Terraform AWS not accessing localstack

Question

I'm having trouble getting a terraform AWS provider to talk to localstack . Whatever I try I just get the same error:

Error: error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid.
    status code: 403, request id: dc96c65d-84a7-4e64-947d-833195464538

This error suggest that the provider is making contact with a HTTP server but the credentials are being rejected (as per any 403 ). You might imagine the problem is that I'm feeding in the wrong credentials (through environment variables).

However the hostname local-aws exists in my /etc/hosts file, but blahblahblah does not. If I swap the endpoint to point to http://blahblahblah:4566 I still get the same 403. So I think the problem is that the provider isn't using my local endpoint. I can't work out why.

resource "aws_secretsmanager_secret_version" "foo" {
  secret_id = aws_secretsmanager_secret.foo.id
  secret_string = "bar"
}

resource "aws_secretsmanager_secret" "foo" {
    name = "rabbitmq_battery_emulator"
}

provider "aws" {
  region = "eu-west-2"
  endpoints {
    secretsmanager = "http://local-aws:4566"
  }
}

Answer 1

I'm having trouble getting a terraform AWS provider to talk to localstack . Whatever I try I just get the same error:

Error: error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid.
    status code: 403, request id: dc96c65d-84a7-4e64-947d-833195464538

This error suggest that the provider is making contact with a HTTP server but the credentials are being rejected (as per any 403 ). You might imagine the problem is that I'm feeding in the wrong credentials (through environment variables).

However the hostname local-aws exists in my /etc/hosts file, but blahblahblah does not. If I swap the endpoint to point to http://blahblahblah:4566 I still get the same 403. So I think the problem is that the provider isn't using my local endpoint. I can't work out why.

resource "aws_secretsmanager_secret_version" "foo" {
  secret_id = aws_secretsmanager_secret.foo.id
  secret_string = "bar"
}

resource "aws_secretsmanager_secret" "foo" {
    name = "rabbitmq_battery_emulator"
}

provider "aws" {
  region = "eu-west-2"
  endpoints {
    secretsmanager = "http://local-aws:4566"
  }
}

Answer 2

In addition to the SERVICES and sts endpoint config mentioned by @philip-couling, I also had to remove a terraform block from my main.tf:

#terraform {
#  backend "s3" {
#    bucket = "valid-bucket"
#    key    = "terraform/state/account/terraform.tfstate"
#    region = "eu-west-1"
#  }
#  required_providers {
#    local = {
#      version = "~> 2.1"
#    }
#  }
#}