fix: Removing extra --auth-provider-cmd call (gruntwork-io#6045)

* fix: Removing extra `--auth-provider-cmd` call

* chore: Adding `TestReadTerragruntAuthProviderCmdRunAllCallCountWithRacing`

Author: yhakbar

pkg/config/dependency.go

@@ -1051,12 +1051,13 @@ func getTerragruntOutputJSON(ctx context.Context, pctx *ParsingContext, l log.Lo
 	}
 
 	if isInit {
-		credsGetter := creds.NewGetter()
-		if err = credsGetter.ObtainAndUpdateEnvIfNecessary(
+		mergedIAM := iam.MergeRoleOptions(remoteStateTGConfig.GetIAMRoleOptions(), pctx.OriginalIAMRoleOptions)
+		if err = creds.NewGetter().ObtainAndUpdateEnvIfNecessary(
 			ctx,
 			l,
 			pctx.Env,
 			externalcmd.NewProvider(l, pctx.AuthProviderCmd, shellRunOptsFromPctx(pctx)),
+			amazonsts.NewProvider(l, mergedIAM, pctx.Env),
 		); err != nil {
 			return nil, err
 		}
@@ -1066,8 +1067,6 @@ func getTerragruntOutputJSON(ctx context.Context, pctx *ParsingContext, l log.Lo
 			pctx,
 			l,
 			workingDir,
-			remoteStateTGConfig.GetIAMRoleOptions(),
-			credsGetter,
 		)
 	}
 
@@ -1120,28 +1119,17 @@ func terragruntAlreadyInit(ctx context.Context, l log.Logger, pctx *ParsingConte
 }
 
 // getTerragruntOutputJSONFromInitFolder will retrieve the outputs directly from the module's working directory without
-// running init.
+// running init. Callers must populate pctx.Env with auth-provider-cmd credentials and any
+// TG_IAM_ROLE assumption beforehand.
 func getTerragruntOutputJSONFromInitFolder(
 	ctx context.Context,
 	pctx *ParsingContext,
 	l log.Logger,
 	terraformWorkingDir string,
-	iamRoleOpts iam.RoleOptions,
-	credsGetter *creds.Getter,
 ) ([]byte, error) {
 	targetConfigPath := pctx.TerragruntConfigPath
 
-	tfRunOpts, err := setupTFRunOptsForBareTerraform(
-		ctx,
-		pctx,
-		l,
-		terraformWorkingDir,
-		iamRoleOpts,
-		credsGetter,
-	)
-	if err != nil {
-		return nil, err
-	}
+	tfRunOpts := setupTFRunOptsForBareTerraform(pctx, terraformWorkingDir)
 
 	l.Debugf(
 		"Unit '%s' is already init-ed. "+
@@ -1216,27 +1204,18 @@ func getTerragruntOutputJSONFromRemoteState(
 
 	l.Debugf("Setting dependency working directory to %s", tempWorkDir)
 
-	credsGetter := creds.NewGetter()
-	if err = credsGetter.ObtainAndUpdateEnvIfNecessary(
+	mergedIAM := iam.MergeRoleOptions(iamRoleOpts, pctx.OriginalIAMRoleOptions)
+	if err = creds.NewGetter().ObtainAndUpdateEnvIfNecessary(
 		ctx,
 		l,
 		pctx.Env,
 		externalcmd.NewProvider(l, pctx.AuthProviderCmd, shellRunOptsFromPctx(pctx)),
+		amazonsts.NewProvider(l, mergedIAM, pctx.Env),
 	); err != nil {
 		return nil, err
 	}
 
-	tfRunOpts, err := setupTFRunOptsForBareTerraform(
-		ctx,
-		pctx,
-		l,
-		tempWorkDir,
-		iamRoleOpts,
-		credsGetter,
-	)
-	if err != nil {
-		return nil, err
-	}
+	tfRunOpts := setupTFRunOptsForBareTerraform(pctx, tempWorkDir)
 
 	// To speed up dependencies processing it is possible to retrieve its output directly from the backend without init dependencies
 	if pctx.Experiments.Evaluate(experiment.DependencyFetchOutputFromState) && !pctx.NoDependencyFetchOutputFromState {
@@ -1361,38 +1340,20 @@ func getTerragruntOutputJSONFromRemoteStateS3(ctx context.Context, l log.Logger,
 	return jsonOutputs, nil
 }
 
-// setupTFRunOptsForBareTerraform builds a *tf.RunOptions that can be used to run terraform
-// without going through the full RunTerragrunt operation. It merges IAM roles and obtains
-// credentials inline.
-func setupTFRunOptsForBareTerraform(
-	ctx context.Context,
-	pctx *ParsingContext,
-	l log.Logger,
-	workingDir string,
-	iamRoleOpts iam.RoleOptions,
-	credsGetter *creds.Getter,
-) (*tf.TFOptions, error) {
-	// Merge IAM options
-	mergedIAM := iam.MergeRoleOptions(iamRoleOpts, pctx.OriginalIAMRoleOptions)
-
-	// Build shell.RunOptions for this specific working dir with io.Discard as writer
+// setupTFRunOptsForBareTerraform builds a *tf.TFOptions for running terraform without
+// going through the full RunTerragrunt operation. Callers must obtain credentials
+// (auth-provider-cmd and any TG_IAM_ROLE assumption) before invoking, so those steps
+// run from the unit's directory rather than the bare-terraform working directory.
+func setupTFRunOptsForBareTerraform(pctx *ParsingContext, workingDir string) *tf.TFOptions {
 	shellOpts := shellRunOptsFromPctx(pctx)
 	shellOpts.WorkingDir = workingDir
 	shellOpts.Writers.Writer = io.Discard
 
-	// Make sure to assume any roles set by TG_IAM_ROLE
-	if err := credsGetter.ObtainAndUpdateEnvIfNecessary(ctx, l, pctx.Env,
-		externalcmd.NewProvider(l, pctx.AuthProviderCmd, shellOpts),
-		amazonsts.NewProvider(l, mergedIAM, pctx.Env),
-	); err != nil {
-		return nil, err
-	}
-
 	return &tf.TFOptions{
 		JSONLogFormat:                pctx.JSONLogFormat,
 		OriginalTerragruntConfigPath: pctx.OriginalTerragruntConfigPath,
 		ShellOptions:                 shellOpts,
-	}, nil
+	}
 }
 
 // runTerragruntOutputJSON uses terragrunt running functions to extract the json output from the target config.

test/fixtures/auth-provider-cmd/run-all-call-count/.gitignore

@@ -0,0 +1 @@
+*.jsonl

test/fixtures/auth-provider-cmd/run-all-call-count/auth-provider.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+# Records each invocation as a JSON line in calls.jsonl in this script's
+# directory. Tests read calls.jsonl to assert how many times the
+# --auth-provider-cmd was invoked and the working directory of each call.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LOG_FILE="${SCRIPT_DIR}/calls.jsonl"
+
+# JSON escape: replace backslash and double-quote.
+escaped_pwd="${PWD//\\/\\\\}"
+escaped_pwd="${escaped_pwd//\"/\\\"}"
+
+ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+printf '{"ts":"%s","working_dir":"%s","pid":%d}\n' "$ts" "$escaped_pwd" "$$" >>"$LOG_FILE"
+
+printf '{"envs":{"AUTH_PROVIDER_CALL_COUNT_VAR":"ok"}}\n'

test/fixtures/auth-provider-cmd/run-all-call-count/dep/main.tf

@@ -0,0 +1,7 @@
+variable "name" {
+  type = string
+}
+
+output "value" {
+  value = "from-${var.name}"
+}

test/fixtures/auth-provider-cmd/run-all-call-count/dep/terragrunt.hcl

@@ -0,0 +1,7 @@
+include {
+  path = find_in_parent_folders("root.hcl")
+}
+
+inputs = {
+  name = "dep"
+}

test/fixtures/auth-provider-cmd/run-all-call-count/dependent/main.tf

@@ -0,0 +1,7 @@
+variable "upstream" {
+  type = string
+}
+
+output "value" {
+  value = var.upstream
+}

test/fixtures/auth-provider-cmd/run-all-call-count/dependent/terragrunt.hcl

@@ -0,0 +1,11 @@
+include {
+  path = find_in_parent_folders("root.hcl")
+}
+
+dependency "dep" {
+  config_path = "../dep"
+}
+
+inputs = {
+  upstream = dependency.dep.outputs.value
+}

test/fixtures/auth-provider-cmd/run-all-call-count/root.hcl

@@ -0,0 +1,10 @@
+remote_state {
+  backend = "local"
+  generate = {
+    path      = "backend.tf"
+    if_exists = "overwrite_terragrunt"
+  }
+  config = {
+    path = "${path_relative_to_include()}/terraform.tfstate"
+  }
+}

test/integration_test.go

@@ -3307,6 +3307,66 @@ func TestReadTerragruntAuthProviderCmdEnvInLocalsRunAll(t *testing.T) {
 	assert.Equal(t, "from-auth-provider", outputs["secret"].Value)
 }
 
+func TestReadTerragruntAuthProviderCmdRunAllCallCountWithRacing(t *testing.T) {
+	t.Parallel()
+
+	helpers.CleanupTerraformFolder(t, testFixtureAuthProviderCmd)
+	tmpEnvPath := helpers.CopyEnvironment(t, testFixtureAuthProviderCmd)
+	rootPath := filepath.Join(tmpEnvPath, testFixtureAuthProviderCmd, "run-all-call-count")
+	authProviderCmd := filepath.Join(rootPath, "auth-provider.sh")
+	logPath := filepath.Join(rootPath, "calls.jsonl")
+
+	helpers.ValidateAuthProviderScript(t, rootPath, authProviderCmd)
+	require.NoError(t, os.Remove(logPath), "auth-provider.sh should have created %s", logPath)
+
+	helpers.RunTerragrunt(
+		t,
+		fmt.Sprintf(
+			"terragrunt run --all apply --non-interactive "+
+				"--working-dir %s --auth-provider-cmd %s",
+			rootPath,
+			authProviderCmd,
+		),
+	)
+
+	logBytes, err := os.ReadFile(logPath)
+	require.NoError(t, err)
+
+	type authCall struct {
+		Timestamp  string `json:"ts"`
+		WorkingDir string `json:"working_dir"`
+		PID        int    `json:"pid"`
+	}
+
+	lines := strings.Split(strings.TrimRight(string(logBytes), "\n"), "\n")
+	calls := make([]authCall, 0, len(lines))
+
+	for i, line := range lines {
+		var call authCall
+
+		require.NoErrorf(t, json.Unmarshal([]byte(line), &call), "line %d: %q", i+1, line)
+
+		calls = append(calls, call)
+	}
+
+	t.Logf("auth-provider-cmd invocations:\n%s", string(logBytes))
+
+	// Five invocations are expected, in this order:
+	//
+	//   1. Discovery relationship phase parses `dep`.
+	//   2. Discovery relationship phase parses `dependent`.
+	//   3. Runner pool task parses `dep`for apply.
+	//   4. Runner pool task parses `dependent` for apply.
+	//   5. While `dependent`'s HCL is being decoded, the `dependency.dep`
+	//      block fetches `dep`'s outputs, which requires parsing `dep` again.
+	//
+	assert.Len(t, calls, 5)
+
+	for _, call := range calls {
+		assert.NotContains(t, call.WorkingDir, ".terragrunt-cache")
+	}
+}
+
 func TestIamRolesLoadingFromDifferentModules(t *testing.T) {
 	t.Parallel()