Open DanielOved93 opened 1 month ago
Thank you for raising this issue.
A few questions on this.
aws sts get-caller-identity
? by default, it should already call regional endpoint since you are using version 2.--endpoint-url
flag? --profile
been passed with the profile also had its region set through aws configure
? (one way to find out is to look into ~/.aws/configThe support engineer suggested that this might be an issue with the saml2aws tool itself, as it seems to be configured to use Global STS endpoints despite the environment variables being set to use regional endpoints.
Quite possible, though I haven't had the time yet to look deeper into the code to give a definite answer. We are calling STS to obtain the credentials and it could be calling from global STS since it could be ignoring the env variables.
Thank you for your response.
aws sts get-caller-identity
, it correctly utilizes regional endpoints by default, as expected with the AWS CLI versions I tested. I have verified this behavior and can confirm it consistently uses regional endpoints.--endpoint-url
flag with aws sts get-caller-identity
, and it consistently behaves with the default regional endpoint for the respective regions (il-central-1
and ap-southeast-4
).
aws sts get-caller-identity --profile TEST --region il-central-1 --endpoint-url=https://sts.il-central-1.amazonaws.com
An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid
4. The AWS profile used with `saml2aws` has its region explicitly set through aws configure. I confirmed this by checking the `~/.aws/credentials` file, which correctly reflects the regional configuration for the profiles used. I also tried running `saml2aws` without setting the region in the configuration and attempted to specify the region in the AWS CLI using the `--region` flag or the `AWS_DEFAULT_REGION` environment variable, I also tried to set the region in the `.saml2aws` config file, but encountered the same behavior.
- Regarding the suspicion that `saml2aws` might be ignoring environment variables for regional endpoints:
Based on these tests, it appears that `saml2aws` may indeed be disregarding the environment variables (`AWS_DEFAULT_REGION` and `AWS_STS_REGIONAL_ENDPOINTS`) intended to enforce the use of regional STS endpoints. Despite setting these variables appropriately, the tool continues to exhibit behavior where it does not access regional STS endpoints in opt-in regions such as `il-central-1` and `ap-southeast-4`.
Hello, I am encountering an issue when using the
saml2aws
CLI tool to call AWS APIs in the opt-in regionil-central-1
(Tel Aviv) orap-southeast-4
(Melbourne) . The error message received is:Steps to Reproduce:
saml2aws
as per the instructions on the GitHub page.saml2aws login --force
to generate new credentials.il-central-1
orap-southeast-4
region. usingaws sts get-caller-identity
.Expected Behavior:
The saml2aws CLI tool should be able to call AWS APIs in the
il-central-1
orap-southeast-4
regions (or another opt-in region) using regional STS endpoints without any errors.Actual Behavior
The tool fails with the error:
No
AssumeRoleWithSAML
events are logged in CloudTrail for theil-central-1
orap-southeast-4
regions, indicating that the STS endpoints (sts.il-central-1.amazonaws.com or sts.ap-southeast-4.amazonaws.com) are not being reached. However, calling AWS APIs using the AWS CLI with IAM Role from an EC2 instance in the same regions works correctly with no issues.Environment
Additional Information
I have confirmed that the configuration is correct as per the GitHub instructions. Using
saml2aws
works in default regions likeus-east-1
oreu-west-1
, but fails in the opt-in regions likeil-central-1
andap-southeast-4
. The same environment variables and credentials work with the AWS CLI in these regions.Support Case Details
I have opened a support case with AWS Premium Support. The support engineer suggested that this might be an issue with the saml2aws tool itself, as it seems to be configured to use Global STS endpoints despite the environment variables being set to use regional endpoints.
Request
Could you please investigate this issue and provide a fix or workaround to allow
saml2aws
to work with regional STS endpoints in opt-in regions likeil-central-1
andap-southeast-4
?Thank you for your assistance!