onboarding: auto-detect AWS account alias instead of relying on backend discovery

[airadier]

Problem

When onboarding an AWS account using the modules/onboarding submodule, the provider_alias field on sysdig_secure_cloud_auth_account defaults to an empty string unless the caller explicitly passes account_alias. This results in the account appearing without a human-readable name in the Sysdig UI.

Observed behavior

We onboarded AWS account 511247157284 (which has the IAM account alias se-demo-prod-west) using the module at version 4.0.0. After the apply completed successfully, the account appears in Sysdig with an empty alias.

However, another AWS account (845151661675) that was onboarded a few weeks ago using the same module and configuration does show the correct alias in the Sysdig UI.

This raises the question: does the Sysdig backend eventually auto-discover the alias using the onboarding IAM role (which includes iam:ListAccountAliases permission)? If so, it's unclear how long this takes, and there's no documentation about this behavior.

Current module code

In modules/onboarding/main.tf:

resource "sysdig_secure_cloud_auth_account" "cloud_auth_account" {
  provider_alias = var.account_alias  # defaults to ""
  ...
}

The onboarding IAM role policy includes iam:ListAccountAliases, suggesting the backend uses this permission to discover the alias asynchronously. But relying on async backend discovery has drawbacks:

• The alias is empty immediately after onboarding (poor UX)
• It's unclear if/when the backend will populate it
• There's no way to know if the empty alias is a bug or just "not yet discovered"

Proposed Solution

The module already uses data.aws_caller_identity.current to get the account ID. It could similarly use data.aws_iam_account_alias to auto-detect the alias at apply time:

data "aws_iam_account_alias" "current" {}

resource "sysdig_secure_cloud_auth_account" "cloud_auth_account" {
  provider_alias = var.account_alias != "" ? var.account_alias : try(data.aws_iam_account_alias.current.account_alias, "")
  ...
}

This would:

• Set the alias immediately during onboarding (no waiting for backend discovery)
• Still allow explicit override via var.account_alias
• Gracefully fall back to empty string if the AWS account has no alias configured

Environment

• Module version: 4.0.0
• Sysdig provider version: 1.60.0
• Terraform version: 1.x