Aws-sdk-go: MissingRegion on S3 GetObject in v1.25.18

[jrefior]

Version of AWS SDK for Go?

v1.25.18

Version of Go (go version)?

go version go1.13.3 darwin/amd64

What issue did you see?

Failed to get file: MissingRegion: could not find region configuration

Steps to reproduce

    creds := stscreds.NewCredentials(session.Must(session.NewSession()), arn)
    cfg := aws.NewConfig().WithCredentials(creds).WithRegion(`us-east-1`)
    client := s3.New(sess, cfg)
    input := &s3.GetObjectInput{
        Bucket: aws.String(getBucketForEnv(env)),
        Key:    aws.String(getFileNameForEnv(env)),
    }
    output, err := client.GetObject(input)
    if err != nil {
        return nil, fmt.Errorf("Failed to get file: %s", err)
    }

This works in release v1.25.17, but not in v1.25.18. How do we adjust our code for the new release?

[jasonmf]

I get this same issue using STS to make IAM calls.

As an additional data point, some services (like Hashicorp Vault) use signed but unsubmitted GetCallerIdentity calls as an authentication mechanism. This client code no longer works but worked fine with v1.25.17:

        stsReq, _ := sts.New(p.session).GetCallerIdentityRequest(nil)
        stsReq.Sign()
        headersJson, err := json.Marshal(stsReq.HTTPRequest.Header)
        if err != nil {
                return nil, time.Time{}, errors.Wrap(err, "marshalling STS request header")
        }
        reqBody, err := ioutil.ReadAll(stsReq.HTTPRequest.Body)
        if err != nil {
                return nil, time.Time{}, errors.Wrap(err, "reading sts request body")
        }
        log.Printf("REQBODY: %s", string(reqBody))

reqBody is now empty.

Best guess: a breaking change to the SDK API was made and tagged as a minor revision.

[jasdel]

Thanks for letting us know about this issue. Could you provide more information about how the passed in Session is configured? In addition what region is the STS client being configured for?

[jasdel]

@AgentZombie What error is being returned from the stsReq.Sign() method call?

[jasdel]

I think we have an idea what is going on here, with the following example easily reproduces the behavior change.

    client := sts.New(session.Must(session.NewSession()))

    req, _ := client.GetCallerIdentityRequest(nil)
    err := req.Sign()
    fmt.Println("err", err)

On v1.25.17 Sign has no error, but fails with missing region on v1.25.18.

[jasdel]

The issue occurring prior to v1.25.18 is that the SDK was incorrectly allowing no region to be specified for the STS client. The SDK is supposed to require a region for all clients, but STS was escaping that validation due to a bug in how the SDK resolved the service's modeled endpoints.

The behavior prior to v1.25.18 is definition a bug in the SDK's endpoint resolver incorrectly resolving the global sts.amazonaws.com region instead of producing an error when no region was configured. From what I can determine STS was the only client that could be created without validation catching that no region was specified.

The best workaround for this issue without reverting to v1.25.17 is to specify the region for the STS client. We're investigating how best to cover the case where STS was usable without a region, even though one should of been required.

[jasonmf]

I wasn't catching the Sign error! I am now: MissingRegion: could not find region configuration

My session being passed in:

sess, err := awsiam.EnvironmentSession()
fatalIfError(err, "getting AWS session from environment")

where:

func EnvironmentSession() (*session.Session, error) {
        creds := credentials.NewChainCredentials(
                []credentials.Provider{
                        &credentials.EnvProvider{},
                        &ec2rolecreds.EC2RoleProvider{
                                Client: ec2metadata.New(session.Must(session.NewSession())),
                        },
                },
        )
        sess, err := session.NewSessionWithOptions(session.Options{
                Config: aws.Config{Credentials: creds},
        })
        if err != nil {
                return nil, errors.Wrap(err, "creating STS session")
        }
        return sess, nil
}

[jrefior]

Thanks, our code is now working in v1.25.18 and v1.25.19 with this change:

-       creds := stscreds.NewCredentials(session.Must(session.NewSession()), arn)
+       creds := stscreds.NewCredentials(session.Must(session.NewSession(&aws.Config{
+               Region: aws.String(region),
+       })), arn)

[jasonmf]

Can confirm my issue is resolve using v1.25.18 with:

sess, err := awsiam.EnvironmentSession()
fatalIfError(err, "getting AWS session from environment")
sess.Config.Region = aws.String("us-west-2")

[jasdel]

Thanks for the update. This exposed a behavior bug in the SDK's resolving of endpoints for multiple services. Specifically, the SDK will attempt to resolve "global" AWS services without a region also being specified. We're investigating the best way to resolve this issue.

[jasdel]

Thanks for reporting this issue. I've merged in #2911 fixing the SDK's behavior with regard to empty region when resolving service endpoints. This change preserved the SDK's behavior for clients that successfully returned an endpoint even though no region was provided. For all other services, a more useful error message is logged.

This change will be included in the SDK's next tagged release.