spring-projects / spring-projects/spring-vault

AwsIamAuthentication fails with Credential should be scoped to a valid region when migrating from spring-vault-core 2.3.3 to 3.1.1

Open
#871 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: ideal-for-contribution status: waiting-for-feedback
Dominant language
Java
Stars
306
Forks
202
PR merge metrics
No merged PRs in 30d

Description

I have upgrade from spring-vault-core 2.3.3 to 3.1.1 and using AwsIamAuthentication

public ClientAuthentication createClientAuthentication() {
AwsCredentialsProvider credentialsProvider = DefaultCredentialsProvider.create();
AwsIamAuthenticationOptions options = AwsIamAuthenticationOptions.builder()
.credentialsProvider(credentialsProvider)
.region(Region.US_WEST_2). I have tried adding this filed in 3.1.1 as vault and instances are in us-west-2
.role(InfrastructureInfo.getInstance().getVaultRole())
.build();
return new AwsIamAuthentication(options, VaultUtils.getRestOptions());
}
Exception-
org.springframework.vault.authentication.VaultLoginException: Cannot login using AWS-IAM: error making upstream request: received error code 403 from STS: ](https://sts.amazonaws.com/doc/2011-06-15/%22%3E)

Sender
SignatureDoesNotMatch
Credential should be scoped to a valid region.

b38c3d6a-ae0a-4f08-b768-94ad7b53b82e

Java-17
SpringBoot-3.2.0
Spring Framework- 6.1.+

From CLI I am able to read data.
Vault v1.9.4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with AwsIamAuthentication and the createClientAuthentication configuration shown in the report, reproducing the migration on Java 17, Spring Boot 3.2.0, and Vault 1.9.4. Compare the AWS IAM request and region handling between spring-vault-core 2.3.3 and 3.1.1, then verify the fix by confirming that login succeeds against the us-west-2 setup without the STS region error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
authentication, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.