RanVaknin
commented
5 months ago Hi @gdavison ,
Thanks for reaching out. You can pass in WithAssumeRoleCredentialOptions to your config, create an new sts client internally and assign it a new config options that disable fips. Something like this:
package main
import (
"context"
"fmt"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/config"
"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
"github.com/aws/aws-sdk-go-v2/service/sts"
"os"
)
func main() {
ctx := context.Background()
os.Setenv("AWS_USE_FIPS_ENDPOINT", "true")
os.Setenv("AWS_ENDPOINT_URL_STS", "https://sts.ca-central-1.amazonaws.com/")
os.Setenv("AWS_REGION", "ca-central-1")
os.Setenv("AWS_PROFILE", "assume-role")
cfg, err := config.LoadDefaultConfig(ctx,
config.WithRegion("ca-central-1"),
config.WithAssumeRoleCredentialOptions(func(o *stscreds.AssumeRoleOptions) {
secondCfg, err := config.LoadDefaultConfig(
context.TODO(),
config.WithRegion("ca-central-1"),
config.WithClientLogMode(aws.LogRequestWithBody),
config.WithUseFIPSEndpoint(aws.FIPSEndpointStateDisabled),
)
if err != nil {
panic(err)
}
o.Client = sts.NewFromConfig(secondCfg)
}),
)
if err != nil {
panic(err)
}
_, err = cfg.Credentials.Retrieve(ctx)
if err != nil {
panic(err)
}
fmt.Println("Success.")
}let me know if this helps.
Thanks, Ran~
github-actions[bot]
tmccombs
gdavison
lucix-aws
Acknowledgements
go get -u github.com/aws/aws-sdk-go-v2/...)Describe the bug
When
config.LoadDefaultConfig),UseFIPSEndpointtotrue, andca-central-1)resolving credentials fails with the error
When overriding the endpoint, as suggested in the AWS CLI documentation, it fails with the error
Expected Behavior
Based on previous discussion (https://github.com/aws/aws-sdk-go-v2/issues/2336#issuecomment-1781797308), the first failure is expected.
When providing a custom endpoint, the
UseFIPSEndpoint(andUseDualStackEndpoint) flags should be cleared so that the endpoint can be used.Current Behavior
Because
config.LoadDefaultConfigcreates its own STS client internally, there is no way to clear theUseFIPSEndpointsetting when also using a custom endpoint.Using a global
aws.EndpointResolverWithOptionsdoes work to set the endpoint without theInvalid Configuration: FIPS and custom endpoint are not supportederror, butaws.EndpointResolverWithOptionsis now deprecated. It also doesn't directly support setting endpoints via environment variables or the shared configuration file.Note that the AWS CLI also fails in this situation:
fails with
Reproduction Steps
package main
The config file
Possible Solution
No response
Additional Information/Context
No response
AWS Go SDK V2 Module Versions Used
require github.com/aws/aws-sdk-go-v2/config v1.27.19
require ( github.com/aws/aws-sdk-go-v2 v1.28.0 // indirect github.com/aws/aws-sdk-go-v2/credentials v1.17.19 // indirect github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.6 // indirect github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.10 // indirect github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.10 // indirect github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.12 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.20.12 // indirect github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.6 // indirect github.com/aws/aws-sdk-go-v2/service/sts v1.28.13 // indirect github.com/aws/smithy-go v1.20.2 // indirect )
Compiler and Version used
go version go1.22.1 darwin/arm64
Operating System and version
macOS 13.6.7