Providing Terraform with credentials in terraform files instead of env variable

Question

I have set-up a terraform project with a remote back-end on GCP. Now when I want to deploy the infrastructure, I run into issues with credentials. I have a credentials file in

\home\mike\.config\gcloud\credentials.json

In my terraform project I have the following data referring to the remote state:

data "terraform_remote_state" "project_id" {
   backend   = "gcs"
   workspace = "${terraform.workspace}"

   config {
     bucket = "${var.bucket_name}"
     prefix = "${var.prefix_project}"
   }
}

and I specify the cloud provider with a the details of my credentials file.

provider "google" {
  version     = "~> 1.16"
  project     = "${data.terraform_remote_state.project_id.project_id}"
  region      = "${var.region}"
  credentials = "${file(var.credentials)}"
}

However, this runs into

data.terraform_remote_state.project_id: data.terraform_remote_state.project_id: 
error initializing backend:
storage.NewClient() failed: dialing: google: could not find default 
credentials. 

if I add

export GOOGLE_APPLICATION_CREDENTIALS=/home/mike/.config/gcloud/credentials.json

I do get it to run as desired. My issue is that I would like to specify the credentials in the terraform files as I am running the terraform commands in an automated way from a python script where I cannot set the environment variables. How can I let terraform know where the credentials are without setting the env variable?

Answer 1

I figured this out in the end.

Also the data needs to have the credentials.

E.g.

data "terraform_remote_state" "project_id" {
  backend   = "gcs"
  workspace = "${terraform.workspace}"

  config = {
    bucket = "${var.bucket_name}"
    prefix = "${var.prefix_project}"
    credentials = "${var.credentials}"  <- added
  }
}