fix(NODE-5551): set AWS region from environment variable for STSClient

[nbbeeken]

Description

What is changing?

• Adding detection for AWS_STS_REGIONAL_ENDPOINTS and AWS_REGION environment variables and setting the corresponding fromNodeProviderChain options.
• LEGACY_REGIONS is created from this: https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html documentation
• The driver will only set region options if BOTH environment variables are present, this is so that the driver does not encode a default setting for AWS_STS_REGIONAL_ENDPOINTS.

Is there new documentation needed for these changes?

Yes. Will file a docs ticket.

What is the motivation for this change?

AWS recommends setting your STS region to be as close to your app as possible to reduce latency but currently, the JS SDK does not use the common AWS region environment variables, and the setting must be controlled programmatically.

Tracking issue here: aws/aws-sdk-js-v3#5105

Release Highlight

Use region settings for STS AWS credentials request

When using IAM AssumeRoleWithWebIdentity AWS authentication the driver uses the @aws-sdk/credential-providers package to contact the Security Token Service API for temporary credentials. AWS recommends using Regional AWS STS endpoints instead of the global endpoint to reduce latency, build-in redundancy, and increase session token validity. Unfortunately, environment variables AWS_STS_REGIONAL_ENDPOINTS and AWS_REGION do not directly control the region the SDK's STS client contacts for credentials.

The driver now has added support for detecting these variables and setting the appropriate options when calling the SDK's API: fromNodeProviderChain().

Important

The driver will only set region options if BOTH environment variables are present. AWS_STS_REGIONAL_ENDPOINTS MUST be set to either 'legacy' or 'regional', and AWS_REGION must be set.

Double check the following

• Ran npm run check:lint script
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Release notes are filled out
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[nbbeeken]

Looking at the tests on this task:

aws-6.0-auth-test-run-aws-auth-test-AssumeRoleWithWebIdentity-with-AWS_ROLE_SESSION_NAME-set

[W-A-James]

Apart from the one question on the test file (which I won't block on), LGTM