SSO OIDC endpoint uses .amazonaws.com instead of .amazonaws.eu for AWS European Sovereign Cloud regions

[masterElmar]

When using assume with --sso flags targeting an AWS European Sovereign Cloud region (e.g. eusc-de-east-1), the SSO OIDC RegisterClient call fails because Granted constructs the endpoint URL using the .amazonaws.com domain instead of the correct .amazonaws.eu domain required by the AWS Sovereign Cloud partition.

The AWS_ENDPOINT_URL_SSO_OIDC environment variable override has no effect, confirming that Granted does not respect standard AWS SDK endpoint override mechanisms for this call.

Granted Version: v0.38.0

Your config:

[sso-session esc-sso]
sso_start_url     = https://identitycenter.amazonaws.eu/ssoins-********
sso_region        = eusc-de-east-1
sso_registration_scopes = sso:account:access
endpoint_url = https://oidc.eusc-de-east-1.amazonaws.eu

[profile esc-management]
sso_session       = esc-sso
sso_account_id = ***
sso_role_name  = AwsTeam
region                = eusc-de-east-1
output               = json

Steps to replicate:

Working aws cli command:

aws sso login --profile esc-management

1. Configure an AWS profile targeting an AWS European Sovereign Cloud region (eusc-de-east-1) with an SSO start URL on identitycenter.amazonaws.eu
2. Run:

   assume --sso --sso-start-url https://identitycenter.amazonaws.eu/*** --sso-region eusc-de-east-1 --account-id *** --role-name AwsTeam --no-cache
   

3. Observe the failure:

   operation error SSO OIDC: RegisterClient, https response error StatusCode: 0, RequestID: ,
   request send failed, Post "https://oidc.eusc-de-east-1.amazonaws.com/client/register":
   dial tcp: lookup oidc.eusc-de-east-1.amazonaws.com: no such host
   

Expected behavior:

Granted should resolve the correct OIDC endpoint based on the AWS partition. For the aws-eu-sovcloud partition, the endpoint must use .amazonaws.eu:

https://oidc.eusc-de-east-1.amazonaws.eu/client/register

This is exactly the endpoint the AWS CLI uses successfully for the same region and credentials.

Additional context:

The AWS CLI handles this correctly — aws sso login --profile esc-management resolves and calls https://oidc.eusc-de-east-1.amazonaws.eu without any issues. The AWS SDK determines the correct endpoint domain based on the partition (aws-eu-sovcloud), but Granted appears to bypass this logic and hardcodes .amazonaws.com when constructing the OIDC endpoint URL.

Setting AWS_ENDPOINT_URL_SSO_OIDC=https://oidc.eusc-de-east-1.amazonaws.eu has no effect, which suggests the endpoint is not being sourced from the SDK's endpoint resolution chain at all.

Potential fix:

The OIDC endpoint construction in Granted should delegate to the AWS SDK's endpoint resolver rather than building the URL manually. This would ensure correct behavior across all AWS partitions (aws, aws-cn, aws-us-gov, aws-eu-sovcloud, etc.) without requiring hardcoded domain suffixes.

Workaround:

Authenticate via the AWS CLI first, then use Granted without --no-cache to reuse the cached SSO token:

aws sso login --profile esc-management
assume esc-management