Repository navigation
Commit 2e1899e
authored
fix(auth): strip -fips suffix from AWS service name in SigV4 signing (#18920)
When signing AWS STS GetCallerIdentity requests against regional FIPS
endpoints (`sts-fips.{region}.amazonaws.com`), the `Host` header must
remain `sts-fips.{region}.amazonaws.com`, whereas the AWS SigV4
credential scope and signing key derivation require the canonical
service name (`sts`).
Previously, `_generate_authentication_header_map` derived `service_name
= host.split(".")[0]`, which produced `sts-fips` and caused AWS STS to
reject the signed request with `SignatureDoesNotMatch: Credential should
be scoped to correct service: 'sts'`.
This change strips any trailing `-fips` suffix from the extracted
hostname label when computing `service_name`.
## Manual Testing
End-to-end reproduction script and observed pre-fix / post-fix output
against GCP STS (`https://sts.googleapis.com/v1/token`) and AWS STS
(`https://sts-fips.us-east-2.amazonaws.com`):
- https://paste.googleplex.com/67553994364867801 parent 905c608 commit 2e1899e
2 files changed
Lines changed: 28 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
258 | 258 | | |
259 | 259 | | |
260 | 260 | | |
261 | | - | |
| 261 | + | |
| 262 | + | |
262 | 263 | | |
263 | 264 | | |
264 | 265 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
606 | 606 | | |
607 | 607 | | |
608 | 608 | | |
| 609 | + | |
| 610 | + | |
| 611 | + | |
| 612 | + | |
| 613 | + | |
| 614 | + | |
| 615 | + | |
| 616 | + | |
| 617 | + | |
| 618 | + | |
| 619 | + | |
| 620 | + | |
| 621 | + | |
| 622 | + | |
| 623 | + | |
| 624 | + | |
| 625 | + | |
| 626 | + | |
| 627 | + | |
| 628 | + | |
| 629 | + | |
| 630 | + | |
| 631 | + | |
| 632 | + | |
| 633 | + | |
| 634 | + | |
609 | 635 | | |
610 | 636 | | |
611 | 637 | | |
| |||
0 commit comments