AWS auth login with multi region STS support #21960

raymonstah · 2023-07-19T20:39:11Z

Summary

Adds support to the AWS auth plugin so that when the use_sts_region_from_client configuration is set, the global STS endpoint (https://sts.amazonaws.com) will be overridden to instead use the regional STS endpoints based on the region provided in the Authorization header.

This change allows for DR situations and AWS regional outages by supporting flexibility in where the login region is calling from.

Without this change, clients would run into an error message when logging in if there were a region mismatch between client and server:

Error authenticating: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/auth/aws/login
Code: 400. Errors:

* error making upstream request: received error code 403 from STS: <ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>SignatureDoesNotMatch</Code>
    <Message>Credential should be scoped to a valid region. </Message>
  </Error>
  <RequestId>b749af7f-ed19-4cea-9885-f60d2422880e</RequestId>
</ErrorResponse>

Testing

For the server side, I've configured the AWS auth plugin with the use_sts_region_from_client config set to true.

vault auth enable aws
Success! Enabled aws auth method at: aws/

vault write auth/aws/config/client \
    secret_key="${AWS_SECRET_ACCESS_KEY}" \
    access_key="${AWS_ACCESS_KEY_ID}" \
use_sts_region_from_client=true
Success! Data written to: auth/aws/config/client

vault write auth/aws/role/dev-role-iam \
    auth_type="iam" \
    bound_iam_principal_arn="arn:aws:iam::XXXXXXXXXXX:user/FOOBAR" \
    policies="default"
Success! Data written to: auth/aws/role/dev-role-iam

For the client side, I've tested the login command using a bunch of different regions, auto region, and no region specified . Responses omitted for brevity.

vault login -method=aws  region=us-east-1 role=dev-role-iam
Success! You are now authenticated. The token information displayed below...

vault login -method=aws  region=us-east-2 role=dev-role-iam
Success! You are now authenticated. The token information displayed below...

vault login -method=aws  region=us-west-1 role=dev-role-iam
Success! You are now authenticated. The token information displayed below...

vault login -method=aws  region=us-west-2 role=dev-role-iam
Success! You are now authenticated. The token information displayed below...

vault login -method=aws  region=auto role=dev-role-iam
Success! You are now authenticated. The token information displayed below...

vault login -method=aws role=dev-role-iam
Success! You are now authenticated. The token information displayed below...

builtin/credential/aws/path_config_client.go

github-actions · 2023-07-19T20:55:04Z

CI Results:
All Go tests succeeded! ✅

website/content/api-docs/auth/aws.mdx

changelog/21960.txt

austingebauer · 2023-07-20T18:30:16Z

builtin/credential/aws/path_login_test.go

@@ -625,6 +627,58 @@ func TestBackend_defaultAliasMetadata(t *testing.T) {
 	}
 }

+func TestRegionFromHeader(t *testing.T) {


austingebauer · 2023-07-20T18:30:38Z

builtin/credential/aws/path_login.go

+	// https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
+	// The Authorization header takes the following form.
+	//  Authorization: AWS4-HMAC-SHA256
+	//	Credential=AKIAIOSFODNN7EXAMPLE/20230719/us-east-1/sts/aws4_request,
+	// 	SignedHeaders=content-length;content-type;host;x-amz-date,
+	//	Signature=fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024
+	//
+	// The credential is in the form of "<your-access-key-id>/<date>/<aws-region>/<aws-service>/aws4_request"


Thanks, this comment is helpful!

… auth

github-actions · 2023-07-24T20:24:07Z

Build Results:
All builds succeeded! ✅

maxcoulombe · 2023-07-25T01:26:04Z

changelog/21960.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+aws/auth: Adds a new config field `sts_region_from_client` which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication..


Suggested change

aws/auth: Adds a new config field `sts_region_from_client` which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication..

aws/auth: Adds a new config field `sts_region_from_client` which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication.

Double dots?

website/content/api-docs/auth/aws.mdx

maxcoulombe

Thanks for the parameter rename. This is a really elegant solution, nice work.

AWS auth login with multi region STS support

3a525df

github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Jul 19, 2023

vercel bot deployed to Preview July 19, 2023 20:43 View deployment

raymonstah commented Jul 19, 2023

View reviewed changes

builtin/credential/aws/path_config_client.go Outdated Show resolved Hide resolved

raymonstah added 2 commits July 19, 2023 13:47

add changelog

e61f780

fix variable name in test

561b1f6

raymonstah added this to the 1.15 milestone Jul 19, 2023

raymonstah requested a review from a team July 19, 2023 21:14

gofmt

2b8a415

austingebauer reviewed Jul 20, 2023

View reviewed changes

website/content/api-docs/auth/aws.mdx Outdated Show resolved Hide resolved

austingebauer reviewed Jul 20, 2023

View reviewed changes

changelog/21960.txt Outdated Show resolved Hide resolved

austingebauer reviewed Jul 20, 2023

View reviewed changes

update docs to mention sts_region_from_client is only for IAM-based…

ba3d873

… auth

vercel bot deployed to Preview July 20, 2023 18:58 View deployment

raymonstah marked this pull request as ready for review July 24, 2023 20:07

raymonstah requested a review from a team as a code owner July 24, 2023 20:07

raymonstah requested a review from a team July 24, 2023 20:07

maxcoulombe reviewed Jul 25, 2023

View reviewed changes

website/content/api-docs/auth/aws.mdx Show resolved Hide resolved

raymonstah added 2 commits July 25, 2023 11:12

remove extra period in changelog

f8547ce

rename to 'use_sts_region_from_client'

8f125f1

vercel bot deployed to Preview July 26, 2023 21:18 View deployment

maxcoulombe approved these changes Jul 28, 2023

View reviewed changes

raymonstah merged commit 4f7a8fb into main Jul 28, 2023
96 checks passed

raymonstah deleted the VAULT-18128/aws-auth-login-multi-region-sts-support branch July 28, 2023 15:42

raymonstah mentioned this pull request Jul 28, 2023

Add use_sts_region_from_client to AWS Auth Config hashicorp/terraform-provider-vault#1963

Merged

austingebauer mentioned this pull request Sep 28, 2023

auth/aws: fix panic in IAM-based login when client config doesn't exist #23366

Merged

hc-github-team-secure-vault-core mentioned this pull request Sep 30, 2023

Backport of auth/aws: fix panic in IAM-based login when client config doesn't exist into release/1.15.x #23425

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AWS auth login with multi region STS support #21960

AWS auth login with multi region STS support #21960

raymonstah commented Jul 19, 2023 •

edited

Loading

github-actions bot commented Jul 19, 2023 •

edited

Loading

austingebauer Jul 20, 2023

austingebauer Jul 20, 2023

github-actions bot commented Jul 24, 2023

maxcoulombe Jul 25, 2023

maxcoulombe left a comment

		@@ -0,0 +1,3 @@
		```release-note:improvement
		aws/auth: Adds a new config field `sts_region_from_client` which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication..

AWS auth login with multi region STS support #21960

AWS auth login with multi region STS support #21960

Conversation

raymonstah commented Jul 19, 2023 • edited Loading

Summary

Testing

github-actions bot commented Jul 19, 2023 • edited Loading

austingebauer Jul 20, 2023

Choose a reason for hiding this comment

austingebauer Jul 20, 2023

Choose a reason for hiding this comment

github-actions bot commented Jul 24, 2023

maxcoulombe Jul 25, 2023

Choose a reason for hiding this comment

maxcoulombe left a comment

Choose a reason for hiding this comment

raymonstah commented Jul 19, 2023 •

edited

Loading

github-actions bot commented Jul 19, 2023 •

edited

Loading