Add sts_region for AWS auth backend (#931)

* Add sts_region for AWS auth backend

* Add sts_region doc

* Add sts_region to read

* Update vault/resource_aws_auth_backend_client.go

Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>

* Fix test

* Remove sts_region check

Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>

Author: jasonodonnell

vault/resource_aws_auth_backend_client.go

@@ -60,6 +60,11 @@ func awsAuthBackendClientResource() *schema.Resource {
 				Optional:    true,
 				Description: "URL to override the default generated endpoint for making AWS STS API calls.",
 			},
+			"sts_region": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Region to override the default region for making AWS STS API calls.",
+			},
 			"iam_server_id_header_value": {
 				Type:        schema.TypeString,
 				Optional:    true,
@@ -78,6 +83,8 @@ func awsAuthBackendWrite(d *schema.ResourceData, meta interface{}) error {
 	ec2Endpoint := d.Get("ec2_endpoint").(string)
 	iamEndpoint := d.Get("iam_endpoint").(string)
 	stsEndpoint := d.Get("sts_endpoint").(string)
+	stsRegion := d.Get("sts_region").(string)
+
 	iamServerIDHeaderValue := d.Get("iam_server_id_header_value").(string)
 
 	path := awsAuthBackendClientPath(backend)
@@ -86,6 +93,7 @@ func awsAuthBackendWrite(d *schema.ResourceData, meta interface{}) error {
 		"endpoint":                   ec2Endpoint,
 		"iam_endpoint":               iamEndpoint,
 		"sts_endpoint":               stsEndpoint,
+		"sts_region":                 stsRegion,
 		"iam_server_id_header_value": iamServerIDHeaderValue,
 	}
 
@@ -95,6 +103,11 @@ func awsAuthBackendWrite(d *schema.ResourceData, meta interface{}) error {
 		data["secret_key"] = d.Get("secret_key").(string)
 	}
 
+	// sts_endpoint and sts_region are required to be set together
+	if (stsEndpoint == "") != (stsRegion == "") {
+		return fmt.Errorf("both sts_endpoint and sts_region need to be set")
+	}
+
 	log.Printf("[DEBUG] Writing AWS auth backend client config to %q", path)
 	_, err := client.Logical().Write(path, data)
 	if err != nil {
@@ -134,6 +147,7 @@ func awsAuthBackendRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("ec2_endpoint", secret.Data["endpoint"])
 	d.Set("iam_endpoint", secret.Data["iam_endpoint"])
 	d.Set("sts_endpoint", secret.Data["sts_endpoint"])
+	d.Set("sts_region", secret.Data["sts_region"])
 	d.Set("iam_server_id_header_value", secret.Data["iam_server_id_header_value"])
 	return nil
 }

vault/resource_aws_auth_backend_client_test.go

@@ -2,6 +2,7 @@ package vault
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
@@ -96,6 +97,21 @@ func TestAccAWSAuthBackendClient_withoutSecretKey(t *testing.T) {
 	})
 }
 
+func TestAccAWSAuthBackendClientStsRegionNoEndpoint(t *testing.T) {
+	backend := acctest.RandomWithPrefix("aws")
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testProviders,
+		CheckDestroy: testAccCheckAWSAuthBackendClientDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAWSAuthBackendClientConfigSTSRegionNoEndpoint(backend),
+				ExpectError: regexp.MustCompile("both sts_endpoint and sts_region need to be set"),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSAuthBackendClientDestroy(s *terraform.State) error {
 	client := testProvider.Meta().(*api.Client)
 
@@ -146,6 +162,7 @@ func testAccAWSAuthBackendClientCheck_attrs(backend string) resource.TestCheckFu
 			"ec2_endpoint":               "endpoint",
 			"iam_endpoint":               "iam_endpoint",
 			"sts_endpoint":               "sts_endpoint",
+			"sts_region":                 "sts_region",
 			"iam_server_id_header_value": "iam_server_id_header_value",
 		}
 		for stateAttr, apiAttr := range attrs {
@@ -175,6 +192,7 @@ resource "vault_aws_auth_backend_client" "client" {
   ec2_endpoint = "http://vault.test/ec2"
   iam_endpoint = "http://vault.test/iam"
   sts_endpoint = "http://vault.test/sts"
+  sts_region = "vault-test"
   iam_server_id_header_value = "vault.test"
 }
 `, backend)
@@ -195,6 +213,7 @@ resource "vault_aws_auth_backend_client" "client" {
   ec2_endpoint = "http://updated.vault.test/ec2"
   iam_endpoint = "http://updated.vault.test/iam"
   sts_endpoint = "http://updated.vault.test/sts"
+  sts_region = "updated-vault-test"
   iam_server_id_header_value = "updated.vault.test"
 }`, backend)
 }
@@ -213,6 +232,7 @@ resource "vault_aws_auth_backend_client" "client" {
   ec2_endpoint = "http://vault.test/ec2"
   iam_endpoint = "http://vault.test/iam"
   sts_endpoint = "http://vault.test/sts"
+  sts_region = "vault-test"
   iam_server_id_header_value = "vault.test"
 }`, backend)
 }
@@ -231,6 +251,25 @@ resource "vault_aws_auth_backend_client" "client" {
   ec2_endpoint = "http://updated2.vault.test/ec2"
   iam_endpoint = "http://updated2.vault.test/iam"
   sts_endpoint = "http://updated2.vault.test/sts"
+  sts_region = "updated-vault-test"
   iam_server_id_header_value = "updated2.vault.test"
 }`, backend)
 }
+
+func testAccAWSAuthBackendClientConfigSTSRegionNoEndpoint(backend string) string {
+	return fmt.Sprintf(`
+resource "vault_auth_backend" "aws" {
+  path = "%s"
+  type = "aws"
+  description = "Test auth backend for AWS backend client config"
+}
+
+resource "vault_aws_auth_backend_client" "client" {
+  backend = "${vault_auth_backend.aws.path}"
+  access_key = "AWSACCESSKEY"
+  ec2_endpoint = "http://vault.test/ec2"
+  iam_endpoint = "http://vault.test/iam"
+  sts_region = "vault-test"
+  iam_server_id_header_value = "vault.test"
+}`, backend)
+}

website/docs/r/aws_auth_backend_client.html.md

@@ -60,6 +60,9 @@ The following arguments are supported:
 * `sts_endpoint` - (Optional) Override the URL Vault uses when making STS API
 	calls.
 
+* `sts_region` - (Optional) Override the default region when making STS API 
+    calls. The `sts_endpoint` argument must be set when using `sts_region`.
+
 * `iam_server_id_header_value` - (Optional) The value to require in the
 	`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
 	that are used in the IAM auth method.