Skip to content

Conversation

@windmgc
Copy link
Member

@windmgc windmgc commented Jul 24, 2024

Summary

This PR fixes the STS regional injection logic under the following cases:

  • When AWS_STS_REGIONAL_ENDPOINTS is regional, the service.signingRegion must be the same as the current environment's region, instead of the globalSSL's us-east-1 region defined in the global region rule. This ensures that the API request sent to the regional STS endpoint has the correct signature.
  • When AWS_STS_REGIONAL_ENDPOINTS is regional and user defines the same regional STS domain(for example, sts.us-east-2.amazonaws.com), ensures that the region is not being injected again inside the regional STS domain.

This PR also adds unit tests to ensure the region is defined correctly in the signed request and the endpoint is also expected under several combinations of region, AWS_STS_REGIONAL_ENDPOINTS and user-defined endpoint config.

KAG-5021

@github-actions
Copy link

github-actions bot commented Jul 24, 2024

Luacheck Report

2 tests   2 ✅  0s ⏱️
1 suites  0 💤
1 files    0 ❌

Results for commit 8286243.

♻️ This comment has been updated with latest results.

@windmgc windmgc requested a review from Tieske July 24, 2024 07:25
@windmgc windmgc merged commit 43c8503 into main Jul 29, 2024
@windmgc windmgc deleted the fix-sts-region-inject branch July 29, 2024 08:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants