Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[8.11] Set region for the STS client via privileged calls in AWS SDK (#102230) #102285

Merged
merged 1 commit into from
Nov 16, 2023
Merged

[8.11] Set region for the STS client via privileged calls in AWS SDK (#102230) #102285

merged 1 commit into from
Nov 16, 2023

Commits on Nov 16, 2023

  1. Set region for the STS client via privileged calls in AWS SDK (elasti… 

    …c#102230)

Unfortunately, `AWSSecurityTokenServiceClientBuilder#setRegion` is not just a setter on the builder. It looks up the region by its name which lazily initializes some regional configuration. As a result, the call with an access denied error, because the caller doesn't have permission to call `accessDeclaredMembers` in some Jackson internals.

This bug wasn't caught by the `CustomWebIdentityTokenCredentialsProviderTests#testSupportRegionalizedEndpoints` test because it's under with the test framework that does allow naked reflection calls.

We fix that in two ways:

*  Make sure withRegion call is privileged
*  Eagerly lookup region metadata in `S3Repository` 

Fixes elastic#102173
    @arteam
    arteam committed Nov 16, 2023
    Configuration menu
    Copy the full SHA
    0a8665c View commit details
    Browse the repository at this point in the history