Terragrunt's sops_decrypt_file() does not work with GOOGLE_CREDENTIALS environment variable

[maciekTree]

Hi
We use GOOGLE_CREDENTIALS with the service account's private key in our CI to authenticate with GCP. Recently, we decided to add sops_decrypt_file() to our CI to pass some credentials down to the module which is supposed to work with GOOGLE_CREDENTIALS according to this PR but we are consistently getting:

Call to function "sops_decrypt_file" failed: Error getting data key: 0 successful groups required, got 0.

We are running sops v3.7.3. I was able to reproduce this error on my local with a dummy Terragrunt/Terraform module and only GOOGLE_CREDENTIALS set.
Binary sops --decrypt secretsfile.yaml works fine. Only sops_decrypt_file() doesn't.

The very same Terragrunt/Terraform configuration works fine when using application default credentials.

Does sops_decrypt_file() work with GOOGLE_CREDENTIALS?

Terraform v1.3.9
terragrunt version v0.44.0
sops 3.7.3 (latest)

[maciekTree]

Would anyone be able to look at this? I can see GOOGLE_CREDENTIALS have been added in #907 a long time ago. Is there a chance sops_decrypt_file() is not using them correctly?

[Tensho]

We have the same problem, it blocks us from using GCP federated authentication in CircleCI.

[phandox]

Bychecking the go.mod I see that terragrunt uses sops v3.7.2 but the feature in mentioned PR is in v3.7.3 (

terragrunt/go.mod

Line 32 in d185ed9

go.mozilla.org/sops/v3 v3.7.2

). Can we bump up the sops library used by Terragrunt?