Skip to content

1.19.0 Breaking Bug: AWS STS 400 Error: {"errors":["number of regions does not match number of endpoints"]} #29869

@cmmarslender

Description

@cmmarslender

Describe the bug
After updating to 1.19.0, when calling an aws sts endpoint, we now receive {"errors":["number of regions does not match number of endpoints"]}. These calls all used to work just fine.

The new error was introduced in this PR #29051

The AWS backend is configured like:

resource "vault_aws_secret_backend" "aws-chia" {
  access_key = var.chia_aws_access_key_id
  secret_key = var.chia_aws_secret_access_key
  path       = "aws"
}

You will note that in this config, no sts endpoint is set at all since that is supposed to be an optional parameter, so it was previously using whatever the default was. If I'm following the flow correctly, &endpoint was likely nil at this point https://github.com/hashicorp/vault/blob/v1.18.5/builtin/logical/aws/client.go#L96 and AWS SDK probably had a fallback.

On the new PR / 1.19.0:

fallback region is specifically set to us-east-1 in the client.go file

fallbackRegion = "us-east-1"
and then later, if no region(s) were otherwise set, this hardcoded default is added to the regions list
regions = append(regions, config.STSFallbackRegions...)

No such logic exists for endpoints - if no endpoints are set in config at all (which is not documented as required), the endpoints will be an empty list.

The combination of these two factors results in this error always firing for very simple sts configurations, since endpoints will be 0 and regions will always be at least 1. (I have not tried editing the code and trying a new build, but this is the only explanation I see at first glance that explains the issue)

Metadata

Metadata

Assignees

Labels

bugUsed to indicate a potential bugregressionUsed to indicate possible regressions between versionssecret/awsui

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions