That can't be right: no way to pass region to AssumeRole STS client

[rix0rrr]

I don't really have a reproducible case for this, but we're working on the AWS CDK using the JS SDK and we get repeated reports of "profiles not working" (no further details sometimes, so I can't really reproduce). While doing a source code review I'm noticing the following:

https://github.com/aws/aws-sdk-js/blob/master/lib/credentials/shared_ini_file_credentials.js#L231

There's no region passed to the STS client used for AssumeRole credentials.

I assume this is done because the assumption is that IAM is global, and so role credentials retrieved in one region will also work in any other region.

However, what about non-classical regions like the China regions and GovCloud? We've had reports of "profiles" not working with GovCloud (aws/aws-cdk#1109, unfortunately no further response but I can only imagine they were using assume-role credentials) and from my experience, since China regions are in a different partition with different credential databases, credentials retrieved in aws will not work in aws-cn, right?

---

So in short, my hypothetical bug report is that AssumeRole will be broken in China and GovCloud.

[srchase]

@rix0rrr

AssumeRole does not have a region option.

You can however set the endpoint on STS. If that region has been disabled (see Activating and Deactivating AWS STS in an AWS Region ), you'd get the RegionDisabled error.

[srchase]

Setting the endpoint on STS:

const sts = new AWS.STS({
  region: 'eu-west-1',
  endpoint: 'sts.eu-west-1.amazonaws.com'
});

const params = {
  ExternalId: '123ABC',
  RoleArn: 'arn:aws:iam::myAccountID:role/myRole',
  RoleSessionName: 'Bob'
}

sts.assumeRole(params, (err,data) => {
  console.log(err,data)
})

[rix0rrr]

Okay I have no idea how that STS client gets its region (given that there's no region argument to it), but it seems to work, so I've got nothing. Sorry for bothering you.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.