weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve aws GetSession comments that explain when and why regions have to be set

Browse Source 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
This commit is contained in:
Tim Ramlot 2024-06-19 17:15:07 +02:00
parent 537e71ee63
commit cad5470a56
No known key found for this signature in database
GPG Key ID: 47428728E0C2878D
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/issuer/acme/dns/route53/route53.go
View File

@ -97,8 +97,10 @@ func (d *sessionProvider) GetSession(ctx context.Context) (aws.Config, error) {
return aws.Config{}, fmt.Errorf("unable to create aws config: %s", err)
}
// Explicitly set the region to aws-global so that AssumeRole can be used
// with the global sts endpoint.
// For backwards compatibility with cert-manager <= 1.14, where we used the aws-sdk-go v1
// library, we configure the SDK here to use the global sts endpoint. This was the default
// behaviour of the SDK v1 library, but has to be explicitly set in the v2 library. For the
// route53 calls, we use the region provided by the user (see below).
stsCfg := cfg.Copy()
stsCfg.Region = "aws-global"
@ -142,7 +144,8 @@ func (d *sessionProvider) GetSession(ctx context.Context) (aws.Config, error) {
// If ambient credentials aren't permitted, always set the region, even if to
// empty string, to avoid it falling back on the environment.
// this has to be set after session is constructed
// This has to be set after session is constructed, as a different region (aws-global)
// is used for the STS service.
if d.Region != "" || !useAmbientCredentials {
cfg.Region = d.Region
}