This repository was archived by the owner on Mar 23, 2026. It is now read-only.
Apply IAM patches when loading STS to avoid wrong access key formats#11931
Merged
Apply IAM patches when loading STS to avoid wrong access key formats#11931
Conversation
dfangl
added
the
semver: patch
LocalStack Community integration with Pro 2 files ± 0 2 suites ±0 49m 44s ⏱️ - 1h 1m 17s Results for commit fbcb484. ± Comparison against base commit 5f19fbc. This pull request removes 2756 and adds 6 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
bentsku
approved these changes
Nov 26, 2024
Contributor
There was a problem hiding this comment.
LGTM! Thanks a lot for addressing this! 🙏 neat and safe fix! 
For additional context, this issue was raised by using ESM and DynamoDB with non default credentials, ESM calling sts.AssumeRole and getting ASIA... credentials, leading to ESM trying to get DynamoDB records in the default account. It was hard to reproduce in our tests, as we always load IAM first 😄
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Currently, if we are using STS (especially the assume-role and assume-role-with-web-identity operations) without ever having loaded IAM (e.g. by referencing a non-existent role in a service like AWS Lambda), we do not have the patches applied patching the access key id format.
This leads to access key ids starting with an
Aand not aL, which leads to the credentials being ignored, unlessPARITY_AWS_ACCESS_KEY_ID=1is set.IAM and STS are coupled tightly in moto, which is why the patching of IAM affects STS access key ids.
Changes