Skip to content

Commit 2e1899e

Browse files
authored
fix(auth): strip -fips suffix from AWS service name in SigV4 signing (#18920)
When signing AWS STS GetCallerIdentity requests against regional FIPS endpoints (`sts-fips.{region}.amazonaws.com`), the `Host` header must remain `sts-fips.{region}.amazonaws.com`, whereas the AWS SigV4 credential scope and signing key derivation require the canonical service name (`sts`). Previously, `_generate_authentication_header_map` derived `service_name = host.split(".")[0]`, which produced `sts-fips` and caused AWS STS to reject the signed request with `SignatureDoesNotMatch: Credential should be scoped to correct service: 'sts'`. This change strips any trailing `-fips` suffix from the extracted hostname label when computing `service_name`. ## Manual Testing End-to-end reproduction script and observed pre-fix / post-fix output against GCP STS (`https://sts.googleapis.com/v1/token`) and AWS STS (`https://sts-fips.us-east-2.amazonaws.com`): - https://paste.googleplex.com/6755399436486780
1 parent 905c608 commit 2e1899e

2 files changed

Lines changed: 28 additions & 1 deletion

File tree

‎packages/google-auth/google/auth/aws.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,8 @@ def _generate_authentication_header_map(
258258
"""
259259
# iam.amazonaws.com host => iam service.
260260
# sts.us-east-2.amazonaws.com host => sts service.
261-
service_name = host.split(".")[0]
261+
# sts-fips.us-east-2.amazonaws.com host => sts service.
262+
service_name = host.split(".")[0].removesuffix("-fips")
262263

263264
current_time = _helpers.utcnow()
264265
amz_date = current_time.strftime("%Y%m%dT%H%M%SZ")

‎packages/google-auth/tests/test_aws.py‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -606,6 +606,32 @@
606606
"data": REQUEST_PARAMS,
607607
},
608608
),
609+
# POST request with session token credentials and FIPS STS endpoint.
610+
(
611+
"us-east-2",
612+
"2020-08-11T06:55:22Z",
613+
{
614+
"access_key_id": ACCESS_KEY_ID,
615+
"secret_access_key": SECRET_ACCESS_KEY,
616+
"security_token": TOKEN,
617+
},
618+
{
619+
"method": "POST",
620+
"url": "https://sts-fips.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",
621+
},
622+
{
623+
"url": "https://sts-fips.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",
624+
"method": "POST",
625+
"headers": {
626+
"Authorization": "AWS4-HMAC-SHA256 Credential="
627+
+ ACCESS_KEY_ID
628+
+ "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=9b27e912850bcfdde94f29f05c992022ad6ed0d40b31381a33e0da6cdb4c5a8f",
629+
"host": "sts-fips.us-east-2.amazonaws.com",
630+
"x-amz-date": "20200811T065522Z",
631+
"x-amz-security-token": TOKEN,
632+
},
633+
},
634+
),
609635
]
610636

611637

0 commit comments

Comments
 (0)