fix(pull): pin AWS region for STS so devbox global push works without an ambient region - #2938
Open
mikeland73 wants to merge 2 commits into
Open
fix(pull): pin AWS region for STS so devbox global push works without an ambient region#2938mikeland73 wants to merge 2 commits into
devbox global push works without an ambient region#2938mikeland73 wants to merge 2 commits into
Conversation
…ut an ambient region (#2591) The STS client used to assume the JetpackS3Federated role was built from config.LoadDefaultConfig(ctx) with no region. AWS SDK v2 cannot resolve the STS endpoint without a region, so users who have no AWS region configured in their environment (a fresh Jetify signup, no ~/.aws/config, no AWS_REGION) hit: Error: operation error STS: AssumeRoleWithWebIdentity, failed to resolve service endpoint, endpoint rule error, Invalid Configuration: Missing Region The `region` constant already existed and was applied to the downstream S3 config, but only via a post-hoc `config.Region = region` mutation because the local variable shadowed the imported `config` package. Pin the region on both configs via config.WithRegion(region), fix the shadowing (cfg), and stop ignoring the first LoadDefaultConfig error. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZuVavP5v2abUek98MDBCQ
- Use t.Context() instead of context.Background() in the new test. - Rename the too-short assumeRole parameter `c` to `cred`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZuVavP5v2abUek98MDBCQ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2591.
devbox global pushfails for users who don't have an AWS region configured in their environment (e.g. a fresh Jetify signup with no~/.aws/configand noAWS_REGION/AWS_DEFAULT_REGION):Root cause: In
internal/pullbox/s3/config.go,assumeRolebuilt the STS client fromconfig.LoadDefaultConfig(ctx)with no region. AWS SDK v2 cannot resolve the STS endpoint without a region, so when the environment supplies none, the call fails before the role can be assumed.The
regionconstant (us-east-2, where thedevbox.shbucket lives) already existed, but it was only applied to the downstream S3 config — and only via a post-hocconfig.Region = regionmutation, because the local variable was namedconfigand shadowed the importedconfigpackage (which is whyconfig.WithRegion(...)couldn't be used there).Fix:
config.WithRegion(region).cfgso theconfigpackage is usable.LoadDefaultConfig, and only set the region on success (the old code assignedconfig.Regionbefore checking the error).The change is minimal and isolated to the credential-assumption helper; behavior for users who do have a region configured is unchanged (the region was already pinned for the S3 config).
How was it tested?
go build ./internal/pullbox/...,go vet ./internal/pullbox/s3/, andgofmtall clean.internal/pullbox/s3/config_test.go(TestConfigPinsRegion) which reproduces the reporter's environment — all AWS region sources cleared — and verifies that a plainLoadDefaultConfigyields an empty region (the failing condition) while the pinnedconfig.WithRegion(region)yields the expected region. Passes:go test ./internal/pullbox/s3/.devbox global pushitself requires a Jetify cloud account and network, so it isn't exercised in CI here; the fix follows directly from the AWS SDK v2 requirement that STS/S3 clients have a resolvable region.cc @svandragt (issue reporter)
Community Contribution License
All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.
By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.
🤖 Generated with Claude Code
https://claude.ai/code/session_01NZuVavP5v2abUek98MDBCQ
Generated by Claude Code