From c78bf4e718d3fb66c98a8cd418d9342abd8a12ee Mon Sep 17 00:00:00 2001 From: "@permadeath.com" Date: Sun, 9 Aug 2026 15:40:29 -0400 Subject: [PATCH] fix(deploy): verify the AWS session with STS before planning deploy.sh took whatever credentials were lying around and let tofu find out. Require AWS_PROFILE like the other repos' deploy scripts, and ask STS up front so a dead session fails before the plan. Co-Authored-By: Claude Fable 5 --- scripts/deploy.sh | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/scripts/deploy.sh b/scripts/deploy.sh index c128c89..5f6b363 100755 --- a/scripts/deploy.sh +++ b/scripts/deploy.sh @@ -63,13 +63,22 @@ env_dir="envs/$env_name" exit 2 } -for tool in tofu jq curl; do +for tool in tofu aws jq curl; do command -v "$tool" >/dev/null || { echo "$tool is not installed." >&2 exit 1 } done +: "${AWS_PROFILE:?set AWS_PROFILE; default credentials are almost never the right account}" + +# The variable being set says nothing about the session behind it. Ask STS +# now, so an expired login fails here instead of partway into the plan. +if ! aws sts get-caller-identity --query Account --output text >/dev/null; then + echo "deploy: no working AWS session for profile $AWS_PROFILE; log in again" >&2 + exit 1 +fi + # Resolved here rather than after the apply: finding out the credential is # missing once the deploy is already live helps nobody. # -- 2.51.2