Add Sigv4 Endpoint config parameter #494
Conversation
kanwren
force-pushed
the
kanwren/add-sigv4-endpoint-parameter
branch
from
bccc2dc
to
4faba52
Compare
|
Any chance on getting this merged? It would be very helpful for AWS VPC deployments that need to keep all network traffic within AWS. |
Signed-off-by: Nicole Wren <[email protected]>
kanwren
force-pushed
the
kanwren/add-sigv4-endpoint-parameter
branch
from
4faba52
to
3442f5d
Compare
|
Thanks for creating this PR. |
| @@ -62,6 +62,7 @@ func NewSigV4RoundTripper(cfg *SigV4Config, next http.RoundTripper) (http.RoundT | |||
| sess, err := session.NewSessionWithOptions(session.Options{ | |||
| Config: aws.Config{ | |||
| Region: aws.String(cfg.Region), | |||
| Endpoint: aws.String(cfg.Endpoint), | |||
There was a problem hiding this comment.
I think what you want to change is the property STSRegionalEndpoint and set it to RegionalSTSEndpoint
References:
https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config
https://github.com/aws/aws-sdk-go/blob/main/aws/endpoints/endpoints.go#L186C2-L186C21
Then we don't need to add a configuration because it is fine to always use the regional STS endpoint.
There was a problem hiding this comment.
On the other hand, I think it is safer to add a configuration parameter whose default value is the current behaviour (global endpoint - value LegacySTSEndpoint). In fact you the zero value will be the legacy endpoint so it is fine to not set if the configuration is not setting.
There was a problem hiding this comment.
still we have the benefit of not needing to provide the sts endpoint explicitly and we leave the SDK to do that for us.
|
Hello from the bug scrub. There is some feedback on this PR that needs attention. Is there any further work required? |
Exposes an
endpointfield in the sigv4 config, so that the call to STS when assuming a role with a web identity can use a custom STS endpoint, e.g. a VPC endpoint.No clients other than the STS one are made from the session config here, so setting
Endpointshould be safe, but it can also be a resolver if this is a concern.Addresses prometheus/prometheus#11710.