AWS govcloud - Assume role

[implicitnewt]

opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/aws.py

In assumed_creds function I added the following check for "us-gov" in location and removed the hard coded call to sts.amazonaws.com. Pretty much a hack, I'll leave it to someone else to come up with a better idea for it.

def assumed_creds(prov_dict, role_arn, location=None):
valid_session_name_re = re.compile("[^a-z0-9A-Z+=,.@-]")

# current time in epoch seconds                                                                                                                                                                                         
now = time.mktime(datetime.utcnow().timetuple())

for key, creds in copy.deepcopy(__AssumeCache__).items():
    if (creds["Expiration"] - now) <= 120:
        del __AssumeCache__[key]

if role_arn in __AssumeCache__:
    c = __AssumeCache__[role_arn]
    return c["AccessKeyId"], c["SecretAccessKey"], c["SessionToken"]

version = "2011-06-15"
session_name = valid_session_name_re.sub(
    "", salt.config.get_id({"root_dir": None})[0]
)[0:63]

if (location != None and 'us-gov' in location):
    endpoint = "sts.us-gov-west-1.amazonaws.com"
else:
    endpoint = "sts.amazonaws.com"

headers, requesturl = sig4(
    "GET",
    endpoint,
    params={
        "Version": version,
        "Action": "AssumeRole",
        "RoleSessionName": session_name,
        "RoleArn": role_arn,
        "Policy": (
            '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1",'
            ' "Effect":"Allow","Action":"*","Resource":"*"}]}'
        ),
        "DurationSeconds": "3600",
    },
    aws_api_version=version,
    data="",
    uri="/",
    prov_dict=prov_dict,
    product="sts",
    location=location,
    requesturl="https://" + endpoint + "/",

..................................