Salt does not include security tokens with requests to s3 in 2015.8

[TronPaul]

Version: 2015.8.0rc3-44-gc604527

If you are running salt in AWS and are using IAM roles, salt will not use the security_token in s3 requests.

    if not key or not keyid:
        iam_creds = iam.get_iam_metadata()
        key = iam_creds['secret_key']
        keyid = iam_creds['access_key']

    if not requesturl:
        requesturl = 'https://{0}/{1}'.format(endpoint, path)
        headers, requesturl = salt.utils.aws.sig4(
            method,
            endpoint,
            params,
            data=data,
            uri='/{0}'.format(path),
            prov_dict={'id': keyid, 'key': key},
            location=location,
            product='s3',
            requesturl=requesturl,
        )

[TronPaul]

Digging deeper it seems salt.utils.aws.creds expects IROLE_CODE as either the access_key or the secret_key to return a security token back to salt.utils.aws.sig4. However s3 is calling iam itself to get the access_key and secret_key, but doesn't use the security_token.

Should salt.utils.s3 be passing in credentials in the IAM case? It seems salt.utils.aws.sig4 doesn't expect it to.

[TronPaul]

Looks to be broken by c63c235.

[jfindlay]

@TronPaul, thanks for your work on this.