Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov partition#1478
Merged
Conversation
matheuscscp
added
bug
matheuscscp
changed the title
stealthybox
approved these changes
Jul 3, 2025
stealthybox
left a comment
stealthybox
left a comment
Member
There was a problem hiding this comment.
Commented some nits, but overall LGTM
| // | ||
| // ref: | ||
| // https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html | ||
| const arnPattern = `^arn:aws[\w-]*:kms:(.+):[0-9]+:(key|alias)/.+$` |
Member
There was a problem hiding this comment.
matching KMS as a service name here also validates the ARN
Partition name is enforced to have an aws* prefix which supports all of the current documented partitions
Notably, we could get the region with SplitN : 4, but matching the sops behavior also makes sense
Member
Author
There was a problem hiding this comment.
Yeah for this fix I'd like to just match SOPS, we can rethink this down the line
… Gov partition Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Member
|
Successfully created backport PR for |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1477
In kustomize-controller 1.6.0 a new logic was introduced for getting the AWS region from the KMS key ARN that did not account for the
aws-us-govandaws-cnARN partitions. This logic would produce errors like the one below, wherearnis mistakenly used as the region extracted byGetRegionFromKMSARN()in the STS endpoint:The endpoint comes out as
https://sts.arn.amazonaws.com/, when it should be something likehttps://sts.us-gov-west-1.amazonaws.com/.This PR fixes the issue by using the same regex that SOPS uses for extracting the region.