title: "Error refreshing state: AccessDenied: Access Denied status code: 403" when using Okta SSO to perform terraform init/plan/apply. Can be fixed?
body: <p>I am building some resources in 1 AWS account with terraform, but I am storing terraform state remotely on another AWS account.</p>
  <p>Example of terraform code:</p>
  <pre><code>provider &quot;aws&quot; {
    region  = &quot;us-east-1&quot;
    profile = &quot;AWS account 1&quot;
  }
  terraform {
  
    backend &quot;s3&quot; {
      bucket         = &quot;bucket name&quot;
      region         = &quot;us-east-1&quot;
      key            = &quot;terraform.tfstate&quot;
      dynamodb_table = &quot;locks&quot;
      profile = &quot;AWS account 2&quot;
    }
  
  }
  </code></pre>
  <p>with .aws/credentials</p>
  <pre><code>[AWS account 1]
  aws_access_key_id=33333333333333
  aws_secret_access_key=44444444444444444444
  
  [AWS account 2]
  aws_access_key_id=111111111111
  aws_secret_access_key=22222222222222222222
  </code></pre>
  <p>When I am NOT using SSO to login to AWS and just using access and secret keys in .aws/credentials everything worked fine.</p>
  <p>However, when I change to login into AWS with SSO and assume roles, things got ugly with .aws/config (with sso .aws/config should be used)</p>
  <pre><code>—
  [okta]
  aws_saml_url = [some aws_saml_url]
  
  [profile AWS account 1-umbrella]
  role_arn = arn:aws:iam::[some accountID]:role/[some role_name]
  region = us-west-1
  
  [profile AWS account 1]
  role_arn = arn:aws:iam::[some accountID]:role/[some role_name]
  source_profile = AWS account 1-umbrella
  region = us-west-1
  
  [profile AWS account 2-umbrella]
  role_arn = arn:aws:iam::[some accountID]:role/[some role_name]
  region = us-west-1
  
  [profile AWS account 2]
  role_arn = arn:aws:iam::[some accountID]:role/[some role_name]
  source_profile = AWS account 1-umbrella
  region = us-west-1
  
  </code></pre>
  <p>I am getting error &quot;Error refreshing state: AccessDenied: Access Denied status code: 403&quot;.
  or I am getting &quot;Error: error configuring S3 Backend: Error creating AWS session: SharedConfigAssumeRoleError: failed to load assume role for arn:aws:iam::[some account id]:role/[some role name], source profile AWS account 1-umbrella has no shared credentials&quot;</p>
  <p>Does anyone has any ideas how I can fix this?</p>