Skip to content

Commit

Permalink
Support AWS_ENDPOINT_URL_STS environment variable (#724)
Browse files Browse the repository at this point in the history
As described in https://docs.aws.amazon.com/sdkref/latest/guide/ss-endpoints-table.html,
the STS endpoint can be configured with the AWS_ENDPOINT_URL_STS
environment variable. This might be necessary for users of Amazon
Secret Cloud (https://aws.amazon.com/federal/secret-cloud/),
for example.
  • Loading branch information
stanhu committed Sep 9, 2024
1 parent 5315d46 commit 05e4ff2
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 1 deletion.
4 changes: 3 additions & 1 deletion lib/fog/aws/credential_fetcher.rb
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,9 @@ def fetch_credentials(options)
}

sts_endpoint =
if ENV["AWS_STS_REGIONAL_ENDPOINTS"] == "regional" && region
if ENV["AWS_ENDPOINT_URL_STS"]
ENV["AWS_ENDPOINT_URL_STS"]
elsif ENV["AWS_STS_REGIONAL_ENDPOINTS"] == "regional" && region
"https://sts.#{region}.amazonaws.com"
else
"https://sts.amazonaws.com"
Expand Down
14 changes: 14 additions & 0 deletions tests/credentials_tests.rb
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,20 @@
) { Fog::AWS::Compute.fetch_credentials(use_iam_profile: true) }
end

ENV["AWS_ENDPOINT_URL_STS"] = "https://my-special-sts.amazonaws.com"

tests('#fetch_credentials with global STS endpoint set in env') do
returns(
aws_access_key_id: 'dummykey',
aws_secret_access_key: 'dummysecret',
aws_session_token: 'dummytoken',
region: 'us-west-1',
sts_endpoint: "https://my-special-sts.amazonaws.com",
aws_credentials_expire_at: expires_at
) { Fog::AWS::Compute.fetch_credentials(use_iam_profile: true) }
end

ENV["AWS_ENDPOINT_URL_STS"] = nil
ENV["AWS_STS_REGIONAL_ENDPOINTS"] = nil
ENV["AWS_DEFAULT_REGION"] = nil
ENV["AWS_REGION"] = nil
Expand Down

0 comments on commit 05e4ff2

Please sign in to comment.