aws/aws-msk-iam-auth v2.3.9

2.3.9

on GitHub

What's Changed

Bug fixes

• Fixed credential resolution failures when dualstack endpoints are enabled
  (AWS_USE_DUALSTACK_ENDPOINT, the aws.useDualstackEndpoint system
  property, or use_dualstack_endpoint in the AWS config profile). (#252,
  fixes #248)
  • Removed the explicit STS endpoint override. Endpoint resolution is now
    delegated to the AWS SDK's endpoint ruleset, which resolves regional,
    dualstack, and FIPS endpoints correctly. Resolved endpoints for existing
    non-dualstack regional configurations are unchanged.
  • With dualstack enabled and no awsStsRegion configured, provider
    construction now fails fast with an actionable error naming the
    awsStsRegion JAAS option, instead of repeatedly retrying the
    nonexistent sts.aws-global.api.aws hostname.
  • When the last configured credential provider (for example the
    awsRoleArn STS provider) fails and the chain falls back to the default
    providers, a WARN is now logged naming the failed provider, so the
    connection no longer silently authenticates as an unintended ambient
    identity. Setting awsAddDefaultProviders="false" remains the way to
    fail fast instead of falling back.
  • fipsEnabled is now set on the STS client only when the
    awsShouldUseFips JAAS option requests it, so ambient FIPS
    configuration is honored.