Backport of Passes configured role name to Vault for AWS auth in Connect CA into release/1.16.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #17885 to be assessed for backporting due to the inclusion of the label backport/1.16.

The below text is copied from the body of the original PR.

---

Fixes #17887.

Description

When using Connect, with Vault CA, with AWS auth - this change ensures that the role name (if configured) is passed as part of the login request. Prior to this change, Consul did not respect this parameter and therefore always falls back to the default Vault behaviour of using the instance AWS IAM role name, even if role was specified in params.

Testing & Reproduction steps

• Added additional coverage to the existing TestVaultCAProvider_AWSLoginDataGenerator tests.

To reproduce original bug

1. Create a file with CA configuration, e.g.

{
  "Provider": "vault",
  "Config": {
    "Address": "https://my.vault.server:8200",
    "IntermediatePKIPath": "pki_int",
    "RootPKIPath": "pki",
    "AuthMethod": {
      "Type": "aws",
      "MountPath": "aws",
      "Params": {
        "role": "configured-role-name"
      }
    }
  }
}

2. Set CA configuration

consul connect ca set-config -config-file ca.conf

3. Observe that role is not sent to Vault, Vault will attempt to use the IAM instance role name and fail if this does not exist as a Vault role.

Links

• Vault AWS auth method login request params
  https://developer.hashicorp.com/vault/api-docs/auth/aws#login
• Vault CLI implementation of AWS auth
  https://github.com/hashicorp/vault/blob/f381fba4a6468921c4d7d90e04db7bfb9bef4f52/builtin/credential/aws/cli.go#L67
• AWS auth for Vault Connect CA ignores "role" param #17887
• Support ticket: 115239

PR Checklist

• updated test coverage
• external facing docs updated (Not applicable)
• appropriate backport labels added
• not a security concern

---

Overview of commits

• 4034bb2 - 9c4c3c5 - 7282078

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR