Fix STS Signature does not match non us-east-1#194
Conversation
There was a problem hiding this comment.
Pull request overview
This PR addresses AWS STS SignatureDoesNotMatch failures when Vault and the Lambda function are in different regions by changing the IAM auth payload signing behavior to default to the global STS endpoint (sts.amazonaws.com) and us-east-1 signing region.
Changes:
- Default IAM auth payload signing to the global STS endpoint and
us-east-1signing region unless a custom STS endpoint is configured. - Remove prior behavior that adjusted the assumed-role AWS config region based on
STSEndpointRegion. - Add/adjust unit tests to assert the new default signing behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| internal/vault/client.go | Updates IAM auth payload signing to prefer global STS endpoint/us-east-1, and adjusts endpoint/region selection logic. |
| internal/vault/client_test.go | Adds a new test for the global endpoint default path and updates an existing assertion to expect us-east-1 signing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
bcsamrudh
changed the title
|
|
563ac5d to
140a962
Compare
Balaji2198
left a comment
Balaji2198
left a comment
There was a problem hiding this comment.
Thanks for working on this. Provided few comments.
| // TestToken_RegionalSTSEndpointWithoutBaseEndpoint verifies that when STSEndpointRegion | ||
| // is set without BaseEndpoint (matching production config), the regional endpoint is used | ||
| // and requests are signed for the correct region. | ||
| func TestToken_RegionalSTSEndpointWithoutBaseEndpoint(t *testing.T) { |
There was a problem hiding this comment.
Can we add a test case to cover the behavior when opts.BaseEndpoint is set? It'd be great to verify that custom endpoints resolve and sign correctly.
|
|
||
| return u.String(), nil | ||
| signingRegion = region | ||
| if authOpts, ok := smithyauth.GetAuthOptions(&endpoint.Properties); ok { |
There was a problem hiding this comment.
Can we add an unit test where GetAuthOptions returns false when endpoint.Properties is missing? This will help ensure the signingRegion fallback to opts.Region works as expected and won't break in the future.
Jira: https://hashicorp.atlassian.net/browse/VAULT-46705
Description:
Lambda function using vault-lambda-extension with AWS SDK V2 crashes when vault and lambda function are in a region other than
us-east-1and also if vault and lambda function are in different regions.Testing Evidence:
Note :
use_sts_region_from_client=falsei.eVAULT_STS_ENDPOINT_REGIONis not usedCase 1 : Vault and lambda in different region :
Vault is running in
ap-southeast-1and Lambda Function is inap-southeast-2Creating Vault server in
ap-southeast-1and lambda function inap-southeast-2via terraform:Result of lambda invoke:
This case was also tested using HCP where Vault cluster was in
us-west-2and lambda function inap-south-1Case 2: Both vault and lambda in same region other than us-east-1:
Both the Vault and Lambda Function are in
eu-central-1Creating Vault server and Lambda in
eu-central-1via terraformResult of Lambda invoke
