diff --git a/.changeset/friendly-hats-push.md b/.changeset/friendly-hats-push.md new file mode 100644 index 0000000000..e730fcbf8c --- /dev/null +++ b/.changeset/friendly-hats-push.md @@ -0,0 +1,5 @@ +--- +'@backstage/integration-aws-node': patch +--- + +The `getDefaultCredentialsChain` function now accepts and applies a `region` parameter, preventing it from defaulting to `us-east-1` when no region is specified. diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts index 237428c3e9..d81f717a58 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts @@ -24,12 +24,20 @@ import { } from '@aws-sdk/client-sts'; import { Config, ConfigReader } from '@backstage/config'; import { promises } from 'fs'; +import { fromNodeProviderChain } from '@aws-sdk/credential-providers'; const env = process.env; let stsMock: AwsClientStub; let config: Config; jest.mock('fs', () => ({ promises: { readFile: jest.fn() } })); +jest.mock('@aws-sdk/credential-providers', () => { + const originalModule = jest.requireActual('@aws-sdk/credential-providers'); + return { + ...originalModule, + fromNodeProviderChain: jest.fn(), + }; +}); describe('DefaultAwsCredentialsManager', () => { beforeEach(() => { @@ -127,12 +135,17 @@ describe('DefaultAwsCredentialsManager', () => { }, }); + const testDate = new Date('2022-01-10'); + process.env.AWS_ACCESS_KEY_ID = 'ACCESS_KEY_ID_10'; process.env.AWS_SECRET_ACCESS_KEY = 'SECRET_ACCESS_KEY_10'; process.env.AWS_SESSION_TOKEN = 'SESSION_TOKEN_10'; - process.env.AWS_CREDENTIAL_EXPIRATION = new Date( - '2022-01-10', - ).toISOString(); + process.env.AWS_CREDENTIAL_EXPIRATION = testDate.toISOString(); + + // Return creds from env + (fromNodeProviderChain as jest.Mock).mockImplementation( + jest.requireActual('@aws-sdk/credential-providers').fromNodeProviderChain, + ); const mockProfile = `[my-profile] aws_access_key_id=ACCESS_KEY_ID_9 @@ -431,5 +444,49 @@ describe('DefaultAwsCredentialsManager', () => { provider.getCredentialProvider({ accountId: '123456789012' }), ).rejects.toThrow(/No credentials found/); }); + + it('passes the region to getDefaultCredentialsChain', async () => { + const region = 'us-west-2'; + const configWithRegion = new ConfigReader({ + aws: { + mainAccount: { + region, + }, + }, + }); + + const provider = + DefaultAwsCredentialsManager.fromConfig(configWithRegion); + const awsCredentialProvider = await provider.getCredentialProvider(); + + // Trigger the call to fromNodeProviderChain + await awsCredentialProvider.sdkCredentialProvider(); + + expect(fromNodeProviderChain).toHaveBeenCalledWith({ + clientConfig: { + region, + }, + }); + }); + + it('uses default region when none is specified', async () => { + const configWithoutRegion = new ConfigReader({ + aws: { + mainAccount: {}, + }, + }); + + const provider = + DefaultAwsCredentialsManager.fromConfig(configWithoutRegion); + const awsCredentialProvider = await provider.getCredentialProvider(); + + await awsCredentialProvider.sdkCredentialProvider(); + + expect(fromNodeProviderChain).toHaveBeenCalledWith({ + clientConfig: { + region: 'us-east-1', + }, + }); + }); }); }); diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts index 12e1e2dffd..3048fdfe40 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts @@ -77,8 +77,15 @@ function getProfileCredentials( }); } -function getDefaultCredentialsChain(): AwsCredentialIdentityProvider { - return fromNodeProviderChain(); +/** + * Include the region if present, otherwise use the default region. + * + * @see https://www.npmjs.com/package/@aws-sdk/credential-provider-node + */ +function getDefaultCredentialsChain( + region = 'us-east-1', +): AwsCredentialIdentityProvider { + return fromNodeProviderChain({ clientConfig: { region } }); } /** @@ -123,7 +130,7 @@ function getSdkCredentialProvider( return getProfileCredentials(config.profile!, config.region); } - return getDefaultCredentialsChain(); + return getDefaultCredentialsChain(config.region); } /** @@ -145,7 +152,7 @@ function getMainAccountSdkCredentialProvider( return getProfileCredentials(config.profile!, config.region); } - return getDefaultCredentialsChain(); + return getDefaultCredentialsChain(config.region); } /**