Merge pull request #27028 from KaemonIsland/add-region-to-aws-provider-chain

Pass region to getDefaultCredentialsChain

.changeset/friendly-hats-push.md

@@ -0,0 +1,5 @@
+---
+'@backstage/integration-aws-node': patch
+---
+
+The `getDefaultCredentialsChain` function now accepts and applies a `region` parameter, preventing it from defaulting to `us-east-1` when no region is specified.

packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts

@@ -24,12 +24,20 @@ import {
 } from '@aws-sdk/client-sts';
 import { Config, ConfigReader } from '@backstage/config';
 import { promises } from 'fs';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 
 const env = process.env;
 let stsMock: AwsClientStub<STSClient>;
 let config: Config;
 
 jest.mock('fs', () => ({ promises: { readFile: jest.fn() } }));
+jest.mock('@aws-sdk/credential-providers', () => {
+  const originalModule = jest.requireActual('@aws-sdk/credential-providers');
+  return {
+    ...originalModule,
+    fromNodeProviderChain: jest.fn(),
+  };
+});
 
 describe('DefaultAwsCredentialsManager', () => {
   beforeEach(() => {
@@ -127,12 +135,17 @@ describe('DefaultAwsCredentialsManager', () => {
         },
       });
 
+    const testDate = new Date('2022-01-10');
+
     process.env.AWS_ACCESS_KEY_ID = 'ACCESS_KEY_ID_10';
     process.env.AWS_SECRET_ACCESS_KEY = 'SECRET_ACCESS_KEY_10';
     process.env.AWS_SESSION_TOKEN = 'SESSION_TOKEN_10';
-    process.env.AWS_CREDENTIAL_EXPIRATION = new Date(
-      '2022-01-10',
-    ).toISOString();
+    process.env.AWS_CREDENTIAL_EXPIRATION = testDate.toISOString();
+
+    // Return creds from env
+    (fromNodeProviderChain as jest.Mock).mockImplementation(
+      jest.requireActual('@aws-sdk/credential-providers').fromNodeProviderChain,
+    );
 
     const mockProfile = `[my-profile]
     aws_access_key_id=ACCESS_KEY_ID_9
@@ -431,5 +444,49 @@ describe('DefaultAwsCredentialsManager', () => {
         provider.getCredentialProvider({ accountId: '123456789012' }),
       ).rejects.toThrow(/No credentials found/);
     });
+
+    it('passes the region to getDefaultCredentialsChain', async () => {
+      const region = 'us-west-2';
+      const configWithRegion = new ConfigReader({
+        aws: {
+          mainAccount: {
+            region,
+          },
+        },
+      });
+
+      const provider =
+        DefaultAwsCredentialsManager.fromConfig(configWithRegion);
+      const awsCredentialProvider = await provider.getCredentialProvider();
+
+      // Trigger the call to fromNodeProviderChain
+      await awsCredentialProvider.sdkCredentialProvider();
+
+      expect(fromNodeProviderChain).toHaveBeenCalledWith({
+        clientConfig: {
+          region,
+        },
+      });
+    });
+
+    it('uses default region when none is specified', async () => {
+      const configWithoutRegion = new ConfigReader({
+        aws: {
+          mainAccount: {},
+        },
+      });
+
+      const provider =
+        DefaultAwsCredentialsManager.fromConfig(configWithoutRegion);
+      const awsCredentialProvider = await provider.getCredentialProvider();
+
+      await awsCredentialProvider.sdkCredentialProvider();
+
+      expect(fromNodeProviderChain).toHaveBeenCalledWith({
+        clientConfig: {
+          region: 'us-east-1',
+        },
+      });
+    });
   });
 });

packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts

@@ -77,8 +77,15 @@ function getProfileCredentials(
   });
 }
 
-function getDefaultCredentialsChain(): AwsCredentialIdentityProvider {
-  return fromNodeProviderChain();
+/**
+ * Include the region if present, otherwise use the default region.
+ *
+ * @see https://www.npmjs.com/package/@aws-sdk/credential-provider-node
+ */
+function getDefaultCredentialsChain(
+  region = 'us-east-1',
+): AwsCredentialIdentityProvider {
+  return fromNodeProviderChain({ clientConfig: { region } });
 }
 
 /**
@@ -123,7 +130,7 @@ function getSdkCredentialProvider(
     return getProfileCredentials(config.profile!, config.region);
   }
 
-  return getDefaultCredentialsChain();
+  return getDefaultCredentialsChain(config.region);
 }
 
 /**
@@ -145,7 +152,7 @@ function getMainAccountSdkCredentialProvider(
     return getProfileCredentials(config.profile!, config.region);
   }
 
-  return getDefaultCredentialsChain();
+  return getDefaultCredentialsChain(config.region);
 }
 
 /**