From 2d0afb02bc82cb150379bdc159630560ca320443 Mon Sep 17 00:00:00 2001 From: Lee Chiang Fong Date: Thu, 9 Jan 2025 15:28:48 +0800 Subject: [PATCH 1/4] Make mock stsClient fail when region is missing Signed-off-by: Lee Chiang Fong --- .../src/DefaultAwsCredentialsManager.test.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts index d81f717a58..a4e13916ff 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts @@ -91,6 +91,18 @@ describe('DefaultAwsCredentialsManager', () => { Account: '123456789012', }); + stsMock + .on(GetCallerIdentityCommand) + .callsFake(async (_input, getClient) => { + const client = getClient(); + const region = await client.config.region(); + if (!region) { + throw new Error('Region is missing'); + } + return { + Account: '123456789012', + }; + }); stsMock .on(AssumeRoleCommand, { RoleArn: 'arn:aws:iam::111111111111:role/hello', From 97907dcefe6b3a9599a61e5900b000456b49e57b Mon Sep 17 00:00:00 2001 From: Lee Chiang Fong Date: Thu, 9 Jan 2025 15:34:46 +0800 Subject: [PATCH 2/4] Use a default region for mainAccount's STS region Signed-off-by: Lee Chiang Fong --- .../integration-aws-node/src/DefaultAwsCredentialsManager.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts index 3048fdfe40..36c753767c 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts @@ -37,6 +37,7 @@ import { Config } from '@backstage/config'; /** * Retrieves the account ID for the given credential provider from STS. + * Include the region if present, otherwise use the default region. */ async function fillInAccountId(credProvider: AwsCredentialProvider) { if (credProvider.accountId) { @@ -44,7 +45,7 @@ async function fillInAccountId(credProvider: AwsCredentialProvider) { } const client = new STSClient({ - region: credProvider.stsRegion, + region: credProvider.stsRegion ?? 'us-east-1', customUserAgent: 'backstage-aws-credentials-manager', credentialDefaultProvider: () => credProvider.sdkCredentialProvider, }); From 01dec025fed80bcd1900ab61ad8c5c98533cdf3d Mon Sep 17 00:00:00 2001 From: Lee Chiang Fong Date: Thu, 9 Jan 2025 15:43:57 +0800 Subject: [PATCH 3/4] Use mainAccount's region as stsRegion Signed-off-by: Lee Chiang Fong --- .../src/DefaultAwsCredentialsManager.test.ts | 16 ++++++++++++++++ .../src/DefaultAwsCredentialsManager.ts | 1 + 2 files changed, 17 insertions(+) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts index a4e13916ff..582b003724 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts @@ -500,5 +500,21 @@ describe('DefaultAwsCredentialsManager', () => { }, }); }); + + it('passes mainAccount region to fillInAccountId for account ID lookup during fallback', async () => { + const region = 'us-west-2'; + const configWithRegion = new ConfigReader({ + aws: { + mainAccount: { + region, + }, + }, + }); + const provider = + DefaultAwsCredentialsManager.fromConfig(configWithRegion); + await provider.getCredentialProvider({ accountId: '123456789012' }); + + expect(await stsMock.call(0).thisValue.config.region()).toEqual(region); + }); }); }); diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts index 36c753767c..b54a4fda26 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts @@ -175,6 +175,7 @@ export class DefaultAwsCredentialsManager implements AwsCredentialsManager { awsConfig.mainAccount, ); const mainAccountCredProvider: AwsCredentialProvider = { + stsRegion: awsConfig.mainAccount.region, sdkCredentialProvider: mainAccountSdkCredProvider, }; From db4630ec9fb2189515eae573039d9013d587a52d Mon Sep 17 00:00:00 2001 From: Lee Chiang Fong Date: Thu, 9 Jan 2025 15:51:54 +0800 Subject: [PATCH 4/4] Add changeset Signed-off-by: Lee Chiang Fong --- .changeset/slow-drinks-enjoy.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/slow-drinks-enjoy.md diff --git a/.changeset/slow-drinks-enjoy.md b/.changeset/slow-drinks-enjoy.md new file mode 100644 index 0000000000..5a171b8fd1 --- /dev/null +++ b/.changeset/slow-drinks-enjoy.md @@ -0,0 +1,5 @@ +--- +'@backstage/integration-aws-node': patch +--- + +Fixed bug in DefaultAwsCredentialsManager where aws.mainAccount.region has no effect on the STS region used for account ID lookup during credential provider lookup when falling back to the main account, and it does not default to us-east-1