Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect endpoint used for AWS SSO when FIPS enabled #3928

Open
2 tasks
abohne opened this issue Feb 24, 2025 · 0 comments
Open
2 tasks

Incorrect endpoint used for AWS SSO when FIPS enabled #3928

abohne opened this issue Feb 24, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@abohne
Copy link
Contributor

abohne commented Feb 24, 2025

Describe the bug

We utilize AWS SSO in GovCloud for authentication. When our AWS profile has use_fips_endpoint = true, we see the following error when terragrunt is run.

11:54:53.360 ERROR  Error finding AWS credentials (did you set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables?): RequestError: send request failed
caused by: Get "https://portal.sso-fips.us-gov-west-1.amazonaws.com/federation/credentials?account_id=XXXXX&role_name=AdministratorAccess": dial tcp: lookup portal.sso-fips.us-gov-west-1.amazonaws.com: no such host

AWS FIPS Documentation states that the correct FIPS endpoints for SSO are sso.us-gov-west-1.amazonaws.com and sso.us-gov-east-1.amazonaws.com.

Steps To Reproduce

Either configure your AWS profile with use_fips_endpoint = true or export AWS_USE_FIPS_ENDPOINT=true

Login to SSO via cli
aws sso login

generate "provider" {
  path        = "provider.tf"
  if_exists   = "overwrite_terragrunt"
  if_disabled = "remove_terragrunt"
  contents    = <<EOF
provider "aws" {
  region = "us-gov-east-1"
}
EOF
}

remote_state {
  backend = "s3"
  config = {
    encrypt        = true
    bucket         = "mystatebucket"
    key            = "terraform.tfstate"
    region         = "us-gov-east-1"
    dynamodb_table = "mydynamotable"
  }
  generate = {
    path      = "backend.tf"
    if_exists = "overwrite_terragrunt"
  }
}

terragrunt plan

Expected behavior

Terragrunt is able to utilize the existing AWS credentials.

Nice to haves

  • Terminal output
  • Screenshots

Versions

  • Terragrunt version: 0.72.0
  • OpenTofu/Terraform version: Terraform 1.10.4
  • Environment details (Ubuntu 20.04, Windows 10, etc.): MacOS Sequoia 15.0.1

Additional context

Add any other context about the problem here.

@abohne abohne added the bug Something isn't working label Feb 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant