fix: some custom resources don't work in opt-in regions

packages/@aws-cdk/aws-eks/lib/cluster-resource-handler/index.ts

@@ -32,6 +32,7 @@ const defaultEksClient: EksClient = {
     console.log(JSON.stringify({ assumeRole: req }, undefined, 2));
     const creds = new aws.ChainableTemporaryCredentials({
       params: req,
+      stsConfig: { stsRegionalEndpoints: 'regional' },
     });
 
     eks = new aws.EKS({ credentials: creds });

packages/@aws-cdk/aws-route53/lib/cross-account-zone-delegation-handler/index.ts

@@ -51,7 +51,7 @@ async function cfnEventHandler(props: ResourceProperties, isDeleteEvent: boolean
 }
 
 async function getCrossAccountCredentials(roleArn: string): Promise<Credentials> {
-  const sts = new STS();
+  const sts = new STS({ stsRegionalEndpoints: 'regional' });
   const timestamp = (new Date()).getTime();
 
   const { Credentials: assumedCredentials } = await sts

packages/@aws-cdk/core/lib/custom-resource-provider/custom-resource-provider.ts

@@ -320,6 +320,11 @@ export class CustomResourceProvider extends Construct {
       return undefined;
     }
 
+    env = { ...env }; // Copy
+
+    // Always use regional endpoints
+    env.AWS_STS_REGIONAL_ENDPOINTS = 'regional';
+
     // Sort environment so the hash of the function used to create
     // `currentVersion` is not affected by key order (this is how lambda does
     // it)

packages/@aws-cdk/core/test/custom-resource-provider/custom-resource-provider.test.ts

@@ -282,10 +282,10 @@ describe('custom resource provider', () => {
     const template = toCloudFormation(stack);
     const lambda = template.Resources.CustomMyResourceTypeCustomResourceProviderHandler29FBDD2A;
     expect(lambda.Properties.Environment).toEqual({
-      Variables: {
+      Variables: expect.objectContaining({
         A: 'a',
         B: 'b',
-      },
+      }),
     });
 
   });

packages/@aws-cdk/custom-resources/lib/aws-custom-resource/runtime/index.ts

@@ -171,6 +171,7 @@ export async function handler(event: AWSLambda.CloudFormationCustomResourceEvent
 
         credentials = new AWS.ChainableTemporaryCredentials({
           params: params,
+          stsConfig: { stsRegionalEndpoints: 'regional' },
         });
       }