Merge pull request #29431 from cflee/cflee/aws-account-id-region

Fix aws.mainAccount account ID check during fallback in DefaultAwsCredentialsManager

.changeset/slow-drinks-enjoy.md

@@ -0,0 +1,5 @@
+---
+'@backstage/integration-aws-node': patch
+---
+
+Fixed bug in DefaultAwsCredentialsManager where aws.mainAccount.region has no effect on the STS region used for account ID lookup during credential provider lookup when falling back to the main account, and it does not default to us-east-1

packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts

@@ -91,6 +91,18 @@ describe('DefaultAwsCredentialsManager', () => {
       Account: '123456789012',
     });
 
+    stsMock
+      .on(GetCallerIdentityCommand)
+      .callsFake(async (_input, getClient) => {
+        const client = getClient();
+        const region = await client.config.region();
+        if (!region) {
+          throw new Error('Region is missing');
+        }
+        return {
+          Account: '123456789012',
+        };
+      });
     stsMock
       .on(AssumeRoleCommand, {
         RoleArn: 'arn:aws:iam::111111111111:role/hello',
@@ -488,5 +500,21 @@ describe('DefaultAwsCredentialsManager', () => {
         },
       });
     });
+
+    it('passes mainAccount region to fillInAccountId for account ID lookup during fallback', async () => {
+      const region = 'us-west-2';
+      const configWithRegion = new ConfigReader({
+        aws: {
+          mainAccount: {
+            region,
+          },
+        },
+      });
+      const provider =
+        DefaultAwsCredentialsManager.fromConfig(configWithRegion);
+      await provider.getCredentialProvider({ accountId: '123456789012' });
+
+      expect(await stsMock.call(0).thisValue.config.region()).toEqual(region);
+    });
   });
 });

packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts

@@ -37,6 +37,7 @@ import { Config } from '@backstage/config';
 
 /**
  * Retrieves the account ID for the given credential provider from STS.
+ * Include the region if present, otherwise use the default region.
  */
 async function fillInAccountId(credProvider: AwsCredentialProvider) {
   if (credProvider.accountId) {
@@ -44,7 +45,7 @@ async function fillInAccountId(credProvider: AwsCredentialProvider) {
   }
 
   const client = new STSClient({
-    region: credProvider.stsRegion,
+    region: credProvider.stsRegion ?? 'us-east-1',
     customUserAgent: 'backstage-aws-credentials-manager',
     credentialDefaultProvider: () => credProvider.sdkCredentialProvider,
   });
@@ -174,6 +175,7 @@ export class DefaultAwsCredentialsManager implements AwsCredentialsManager {
       awsConfig.mainAccount,
     );
     const mainAccountCredProvider: AwsCredentialProvider = {
+      stsRegion: awsConfig.mainAccount.region,
       sdkCredentialProvider: mainAccountSdkCredProvider,
     };