credentials `role-to-assume`, so AssumeRole failed
with "Source Account ID is needed if the Role Name is provided and not the Role
Arn." Region already worked because that value was extracted per-env; the role
was not.

Extract ROLE_GITHUB for the target environment in the Extract Variables step
(mirroring REGION) and reference the extracted output in Configure AWS
Credentials, matching how terraform-CI/CD resolve the role.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 modules/service-repo/templates/terraform-drift.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/service-repo/templates/terraform-drift.yml b/modules/service-repo/templates/terraform-drift.yml
index 7386032..adae852 100644
--- a/modules/service-repo/templates/terraform-drift.yml
+++ b/modules/service-repo/templates/terraform-drift.yml
@@ -27,6 +27,7 @@ jobs:
     env:
       GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
       REGION_JSON: "${{ vars.AWS_DEFAULT_REGION }}"
+      ROLE_GITHUB_JSON: "${{ vars.ROLE_GITHUB }}"
 
     defaults:
       run:
@@ -41,15 +42,18 @@ jobs:
         id: "extract_vars"
         env:
           REGION_JSON_CONTENT: ${{ env.REGION_JSON }}
+          ROLE_GITHUB_JSON_CONTENT: ${{ env.ROLE_GITHUB_JSON }}
           TARGET_ENV: ${{ inputs.env }}
         run: |
           REGION=$(echo "$REGION_JSON_CONTENT" | jq -r ".${TARGET_ENV}")
           echo "REGION=$REGION" >> "$GITHUB_OUTPUT"
+          ROLE_GITHUB=$(echo "$ROLE_GITHUB_JSON_CONTENT" | jq -r ".${TARGET_ENV}")
+          echo "ROLE_GITHUB=$ROLE_GITHUB" >> "$GITHUB_OUTPUT"
 
       - name: "Configure AWS Credentials"
         uses: "aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b"  # v6
         with:
-          role-to-assume: "${{ vars.ROLE_GITHUB }}"
+          role-to-assume: "${{ steps.extract_vars.outputs.ROLE_GITHUB }}"
           role-session-name: "github-actions-${{ inputs.env }}"
           aws-region: "${{ steps.extract_vars.outputs.REGION }}"