feat: support a custom STS endpoint for AWS-API-compatible services - #90
Open
karcaw wants to merge 1 commit into
Open
feat: support a custom STS endpoint for AWS-API-compatible services#90karcaw wants to merge 1 commit into
karcaw wants to merge 1 commit into
Conversation
Adds sts_endpoint and aws_region config keys. When sts_endpoint is set, both the OIDC (AssumeRoleWithWebIdentity) and SAML (AssumeRoleWithSAML) code paths target that URL via a new shared newSTSConfig() helper, instead of always hitting sts.amazonaws.com. If aws_region is left blank but an endpoint is set, region defaults to us-east-1, since the SDK still needs some region string to sign requests even for services with no real AWS regions. Needed to get credentials from non-AWS STS-compatible services (e.g. VAST Data's S3 federation). Also bundles the pieces that only make sense once a custom endpoint exists: - insecure_skip_verify (already used for the OIDC provider's HTTP client) is now honored for the STS client's transport too, but only when sts_endpoint is set - real AWS STS is never affected. Needed for internal/self-signed AWS-API-compatible endpoints where the certificate doesn't validate cleanly. - A new -v/--debug flag wires the existing (previously hardcoded-off) log.IsTraceEnabled switch, turning on the AWS SDK's own request/response body logging for STS calls (routed through the same trace logger) plus a new traceSTSError() helper that unwraps a failed call's smithy.APIError (code/message/fault) and HTTP status - detail the default error string can otherwise collapse into one line. Useful for debugging exactly the kind of endpoint/TLS/role issues a custom STS target introduces. - Setup wizard prompts for sts_endpoint and aws_region, so they can be configured through `aws-cli-oidc setup` instead of only by hand-editing config.yaml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds sts_endpoint and aws_region config keys. When sts_endpoint is set, both the OIDC (AssumeRoleWithWebIdentity) and SAML (AssumeRoleWithSAML) code paths target that URL via a new shared newSTSConfig() helper, instead of always hitting sts.amazonaws.com. If aws_region is left blank but an endpoint is set, region defaults to us-east-1, since the SDK still needs some region string to sign requests even for services with no real AWS regions. Needed to get credentials from non-AWS STS-compatible services (e.g. VAST Data's S3 federation).
Also bundles the pieces that only make sense once a custom endpoint exists:
insecure_skip_verify (already used for the OIDC provider's HTTP client) is now honored for the STS client's transport too, but only when sts_endpoint is set - real AWS STS is never affected. Needed for internal/self-signed AWS-API-compatible endpoints where the certificate doesn't validate cleanly.
A new -v/--debug flag wires the existing (previously hardcoded-off) log.IsTraceEnabled switch, turning on the AWS SDK's own request/response body logging for STS calls (routed through the same trace logger) plus a new traceSTSError() helper that unwraps a failed call's smithy.APIError (code/message/fault) and HTTP status - detail the default error string can otherwise collapse into one line. Useful for debugging exactly the kind of endpoint/TLS/role issues a custom STS target introduces.
Setup wizard prompts for sts_endpoint and aws_region, so they can be configured through
aws-cli-oidc setupinstead of only by hand-editing config.yaml.