search

rundeck-plugins / rundeck-ec2-nodes-plugin

Get resource node data from Amazon EC2
86 stars 45 forks source link

RUN-2824: Respect the AWS_STS_REGIONAL_ENDPOINTS parameter #131

Closed kangaechu closed 3 weeks ago

kangaechu commented 2 months ago

Closes #110

This modification allows the use of STS regionalized endpoints by specifying the AWS_STS_REGIONAL_ENDPOINTS=regional environment variable.

AWS STS has global and per-region endpoints. https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html

AWS recommends STS regionalized endpoints (AWS_STS_REGIONAL_ENDPOINTS=regional), but defaults to STS global endpoints (AWS_STS_REGIONAL_ENDPOINTS=legacy ).

On August 29, 2024, an AWS STS failure occurred and requests using the STS global endpoints failed. This failure did not affect requests using STS Regionalized endpoints.

image

The current implementation uses AWS SecurityTokenServiceClient when creating sts clients. This method is deprecated and does not read the STS endpoint configuration. https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/securitytoken/AWSSecurityTokenServiceClient.html#AWSSecurityTokenServiceClient-com.amazonaws.auth.AWSCredentialsProvider-com.amazonaws.ClientConfiguration-

Instead, the AWSsecurityTokenServiceClientBuilder is used to allow the STS endpoint settings to be respected.

kangaechu commented 2 months ago

@gschueler Would you review this PR?

kangaechu commented 3 weeks ago

@gschueler Wolud you merge this PR?