backport of commit 8a84d13 (#30417)

Co-authored-by: kpcraig <[email protected]>

Author: hc-github-team-secure-vault-core

builtin/logical/aws/client.go

@@ -24,19 +24,79 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-const fallbackEndpoint = "https://sts.amazonaws.com" // this is not regionally distributed; all requests go to us-east-1
+// getRootIAMConfig creates an *aws.Config for Vault to connect to IAM.
+func (b *backend) getRootIAMConfig(ctx context.Context, s logical.Storage, logger hclog.Logger) (*aws.Config, error) {
+	credsConfig := &awsutil.CredentialsConfig{}
+	var endpoint string
+	var maxRetries int = aws.UseServiceDefaultRetries
+
+	entry, err := s.Get(ctx, "config/root")
+	if err != nil {
+		return nil, err
+	}
+	if entry != nil {
+		var config rootConfig
+		if err := entry.DecodeJSON(&config); err != nil {
+			return nil, fmt.Errorf("error reading root configuration: %w", err)
+		}
+
+		credsConfig.AccessKey = config.AccessKey
+		credsConfig.SecretKey = config.SecretKey
+		credsConfig.Region = config.Region
+		maxRetries = config.MaxRetries
+
+		if config.IAMEndpoint != "" {
+			endpoint = *aws.String(config.IAMEndpoint)
+		}
+
+		if config.IdentityTokenAudience != "" {
+			ns, err := namespace.FromContext(ctx)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get namespace from context: %w", err)
+			}
+
+			fetcher := &PluginIdentityTokenFetcher{
+				sys:      b.System(),
+				logger:   b.Logger(),
+				ns:       ns,
+				audience: config.IdentityTokenAudience,
+				ttl:      config.IdentityTokenTTL,
+			}
+
+			sessionSuffix := strconv.FormatInt(time.Now().UnixNano(), 10)
+			credsConfig.RoleSessionName = fmt.Sprintf("vault-aws-secrets-%s", sessionSuffix)
+			credsConfig.WebIdentityTokenFetcher = fetcher
+			credsConfig.RoleARN = config.RoleARN
+		}
+	}
+
+	if credsConfig.Region == "" {
+		credsConfig.Region = getFallbackRegion()
+	}
+
+	credsConfig.HTTPClient = cleanhttp.DefaultClient()
+
+	credsConfig.Logger = logger
+
+	creds, err := credsConfig.GenerateCredentialChain()
+	if err != nil {
+		return nil, err
+	}
+
+	return &aws.Config{
+		Credentials: creds,
+		Region:      aws.String(credsConfig.Region),
+		Endpoint:    &endpoint,
+		HTTPClient:  cleanhttp.DefaultClient(),
+		MaxRetries:  aws.Int(maxRetries),
+	}, nil
+}
 
 // Return a slice of *aws.Config, based on descending configuration priority. STS endpoints are the only place this is used.
 // NOTE: The caller is required to ensure that b.clientMutex is at least read locked
-func (b *backend) getRootConfigs(ctx context.Context, s logical.Storage, clientType string, logger hclog.Logger) ([]*aws.Config, error) {
+func (b *backend) getRootSTSConfigs(ctx context.Context, s logical.Storage, logger hclog.Logger) ([]*aws.Config, error) {
 	// set fallback region (we can overwrite later)
-	fallbackRegion := os.Getenv("AWS_REGION")
-	if fallbackRegion == "" {
-		fallbackRegion = os.Getenv("AWS_DEFAULT_REGION")
-	}
-	if fallbackRegion == "" {
-		fallbackRegion = "us-east-1"
-	}
+	fallbackRegion := getFallbackRegion()
 
 	maxRetries := aws.UseServiceDefaultRetries
 
@@ -81,13 +141,16 @@ func (b *backend) getRootConfigs(ctx context.Context, s logical.Storage, clientT
 	credsConfig.HTTPClient = cleanhttp.DefaultClient()
 	credsConfig.Logger = logger
 
+	if config.Region != "" {
+		regions = append(regions, config.Region)
+	}
+
 	maxRetries = config.MaxRetries
-	if clientType == "iam" && config.IAMEndpoint != "" {
-		endpoints = append(endpoints, config.IAMEndpoint)
-	} else if clientType == "sts" && config.STSEndpoint != "" {
+	if config.STSEndpoint != "" {
 		endpoints = append(endpoints, config.STSEndpoint)
 		if config.STSRegion != "" {
-			regions = append(regions, config.STSRegion)
+			// this retains original logic, where sts region was only used if sts endpoint was set
+			regions = []string{config.STSRegion} // override to be "only" region if set
 		}
 
 		if len(config.STSFallbackEndpoints) > 0 {
@@ -124,23 +187,22 @@ func (b *backend) getRootConfigs(ctx context.Context, s logical.Storage, clientT
 		opts = append(opts, awsutil.WithEnvironmentCredentials(false), awsutil.WithSharedCredentials(false))
 	}
 
-	// at this point, in the IAM case, regions contains nothing, and endpoints contains iam_endpoint, if it was set.
-	// in the sts case, regions contains sts_region, if it was set, then the sts_fallback_regions in order, if they were set.
-	//                  endpoints contains sts_endpint, if it wa set, then sts_fallback_endpoints in order, if they were set.
+	// at this point, in the IAM case,
+	// - regions contains config.Region, if it was set.
+	// - endpoints contains iam_endpoint, if it was set.
+	// in the sts case,
+	// - regions contains sts_region, if it was set, then sts_fallback_regions in order, if they were set.
+	// - endpoints contains sts_endpoint, if it was set, then sts_fallback_endpoints in order, if they were set.
 
 	// case in which nothing was supplied
 	if len(regions) == 0 {
 		// fallback region is in descending order, AWS_REGION, or AWS_DEFAULT_REGION, or us-east-1
 		regions = append(regions, fallbackRegion)
+	}
 
-		// we also need to set the endpoint based on this region (since we need matched length arrays)
-		if len(endpoints) == 0 {
-			switch clientType {
-			case "sts":
-				endpoints = append(endpoints, matchingSTSEndpoint(fallbackRegion))
-			case "iam":
-				endpoints = append(endpoints, "https://iam.amazonaws.com") // see https://docs.aws.amazon.com/general/latest/gr/iam-service.html
-			}
+	if len(endpoints) == 0 {
+		for _, v := range regions {
+			endpoints = append(endpoints, matchingSTSEndpoint(v))
 		}
 	}
 
@@ -181,14 +243,10 @@ func (b *backend) nonCachedClientIAM(ctx context.Context, s logical.Storage, log
 			return nil, fmt.Errorf("failed to assume role %q: %w", entry.AssumeRoleARN, err)
 		}
 	} else {
-		configs, err := b.getRootConfigs(ctx, s, "iam", logger)
+		awsConfig, err = b.getRootIAMConfig(ctx, s, logger)
 		if err != nil {
 			return nil, err
 		}
-		if len(configs) != 1 {
-			return nil, errors.New("could not obtain aws config")
-		}
-		awsConfig = configs[0]
 	}
 
 	sess, err := session.NewSession(awsConfig)
@@ -203,7 +261,7 @@ func (b *backend) nonCachedClientIAM(ctx context.Context, s logical.Storage, log
 }
 
 func (b *backend) nonCachedClientSTS(ctx context.Context, s logical.Storage, logger hclog.Logger) (*sts.STS, error) {
-	awsConfig, err := b.getRootConfigs(ctx, s, "sts", logger)
+	awsConfig, err := b.getRootSTSConfigs(ctx, s, logger)
 	if err != nil {
 		return nil, err
 	}
@@ -238,6 +296,23 @@ func matchingSTSEndpoint(stsRegion string) string {
 	return fmt.Sprintf("https://sts.%s.amazonaws.com", stsRegion)
 }
 
+// getFallbackRegion returns an aws region fallback. It will check in the AWS specified order:
+// - AWS_REGION, then
+// - AWS_DEFAULT_REGION, then
+// - us-east-1
+func getFallbackRegion() string {
+	// set fallback region (we can overwrite later)
+	fallbackRegion := os.Getenv("AWS_REGION")
+	if fallbackRegion == "" {
+		fallbackRegion = os.Getenv("AWS_DEFAULT_REGION")
+	}
+	if fallbackRegion == "" {
+		fallbackRegion = "us-east-1"
+	}
+
+	return fallbackRegion
+}
+
 // PluginIdentityTokenFetcher fetches plugin identity tokens from Vault. It is provided
 // to the AWS SDK client to keep assumed role credentials refreshed through expiration.
 // When the client's STS credentials expire, it will use this interface to fetch a new