add support for sts regional interface endpoints #227
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue #, Not available
Issue Description
PublicSubnets (has i-gw)
orPrivateSubnets (has nat-gw).
It is unable to call AWS STS even when the VPC has InterfaceEndpoints to access AWS services like ECR, STS, S3, DynamoDB.sts.eu-west-1.amazonaws.com
etc.region_name
parameter is specified, it hits the global endpoint -sts.amazon.com
instead of regional endpoints. There are two reasons behind this behavior -a. Some of the regions don't have regional STS endpoints itself
b. I read somewhere (can't verify correctness!) that it does that for historical reasons - some critical infra was breaking when they tried to move it to regional endpoints.
PrivateSubnet (NAT-GW)
! But what if we don't want that due to security reasons and multitude of other reasons?Changes / Solution
endpoint_url
parameter while creating the sts client using boto3. This change has been implemented in this CR.Testing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.