fix: aws iam external identities region

[nimish-ks]

🔍 Overview

Fix AWS region handling for Service Accounts with multiple External Identities.

Addresses: #692

💡 Proposed Changes

• Handle AWS STS endpoint region context from incoming requests correctly before validating trusted entities

✨ How to Test the Changes Locally

Attach multiple external identities to a service accounts (different regions, trusted principles) Try:

• Same principles, different region
• Different principles, same region
• Multiple external identities with the same region, different trusted principal

💚 Did You...

• Ensure linting passes (code style checks)?
• Update dependencies and lockfiles (if required)
• Update migrations (if required)
• Regenerate graphql schema and types (if required)
• Verify the app builds locally?
• Manually test the changes on different browsers/devices?

---

Note

Selects AWS IAM identity by STS endpoint host when multiple are attached, adding host normalization utility.

• Backend – AWS IAM auth (backend/api/views/identities/aws/iam.py):

  • Selects the aws_iam identity by matching the request’s STS endpoint host to the identity’s config.stsEndpoint when multiple identities exist (falls back to first).
  • Adds get_normalized_host to robustly extract/normalize hosts from URLs.

• Utilities:

  • Minor docstring tweak in resolve_attached_identity (no functional change).

^{Written by Cursor Bugbot for commit c760317. This will update automatically on new commits. Configure here.}

[Copilot]

Pull request overview

This PR fixes AWS IAM authentication to correctly resolve region-specific identities when multiple AWS IAM identities are attached to a single service account. Instead of always using the first identity, the system now matches identities based on the STS endpoint hostname from the signed request.

Key Changes:

• Added multi-identity selection logic that matches based on STS endpoint host
• Introduced get_normalized_host() utility function for consistent URL hostname extraction
• Removed dependency on resolve_attached_identity() helper in favor of inline filtering

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
backend/api/views/identities/aws/iam.py	Added get_normalized_host() function and multi-identity selection logic to match identities by STS endpoint host when multiple AWS IAM identities exist
backend/api/utils/identity/common.py	Updated docstring for resolve_attached_identity() to clarify it returns first available identity (documentation-only change)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.