Default sts client config to regional endpoints #3309
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Around 2022, AWS announced that all new SDKs would change the default STS endpoint behavior from the `legacy` endpoint to `regional` as documented [here](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html). > All new SDK major versions releasing after July 2022 will default to regional. > New SDK major versions might remove this setting and use regional behavior. > To reduce future impact regarding this change, we recommend you start using > regional in your application when possible. This is used when clients call `sts:AssumeRole`. Using the `legacy` behavior, clients connect to `sts.amazonaws.com,` which lives in `us-east-1.` Workloads outside of that region using this configuration unknowingly depend on that region since they are not using the `regional` endpoint where their code runs. botocore was never updated, so today, all calls to the STS API, unless otherwise explicitly configured, will use the "global" endpoint in `us-east-1.` There was an [outage in Aug 2024](https://health.aws.amazon.com/health/status?eventID=arn:aws:health:global::event/IAM/AWS_IAM_OPERATIONAL_ISSUE/AWS_IAM_OPERATIONAL_ISSUE_C9750_3CF4B9D9C39) which impacted STS in `us-east-1`. Had botocore been updated, this specific event would not have impaired workloads running in other regions using a default client. This PR attempts to align the new "default" to `regional` as specified by the documentation. Should you require the old behavior, you can always set the environment variable to override the new default back to `legacy` (as documented): ``` export AWS_STS_REGIONAL_ENDPOINTS=legacy ``` A follow-up change to the documentation [here](https://github.com/boto/boto3/blob/f46cfc9eee4c5f3961ad53475d1623d7f01b6bef/docs/source/guide/configuration.rst?plain=1#L415) will be needed to reflect this change. Not a Python guru here, so I did my best at a first crack. Please review. Thanks!
2 tasks
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## develop #3309 +/- ##
========================================
Coverage 93.19% 93.19%
========================================
Files 66 66
Lines 14376 14377 +1
========================================
+ Hits 13397 13398 +1
Misses 979 979 ☔ View full report in Codecov by Sentry. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Around 2022, AWS announced that all new SDKs would change the default STS endpoint behavior from the
legacyendpoint toregionalas documented here.This is used when clients call
sts:AssumeRole. Using thelegacybehavior, clients connect tosts.amazonaws.com,which lives inus-east-1.Workloads outside of that region using this configuration unknowingly depend on that region since they are not using theregionalendpoint where their code runs.botocore was never updated, so today, all calls to the STS API, unless otherwise explicitly configured, will use the "global" endpoint in
us-east-1.There was an outage in Aug 2024 which impacted STS in
us-east-1.Had botocore been updated, this specific event would not have impaired workloads running in other regions using a default client.
This PR attempts to align the new "default" to
regionalas specified by the documentation.Should you require the old behavior, you can always set the environment variable to override the new default back to
legacy(as documented):A follow-up change to the documentation here will be needed to reflect this change.
Not a Python guru here, so I did my best at a first crack. Please review.
Thanks!