fix(aws): keep the resolved endpoint when building a Config from credentials

[ffernandezcast]

Description

AWS_ENDPOINT_URL is honoured by NewAuthenticatedSessionContext but silently discarded by three sibling helpers, so a suite pointed at an emulator such as LocalStack or Moto can end up talking to real AWS.

The problem

config.LoadDefaultConfig resolves AWS_ENDPOINT_URL (and the per-service AWS_ENDPOINT_URL_<SERVICE> form) into Config.BaseEndpoint, which service clients inherit through NewFromConfig. Three helpers return a freshly built aws.Config carrying only Region and Credentials, dropping it:

helper	endpoint preserved
NewAuthenticatedSessionFromDefaultCredentialsContext	yes
NewAuthenticatedSessionFromRoleContext	no
CreateAwsSessionWithCredsContext	no
CreateAwsSessionWithMfaContext	no

This is not limited to callers of those three. NewAuthenticatedSessionContext delegates to the role helper whenever TERRATEST_IAM_ROLE is set, so the standard entry point loses the override too.

Nothing errors when this happens — requests are simply sent to AWS instead of the emulator.

The change

• NewAuthenticatedSessionFromRoleContext already holds a fully resolved config, so it swaps the assumed-role credentials into that config instead of rebuilding one.
• The other two share a small helper that loads the standard configuration for the region and overrides only the credentials.

Two of the three call sites get shorter as a result.

One behaviour change to flag: CreateAwsSessionWithCredsContext previously never consulted the environment and could not fail. It now resolves ambient configuration, so it honours AWS_ENDPOINT_URL and can return an error if that configuration is unreadable. Its ctx, documented as "accepted for API consistency but not currently used", is now used. Explicitly supplied credentials still take precedence.

Tests stub STS over httptest with canned AssumeRole and GetSessionToken responses, so they run offline with no AWS account.

I could not find an open issue covering this. Related, both closed: #494, #453.

TODOs

Read the Gruntwork contribution guidelines.

• Update the docs.
• Run the relevant tests successfully, including pre-commit checks.
• Ensure any 3rd party code adheres with our license policy or delete this line if its not applicable.
• Include release notes. If this PR is backward incompatible, include a migration guide.
• Make a plan for release of the functionality in this PR. If it delivers value to an end user, you are responsible for ensuring it is released promptly, and correctly. If you are not a maintainer, you are responsible for finding a maintainer to do this for you.

Unticked deliberately: no docs change seemed warranted for restoring existing documented behaviour, though I will add one if you disagree; and I am not a maintainer, so I cannot own the release.

Release Notes (draft)

Fixed NewAuthenticatedSessionFromRoleContext, CreateAwsSessionWithCredsContext and CreateAwsSessionWithMfaContext discarding the resolved endpoint, so AWS_ENDPOINT_URL is honoured when assuming a role or supplying explicit credentials.

Migration Guide

No signature changes. Two behavioural notes:

• CreateAwsSessionWithCredsContext can now return a non-nil error where it previously always returned nil. Callers already handle the error return.
• These helpers now reflect AWS_ENDPOINT_URL in the returned Config. If you set that variable but relied on these helpers ignoring it, unset it or scope it per service with AWS_ENDPOINT_URL_<SERVICE>.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}