Credential resolvers that use AWS services (e.g,. STS / SSO) should use configured endpoint

[sichanyoo]

Background

The configured endpoint feature for SDKs requires the ability to configure the endpoint to use for service clients using environment variables and properties in the shared config file.

Swift SDK depends on aws-crt-swift for credential resolution, and to support configured endpoint, that means credential resolvers in CRT that use service clients must respect the configured endpoint spec as well.

The order of resolution for configured endpoint is as follows:

1. The value provided by a service-specific environment variable, AWS_ENDPOINT_URL_<SERVICE>. <SERVICE> here is the uppercased version of corresponding service identifier in this official list.
2. The value provided by the global endpoint environment variable, AWS_ENDPOINT_URL.
3. The value provided by a service-specific parameter from a services definition section referenced in a profile in the shared configuration file. The name of the service must match the identifier in this official list. E.g.:

[profile profile-with-services]
services = dev
endpoint_url = http://localhost:5567

[services dev]
sts = 
  endpoint_url = https://play.min.io:9000

4. The value provided by the global parameter from a profile in the shared configuration file. E.g.:

[profile profile-with-services]
services = dev
endpoint_url = http://localhost:5567

5. The endpoint value resolved through existing methods

Task

The STS credential resolver, SSO credential resolver, and default chain credential resolver which has STS in its chain should respect the endpoint configured in the env var & shared config file if present.

Use Case

For customers that want to configure endpoint for STS or SSO for their usage of Swift SDK.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change