Credential should be scoped to a valid region using OIDC authentication method with token.

Describe the bug Version 4.0.1. We are trying to migrate from Spring 2 -> 3 using an AWS-based vault. In development we access this via logging with with vault login --method=oidc and then pasting this into our application.properties.

implementation 'org.springframework.cloud:spring-cloud-starter-vault-config:4.0.1'

spring:
  cloud:
    vault:
      enabled: true
      namespace: A_NAMESPACE
      application-name: A_NAMESPACE
      fail-fast: true
      host: URL
      authentication: token
      token: hvs.TOKEN_HERE

Previously this worked fine with version 3.1.1 with identical implementation and token, however upon migration to 4.0.1:

12:12:15.117 [main] ERROR org.springframework.boot.SpringApplication -- Application run failed
org.springframework.vault.authentication.VaultLoginException: Cannot login using AWS-IAM: error making upstream request: received error code 403 from STS: <ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>SignatureDoesNotMatch</Code>
    <Message>Credential should be scoped to a valid region. </Message>
  </Error>
  <RequestId>A Request ID</RequestId>
</ErrorResponse>

I can understand this issue, and have found various fixes when using aws_iam authentication in this plugin, however with OIDC is there a way to get around this? Thanks

Sample Example provided above, hard to make easily reproducible given vault cloud setup.

spring-cloud / spring-cloud-vault

Credential should be scoped to a valid region using OIDC authentication method with token. #693