Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Release artifact now takes endpoint for regional sts #92

Merged
merged 1 commit into from
Jun 14, 2021

Conversation

royjit
Copy link
Contributor

@royjit royjit commented Jun 13, 2021

Description of changes: Previous PR did not properly updated the regional end point for STS. We have to provide the endpoint to make it work correctly.

Just giving the region in Boto3 will not work - boto/boto3#1859

Cloudtrail without this change

{
            "eventVersion": "1.08",
            "userIdentity": {
                "type": "IAMUser",
                "principalId": "xx",
                "arn": "arn:aws:iam::xx:user/CircleCIReleaseProcessIAMUser",
                "accountId": "xx",
                "accessKeyId": "xx",
                "userName": "CircleCIReleaseProcessIAMUser"
            },
            "eventTime": "2021-06-12T01:04:32Z",
            "eventSource": "sts.amazonaws.com",
            "eventName": "AssumeRole",
            "awsRegion": "us-east-1",
            "sourceIPAddress": "xx",
            "userAgent": "xx",
            "requestParameters": {
                "roleArn": "arn:aws:iam::xxx:role/CircleCIReleaseProcessRole",
                "roleSessionName": "CredentialRotationLambda-xx",
                "durationSeconds": 14400
            },
            "responseElements": {
                "credentials": {
                    "accessKeyId": "ASxx",
                    "expiration": "Jun 12, 2021 5:04:32 AM",
                    "sessionToken": "FwoGxx"
                },
                "assumedRoleUser": {
                    "assumedRoleId": "Axx",
                    "arn": "arn:aws:sts::xx:assumed-role/CircleCIReleaseProcessRole/CredentialRotationLambda-xx"
                }
            },
            "requestID": "xxx",
            "eventID": "xx",
            "readOnly": true,
            "resources": [
                {
                    "accountId": "xx",
                    "type": "AWS::IAM::Role",
                    "ARN": "arn:aws:iam::xx:role/CircleCIReleaseProcessRole"
                }
            ],
            "eventType": "AwsApiCall",
            "managementEvent": true,
            "eventCategory": "Management",
            "recipientAccountId": "xx",
            "tlsDetails": {
                "tlsVersion": "TLSv1.2",
                "cipherSuite": "xx",
                "clientProvidedHostHeader": "sts.amazonaws.com"
            }
        }

Cloudtrail with this change

{
            "eventVersion": "1.08",
            "userIdentity": {
                "type": "IAMUser",
                "principalId": "AIxx",
                "arn": "arn:aws:iam::xx:user/CircleCIReleaseProcessIAMUser",
                "accountId": "xx",
                "accessKeyId": "AKxx",
                "userName": "CircleCIReleaseProcessIAMUser"
            },
            "eventTime": "2021-06-13T21:19:20Z",
            "eventSource": "sts.amazonaws.com",
            "eventName": "AssumeRole",
            "awsRegion": "us-east-1",
            "sourceIPAddress": "xxx",
            "userAgent": "xxx",
            "requestParameters": {
                "roleArn": "arn:aws:iam::xx:role/CircleCIReleaseProcessRole",
                "roleSessionName": "CredentialRotationLambda-xx",
                "durationSeconds": 14400
            },
            "responseElements": {
                "credentials": {
                    "accessKeyId": "ASIxxx",
                    "expiration": "Jun 14, 2021 1:19:20 AM",
                    "sessionToken": "IQoJxxxx"
                },
                "assumedRoleUser": {
                    "assumedRoleId": "ARxx",
                    "arn": "arn:aws:sts::xx:assumed-role/CircleCIReleaseProcessRole/CredentialRotationLambda-xx"
                }
            },
            "requestID": "xx",
            "eventID": "xx",
            "readOnly": true,
            "resources": [
                {
                    "accountId": "xx",
                    "type": "AWS::IAM::Role",
                    "ARN": "arn:aws:iam::xx:role/CircleCIReleaseProcessRole"
                }
            ],
            "eventType": "AwsApiCall",
            "managementEvent": true,
            "eventCategory": "Management",
            "recipientAccountId": "xx",
            "tlsDetails": {
                "tlsVersion": "TLSv1.2",
                "cipherSuite": "xx",
                "clientProvidedHostHeader": "sts.us-east-1.amazonaws.com"
            }
        }

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@royjit royjit requested a review from palpatim June 13, 2021 21:57
@royjit royjit merged commit eab1055 into main Jun 14, 2021
@royjit royjit deleted the royjit.fixregion2 branch June 14, 2021 16:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants