Regional STS Endpoint

[sidewinder12s]

Does kiam support setting a regional STS endpoint?

It looks like kube2iam supported it and we'd need to be able to set it to be able to use the STS VPC Endpoint.

[pingles]

It doesn't support it currently. Is there a reason it's useful/you're keen to have it moved to a VPC endpoint? (I assume there may be some latency benefit?).

I'd be happy to take a PR for it; it sounds like a useful thing to have but I'm not sure we'd be able to prioritise doing it just yet.

[sidewinder12s]

Using the VPC endpoint for STS (though it's only available in us-west-2 right now) requires using the regional STS URL for it to work. We believe we run into some latency issues with accounts that don't have a NAT gateway in place and all STS traffic has to go down a VPN.

[sidewinder12s]

Do you happen to know if just setting the AWS_REGION environment variable on the server would cause it to use the regional endpoint?

[pingles]

Some references:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html
• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts_vpce.html

[pingles]

fyi, it doesn't appear to apply automatically having set AWS_REGION or even using WithRegion on aws.Config. I wrote a little dummy tool and had it log debug output, suggests it only connects to the global endpoint:

2018/12/06 14:49:05 DEBUG: Request sts/AssumeRole Details:
---[ REQUEST POST-SIGN ]-----------------------------
POST / HTTP/1.1
Host: sts.amazonaws.com

[pingles]

Which would explain why the kube2iam authors wrote a custom endpoints.Resolver: https://github.com/jtblin/kube2iam/blob/a472f64f268149064391f8c7909bd4181528cc75/iam/iam.go#L114

[pingles]

To clarify, we'd support integrating this (via an additional flag on the Server so it can be enabled/controlled directly) and is a pretty nice/self-contained change if someone's looking for a first contribution!