-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(sts): do not inject region info for STS service with VPC endpoint hostname #113
Conversation
Luacheck Report25 tests - 8 0 ✅ - 1 0s ⏱️ ±0s For more details on these failures, see this check. Results for commit f41554c. ± Comparison against base commit 77c62da. This pull request removes 33 and adds 25 tests. Note that renamed tests count towards both.
♻️ This comment has been updated with latest results. |
The aws-sdk-js may also share the same issue: https://github.com/aws/aws-sdk-js/blob/307e82673b48577fce4389e4ce03f95064e8fe0d/lib/services/sts.js#L78-L82 |
7660fc0
to
f41554c
Compare
Summary
AWS services can be used inside a private VPC without Internet access by creating private links(VPC endpoints). When creating VPC endpoint for an AWS service, the
Enable private DNS name
is enabled by default, which means that a private DNS record will be created whose value is just the same as the AWS service's public endpoint(for example,s3.amazonaws.com
) but pointing at the private VPC endpoint. This is what is expected to be a common practice when using VPC endpoint to access AWS service.However, user can also disable it to not create this "fake" DNS record, and use the VPC endpoint hostname directly(something like
vpce-abcdefghijklmn-abcdefg.sts.us-east-1.vpce.amazonaws.com
). In this case, there is no need to inject region info into the endpoint domain since the hostname itself always contains the region for this VPC endpoint.We've encountered a case in which the user is using a VPC endpoint hostname directly for STS service and region info gets injected unexpectedly, thus STS service cannot be used. This PR fixes it.
More information: https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html#interface-endpoint-dns-hostnames
Issue
FTI-5934
KAG-4599