Skip to content

Commit ccc6608

Browse files
bshafferbshaffer
authored
fix: STS region_url should optional (#1211)
* fix: STS region_url should optional
1 parent 9a49527 commit ccc6608

File tree

1 file changed

+11
-10
lines changed

1 file changed

+11
-10
lines changed

‎aip/auth/4117.md‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ endpoint.
205205
| Field Name | Required | Description |
206206
|--------------------------------------------------|----------|:------------|
207207
| environment_id | Yes | This is the environment identifier, of format `aws${version}`. A version should be specified to indicate to the auth library whether breaking changes were introduced to the underlying AWS implementation. So if aws1 is supported in the current version of the library but a credential file with aws2 is provided, an error should be thrown instructing the developer to upgrade to a newer version of the library. |
208-
| region_url | Yes | This URL should be used to determine the current AWS region needed for the signed request construction. |
208+
| region_url | No | This URL should be used to determine the current AWS region needed for the signed request construction when the region environment variables are not present. |
209209
| url | No | This AWS metadata server URL should be used to retrieve the access key, secret key and security token needed to sign the `GetCallerIdentity` request. The $ROLE_NAME should be retrieved from calling this endpoint without any parameter and then calling again with the returned role name appended to this URL: http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE_NAME |
210210
| regional_cred_verification_url | Yes | This defines the regional AWS `GetCallerIdentity` action URL. This URL should be used to determine the AWS account ID and its roles. This should not actually be called by the Auth libraries. It should be called on the STS token server. The region should be substituted by SDK, e.g. `sts.eu-west-1.amazonaws`.com. |
211211
| imdsv2_session_token_url | No | Presence of this URL enforces the auth libraries to fetch a Session Token from AWS. This field is required for EC2 instances using IMDSv2. This Session Token would later be used while making calls to the metadata enpoint. |
@@ -244,7 +244,7 @@ The auth libraries and applications **must** follow the steps below:
244244
- Check the environment variables in the following order (`AWS_REGION` and
245245
then the `AWS_DEFAULT_REGION`) to determine the AWS region. If found, skip
246246
using the AWS metadata server to determine this value.
247-
- If the region environment variable is not provided, use the **region_url**
247+
- If the region environment variables are not provided, use the **region_url**
248248
to determine the current AWS region. The API returns the zone name, e.g.
249249
`us-east-1d`. The region should be determined by stripping the last
250250
character, e.g. `us-east-1`.
@@ -279,7 +279,7 @@ The auth libraries and applications **must** follow the steps below:
279279
{
280280
"value": "AWS4-HMAC-SHA256 Credential=AKIASOZTBDV4D7ABCDEDF/20200228/us-east-1/sts/aws4_request, SignedHeaders=host;x-amz-date,Signature=abcedefdfedfd",
281281
"key": "Authorization"
282-
},
282+
},
283283
{
284284
"value": "sts.us-east-1.amazonaws.com",
285285
"key": "host"
@@ -288,7 +288,7 @@ The auth libraries and applications **must** follow the steps below:
288288
"value": "IQoJb3JpZ2luX2VjEIz//////////wEaCXVzLWVh...",
289289
"key": "x-amz-security-token"
290290
}
291-
],
291+
],
292292
"method": "POST",
293293
"body": ""
294294
}
@@ -375,7 +375,7 @@ in the `credential_source` object to facilitate retrieval of file-sourced
375375
credentials to be passed as subject tokens to the GCP STS token exchange
376376
endpoint.
377377

378-
| Field Name | Required | Description |
378+
| Field Name | Required | Description |
379379
|---------------------------------------------------|----------|:------------|
380380
| file | Yes | This is the source of the credential. This should be used for a credential locally available. This should take precedence over `url` when both are provided. |
381381
| format.type | No | This indicates the format of the file where the token is stored. This can be either "text" or "json". The default should be "text". |
@@ -419,7 +419,7 @@ in the `credential_source` object to facilitate retrieval of executable-sourced
419419
credentials to be passed as subject tokens to the GCP STS token exchange
420420
endpoint.
421421

422-
| Field Name | Required | Description |
422+
| Field Name | Required | Description |
423423
|---------------------------|----------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
424424
| executable | Yes | Holds the information necessary to run the executable. |
425425
| executable.command | Yes | Specifies the full command to run to retrieve the subject token. This can include arguments. Must be an absolute path for the program. |
@@ -452,7 +452,7 @@ Additionally, the executable **must** adhere to the following response format:
452452

453453
Successful responses:
454454

455-
| Field Name | Type | Description |
455+
| Field Name | Type | Description |
456456
|---------------------------|---------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
457457
| version | number | The version of the JSON output. Currently only version 1 is supported. |
458458
| success | boolean | The status of the response. True in this case. |
@@ -484,7 +484,7 @@ A sample successful executable SAML response:
484484

485485
Error responses:
486486

487-
| Field Name | Type | Description |
487+
| Field Name | Type | Description |
488488
|------------|---------|:-----------------------------------------------------------------------|
489489
| version | number | The version of the JSON output. Currently only version 1 is supported. |
490490
| success | boolean | The status of the response. False in this case. | |
@@ -509,7 +509,7 @@ The auth libraries and applications **must** follow the steps below:
509509
**credential_source.executable** field.
510510
- Check that the `GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES` environment variable is set to **1**. If not, error out.
511511
- Before the next step, check if **credential_source.executable.output_file** was specified in the credential configuration.
512-
- If present, check if there is an executable response at that location.
512+
- If present, check if there is an executable response at that location.
513513
- If the response is valid and unexpired, or there is no response at that location, continue execution.
514514
- If the response is malformed or invalid, error out.
515515
- Ensure the following environment variables will be available to the executable:
@@ -528,12 +528,13 @@ The auth libraries and applications **must** follow the steps below:
528528
**urn:ietf:params:oauth:token-type:id_token**, or **urn:ietf:params:oauth:token-type:saml2**.
529529
- If the **token_type** is **urn:ietf:params:oauth:token-type:saml2**, the subject token will be parsed from the **saml_response** field.
530530
- Otherwise it will be parsed from the **id_token** field.
531-
531+
532532
## Changelog
533533

534534
- **2021-12-10**: Add AIP for External Account Credentials (AIP 4117).
535535
- **2022-05-18**: Document executable-sourced credentials (AIP 4117).
536536
- **2022-08-31**: Document configurable token lifetime (AIP 4117).
537+
- **2023-09-12**: Mark region_url as optional (AIP 4117).
537538

538539
<!-- prettier-ignore-start -->
539540
[0]: https://cloud.google.com/iam/docs/configuring-workload-identity-federation#aws

0 commit comments

Comments
 (0)