-
Notifications
You must be signed in to change notification settings - Fork 4.4k
Description
Describe the bug
After updating to 1.19.0, when calling an aws sts endpoint, we now receive {"errors":["number of regions does not match number of endpoints"]}
. These calls all used to work just fine.
The new error was introduced in this PR #29051
The AWS backend is configured like:
resource "vault_aws_secret_backend" "aws-chia" {
access_key = var.chia_aws_access_key_id
secret_key = var.chia_aws_secret_access_key
path = "aws"
}
You will note that in this config, no sts endpoint is set at all since that is supposed to be an optional parameter, so it was previously using whatever the default was. If I'm following the flow correctly, &endpoint
was likely nil at this point https://github.com/hashicorp/vault/blob/v1.18.5/builtin/logical/aws/client.go#L96 and AWS SDK probably had a fallback.
On the new PR / 1.19.0:
fallback region is specifically set to us-east-1 in the client.go file
vault/builtin/logical/aws/client.go
Line 36 in c937b3e
fallbackRegion = "us-east-1" |
vault/builtin/logical/aws/client.go
Line 96 in c937b3e
regions = append(regions, config.STSFallbackRegions...) |
No such logic exists for endpoints - if no endpoints are set in config at all (which is not documented as required), the endpoints will be an empty list.
The combination of these two factors results in this error always firing for very simple sts configurations, since endpoints will be 0 and regions will always be at least 1. (I have not tried editing the code and trying a new build, but this is the only explanation I see at first glance that explains the issue)