Don't force the use of FIPS endpoints for DynamoDB Streams and Application Auto Scaling

[reedloden]

DynamoDB Streams and Application Auto Scaling do not currently have FIPS endpoints in non-GovCloud, leading to invalid endpoints for FIPS users running in AWS Standard.

See also: https://aws.amazon.com/compliance/fips/#FIPS_Endpoints_by_Service

Regression from #34170.

Fixes #34804.

Additionally, clean-up a few more AWS session initiations to be consistent and clear.

changelog: Don't force the use of FIPS endpoints for DynamoDB Streams and Application Auto Scaling

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[rosstimothy]

Could you please add some tests that validate the behavior change?

[GavinFrazar]

LGTM but I didn't test it.

I think the same issue can happen with AWS Application Auto Scaling though, since it also does not have fips endpoints in non-gov cloud.

We use that here:

teleport/lib/backend/dynamo/dynamodbbk.go

Lines 348 to 360 in 8aee840

	// Enable auto scaling if requested.
	if b.Config.EnableAutoScaling {
	if err := SetAutoScaling(ctx, applicationautoscaling.New(b.session), GetTableID(b.TableName), AutoScalingParams{
	ReadMinCapacity: b.Config.ReadMinCapacity,
	ReadMaxCapacity: b.Config.ReadMaxCapacity,
	ReadTargetValue: b.Config.ReadTargetValue,
	WriteMinCapacity: b.Config.WriteMinCapacity,
	WriteMaxCapacity: b.Config.WriteMaxCapacity,
	WriteTargetValue: b.Config.WriteTargetValue,
	}); err != nil {
	return nil, trace.Wrap(err)
	}
	}

If you've already tested this could you try setting auto_scaling: true in your teleport.storage dynamodb config?

[reedloden]

Could you please add some tests that validate the behavior change?

I flipped the logic so that we only force FIPS endpoints for the services we know support it (mainly DynamoDB in this case). This obliviated the need for extra complexity, so I don't think a separate test is needed.

[reedloden]

I think the same issue can happen with AWS Application Auto Scaling though, since it also does not have fips endpoints in non-gov cloud.

Good catch. As mentioned above, I flipped the logic so that we're only forcing FIPS endpoints for DynamoDB in this case (and not DynamoDB Streams or Application Auto Scaling). So, that should address this issue.

[rosstimothy]

Tests would still be useful to verify that we are using the correct endpoints to prevent regressions.

[public-teleport-github-review-bot]

@reedloden See the table below for backport results.

Branch	Result
branch/v14	Create PR