AWS: ensure request parameters are sent with generate_credentials

[steved]

The JSON body is not read on GET requests, we either need to POST or
pass the arguments as query parameters.

[jeffwecan]

The documentation doesn't explicitly call out POST as an accepted method: https://www.vaultproject.io/api/secret/aws/index.html#generate-credentials.

I haven't dug into much, but given the premise and the current upstream documentation, shouldn't we just change the json keyword argument (that get passed through to the requests module) be changed to params instead of changing the request method to POST (assuming the upstream documentation is up-to-date)?

[steved]

Yeah, unfortunately the docs aren't super consistent as the AWS secret engine documentation uses vault write: https://www.vaultproject.io/docs/secrets/aws/index.html#sts-assumerole.

Either way works for me though, so I'm happy to adhere to their API documentation.

[jeffwecan]

Thanks! I had one comment on the test case update that I'll give you a chance to provide feedback on but I feel like this is a good change to merge in regardless. 👍

[jeffwecan]

I don't have any issue with working around the credential_type / credential_types change in this secrets engine in this manner, but another option would be to go off the Vault version being tested against. E.g.:

key_name = 'credential_types' if vault_version_lt('1.0.0') else 'credential_type'
self.assertEqual(
    first=read_role_response['data'][key_name],
    second=['iam_user'],
)

I like that route because it makes things a bit more explicit. What do you think?

[steved]

Sure! Changed and added a link to the corresponding vault commit.

[jeffwecan]

Also for what it is worth, I would be fine with the originally proposed change to a POST method or with the current changes (now that you've done my due diligence in verifying a POST should work just as well 😄).

[steved]

GET works for me. I sort of understand the semantics of using a POST for this endpoint (creating credentials, ...), but for some reason it still makes more sense as a read.