[Bug]: Could not connect to the endpoint URL: "https://sts.us-east.amazonaws.com/"

[fgont]

What happened?

Installed prowler, configured aws credendials, but when running it as prowler aws

I got:

                         _
 _ __  _ __ _____      _| | ___ _ __
| '_ \| '__/ _ \ \ /\ / / |/ _ \ '__|
| |_) | | | (_) \ V  V /| |  __/ |
| .__/|_|  \___/ \_/\_/ |_|\___|_|v3.0.1
|_| the handy cloud security tool

Date: 2023-01-04 16:04:26

2023-01-04 16:04:37,934 [File: audit_info.py:30]    [Module: audit_info]     CRITICAL: EndpointConnectionError -- Could not connect to the endpoint URL: "https://sts.us-east.amazonaws.com/"`

How to reproduce it Steps to reproduce the behavior:

1. What command are you running?

prowler aws

3. Cloud provider you are launching

aws

4. Environment you have like single account, multi-account, organizations, multi or single subsctiption, etc.

organization

5. See error

2023-01-04 16:04:37,934 [File: audit_info.py:30] [Module: audit_info] CRITICAL: EndpointConnectionError -- Could not connect to the endpoint URL: "https://sts.us-east.amazonaws.com/"

Note: that domain name no longer resolves to any IP address.

Expected behavior

Screenshots or Logs If applicable, add screenshots to help explain your problem. Also, you can add logs (anonymize them first!). Here a command that may help to share a log prowler <your arguments> --log-level DEBUG --log-file $(date +%F)_debug.log then attach here the log file.

(there seem to be other instances in the code of names that do not resolve to IP addresses)

From where are you running Prowler? Please, complete the following information:

• Resource: (e.g. EC2 instance, Fargate task, Docker container manually, EKS, Cloud9, CodeBuild, workstation, etc.)

VM instance (neither AWS nor GCP)

• OS: [e.g. Amazon Linux 2, Mac, Alpine, Windows, etc. ]

"Ubuntu 22.04.1 LTS"

• Prowler Version [./prowler --version]:

Prowler 3.0.1

• Python version [python --version]:

python3 --version Python 3.10.6

• Pip version [pip --version]: pip --version pip 22.0.2 from /usr/lib/python3/dist-packages/pip (python 3.10)

• Installation method (Are you running it from pip package or cloning the github repo?):

pip package

• Others:

Additional context Add any other context about the problem here.

[toniblyx]

Thanks for reporting this to us. That seems too weird because there is not such an endpoint like sts.us-east.amazonaws.com. us-east is not a valid region actually. Can you see if you have anything wrong in your AWS configuration?

1. First I would try with prowler aws --region us-east-1 if that works means your AWS configuration is not correct.
2. I would review all my environment variables and configuration related to AWS doing env | grep AWS or echo $AWS_STS_REGIONAL_ENDPOINTS or looking at ~/.aws/config and ~/.aws/credentials.

Please, let us know what you both get.

[toniblyx]

We are mixing issues here, the SSH connection reset issue commented by @SrikanthREEF has been moved to https://github.com/prowler-cloud/prowler/issues/1659

We will keep here the issue with AWS STS Endpoints as requested by @fgont

[n4ch04]

Hi @fgont, did the previous workaround solve your issue?

[n4ch04]

Hi @fgont since we are not receiving feedback from your side we assume that the issue is solved. We are going to close the issue, feel free to reopen or open another one if the issue persist.

Thanks for using Prowler !!

[bobbyhiddn]

Dealing with this issue in gov-cloud where the suffix amazonaws.com is not correct. This is the relevant snippet from aws_provider.py:

    @staticmethod
    def create_sts_session(
        session: Session, aws_region: str = AWS_STS_GLOBAL_ENDPOINT_REGION
    ) -> Session.client:
        """
        Create an STS session client.

        Parameters:
        - session (session.Session): The AWS session object.
        - aws_region (str): The AWS region to use for the session.

        Returns:
        - session.Session.client: The STS session client.

        Example:
            session = boto3.session.Session()
            sts_client = create_sts_session(session, 'us-west-2')
        """
        try:
            sts_endpoint_url = (
                f"https://sts.{aws_region}.amazonaws.com"
                if not aws_region.startswith("cn-")
                else f"https://sts.{aws_region}.amazonaws.com.cn"
            )
            return session.client("sts", aws_region, endpoint_url=sts_endpoint_url)
        except Exception as error:
            logger.critical(
                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
            )
            raise error

If this function allowed for an environmental variable override like with region, we would be set, but we are currently having to build a custom version of the library.