From 245d53e4b62c2fe7e07e86767f71c42c11b7586b Mon Sep 17 00:00:00 2001
From: jrhoads <jrhoads@datacite.org>
Date: Fri, 4 Sep 2026 16:33:15 +0200
Subject: [PATCH] fix(profiles): pass service account credentials to task
 template

---
 stage/services/profiles/input.tf      | 2 ++
 stage/services/profiles/profiles.json | 4 ++--
 stage/services/profiles/var.tf        | 2 ++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/stage/services/profiles/input.tf b/stage/services/profiles/input.tf
index ef03dc3ef..ef6a5bf6a 100644
--- a/stage/services/profiles/input.tf
+++ b/stage/services/profiles/input.tf
@@ -106,5 +106,7 @@ data "template_file" "profiles_task" {
     es_prefix          = var.es_prefix
     elastic_password   = var.elastic_password
     version            = var.volpino_tags["sha"]
+    aws_service_account_key = var.aws_service_account_key
+    aws_service_account_secret = var.aws_service_account_secret
   }
 }
diff --git a/stage/services/profiles/profiles.json b/stage/services/profiles/profiles.json
index ce75a0b71..24a31cc66 100644
--- a/stage/services/profiles/profiles.json
+++ b/stage/services/profiles/profiles.json
@@ -187,11 +187,11 @@
     },
     {
       "name": "AWS_ACCESS_KEY_ID",
-      "value": "${access_key}"
+      "value": "${aws_service_account_key}"
     },
     {
       "name": "AWS_SECRET_ACCESS_KEY",
-      "value": "${secret_key}"
+      "value": "${aws_service_account_secret}"
     },
     {
       "name": "AWS_REGION",
diff --git a/stage/services/profiles/var.tf b/stage/services/profiles/var.tf
index 059a0cc8e..1ceb44546 100644
--- a/stage/services/profiles/var.tf
+++ b/stage/services/profiles/var.tf
@@ -105,3 +105,5 @@ variable "es_prefix" {
   default = "stage"
 }
 variable "elastic_password" {}
+variable "aws_service_account_key" {}
+variable "aws_service_account_secret" {}