spring-projects / spring-projects/spring-vault
AwsIamAuthentication fails with Credential should be scoped to a valid region when migrating from spring-vault-core 2.3.3 to 3.1.1
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 306
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
I have upgrade from spring-vault-core 2.3.3 to 3.1.1 and using AwsIamAuthentication
public ClientAuthentication createClientAuthentication() {
AwsCredentialsProvider credentialsProvider = DefaultCredentialsProvider.create();
AwsIamAuthenticationOptions options = AwsIamAuthenticationOptions.builder()
.credentialsProvider(credentialsProvider)
.region(Region.US_WEST_2). I have tried adding this filed in 3.1.1 as vault and instances are in us-west-2
.role(InfrastructureInfo.getInstance().getVaultRole())
.build();
return new AwsIamAuthentication(options, VaultUtils.getRestOptions());
}
Exception-
org.springframework.vault.authentication.VaultLoginException: Cannot login using AWS-IAM: error making upstream request: received error code 403 from STS: ](https://sts.amazonaws.com/doc/2011-06-15/%22%3E)
Sender
SignatureDoesNotMatch
Credential should be scoped to a valid region.
b38c3d6a-ae0a-4f08-b768-94ad7b53b82e
Java-17
SpringBoot-3.2.0
Spring Framework- 6.1.+
From CLI I am able to read data.
Vault v1.9.4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with AwsIamAuthentication and the createClientAuthentication configuration shown in the report, reproducing the migration on Java 17, Spring Boot 3.2.0, and Vault 1.9.4. Compare the AWS IAM request and region handling between spring-vault-core 2.3.3 and 3.1.1, then verify the fix by confirming that login succeeds against the us-west-2 setup without the STS region error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- authentication, cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100