search

lyft / metadataproxy

A proxy for AWS's metadata service that gives out scoped IAM credentials from STS
Other
456 stars 69 forks source link

STS regional endpoints support #107

Closed ystarikovich closed 3 years ago

ystarikovich commented 3 years ago

We faced very nasty STS issue with metadata proxy.

One of our production regions is located in the ap-southeast-1 and by default boto3 is trying to global STS endpoint which is located in the us-east-1 region. Latency for this requests dramatically decreased within last one and half months and we started to reach timeouts for AWS SDK Credential Provider calls.

Override default endpoint url via environment variable is not an option due to this issue https://github.com/boto/boto3/issues/2099.

Within this PR I've added new env variable for the metadata proxy to be able to support regional STS endpoint and be fully backward compatible to the previous version.

This solved our issue with latency and I believe this can be useful for the community. Would appreciate for the quick response as we would prefer to use official version instead of in-house built feature branch version.

Thanks in advance.

ystarikovich commented 3 years ago

@ryan-lane Is there chance to find someone who can merge it? You are the main contributor to this project :)

JeanFred commented 3 years ago

CC-ing @skiptomyliu, @danielmmetz and @dschaller who merged the last PRs :) Would there be any concern with merging this?

JeanFred commented 3 years ago

Thanks @skiptomyliu !