How do I configure the AssumeRoleProvider to use the FIPS endpoints?

[jszwedko]

This came up through an issue report on Vector about it not using the FIPS endpoints when AWS_USE_FIPS_ENDPOINT=true.

I am able to see how to configure the SDK to use the FIPS endpoints for accessing various services (use_fips on the SDK config builders), but I'm not seeing how to do so for the STS access when fetching credentials. I created a stand-alone project for testing:

Cargo.toml

[package]
name = "aws-tmp"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
aws-config = "0.56.1"
aws-credential-types = "0.56.1"
aws-types = "0.56.1"
tokio = { version = "1.32.0", features = ["macros", "rt-multi-thread"] }
tracing-subscriber = { version = "0.3", features = ["env-filter"] } 

src/main.rs

use aws_config::default_provider::credentials::DefaultCredentialsChain;
use aws_config::sts::AssumeRoleProvider;
use aws_credential_types::provider::ProvideCredentials;
use aws_types::region::Region;

#[tokio::main]
async fn main() -> Result<(), ()> {
    tracing_subscriber::fmt::init();

    let provider = AssumeRoleProvider::builder("arn:aws:iam::123456789012:role/demo")
        .region(Region::from_static("us-east-2"))
        .session_name("testAR")
        .build(DefaultCredentialsChain::builder().build().await);

    dbg!(&provider.provide_credentials().await);

    Ok(())
}

When running with:

RUST_LOG=trace AWS_ACCESS_KEY_ID=foo AWS_SECRET_ACCESS_KEY=bar AWS_USE_FIPS_ENDPOINT=true cargo run

I see it, reasonably, fail to fetch credentials, but, crucially, I see it hitting the normal STS endpoints rather than the FIPS ones.

Output:

    Finished dev [unoptimized + debuginfo] target(s) in 0.07s
     Running `target/debug/aws-tmp`
2023-08-25T22:54:29.003735Z DEBUG load_region{provider=ProfileFileRegionProvider { provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: None } }}: aws_config::fs_util: loaded home directory src="HOME"
2023-08-25T22:54:29.003834Z DEBUG load_region{provider=ProfileFileRegionProvider { provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: None } }}:load_config_file{file=Default(Config)}: aws_config::profile::parser::source: performing home directory substitution home="/Users/jesse.szwedko" path="~/.aws/config"
2023-08-25T22:54:29.003888Z DEBUG load_region{provider=ProfileFileRegionProvider { provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: None } }}:load_config_file{file=Default(Config)}: aws_config::profile::parser::source: home directory expanded before="~/.aws/config" after="/Users/jesse.szwedko/.aws/config"
2023-08-25T22:54:29.004219Z DEBUG load_region{provider=ProfileFileRegionProvider { provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: None } }}:load_config_file{file=Default(Config)}: aws_config::profile::parser::source: config file loaded path=Some("/Users/jesse.szwedko/.aws/config") size=884872
2023-08-25T22:54:29.004264Z DEBUG load_region{provider=ProfileFileRegionProvider { provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: None } }}:load_config_file{file=Default(Credentials)}: aws_config::profile::parser::source: performing home directory substitution home="/Users/jesse.szwedko" path="~/.aws/credentials"
2023-08-25T22:54:29.004277Z DEBUG load_region{provider=ProfileFileRegionProvider { provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: None } }}:load_config_file{file=Default(Credentials)}: aws_config::profile::parser::source: home directory expanded before="~/.aws/credentials" after="/Users/jesse.szwedko/.aws/credentials"
2023-08-25T22:54:29.004316Z DEBUG load_region{provider=ProfileFileRegionProvider { provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: None } }}:load_config_file{file=Default(Credentials)}: aws_config::profile::parser::source: config file loaded path=Some("/Users/jesse.szwedko/.aws/credentials") size=0
2023-08-25T22:54:29.117636Z TRACE build_profile_provider: aws_smithy_client::conns::default_connector: creating a new default connector settings=ConnectorSettings { connect_timeout: None, read_timeout: None } sleep=Some(SharedAsyncSleep(TokioSleep))
2023-08-25T22:54:29.257877Z DEBUG build_profile_provider: hyper_rustls::config: with_native_roots processed 161 valid and 0 invalid certs    
2023-08-25T22:54:29.258444Z TRACE aws_smithy_client::conns::default_connector: creating a new default connector settings=ConnectorSettings { connect_timeout: None, read_timeout: None } sleep=Some(SharedAsyncSleep(TokioSleep))
2023-08-25T22:54:29.276226Z DEBUG aws_sdk_sts::config: using retry strategy with partition 'sts'
2023-08-25T22:54:29.276452Z TRACE aws_smithy_client::conns::default_connector: creating a new default connector settings=ConnectorSettings { connect_timeout: None, read_timeout: None } sleep=Some(SharedAsyncSleep(TokioSleep))
2023-08-25T22:54:29.294125Z DEBUG assume_role: aws_config::sts::assume_role: retrieving assumed credentials
2023-08-25T22:54:29.294288Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:apply_configuration: aws_smithy_runtime_api::client::runtime_plugin: applying client runtime plugins
2023-08-25T22:54:29.294312Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:apply_configuration: aws_smithy_runtime::client::interceptors: running client `read_before_execution` interceptors
2023-08-25T22:54:29.294328Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:apply_configuration: aws_smithy_runtime_api::client::runtime_plugin: applying operation runtime plugins
2023-08-25T22:54:29.294348Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:apply_configuration: aws_smithy_runtime::client::interceptors: running operation `read_before_execution` interceptors
2023-08-25T22:54:29.294438Z TRACE assume_role:invoke{service=sts operation=AssumeRole}: aws_smithy_runtime::client::orchestrator: runtime_components=RuntimeComponents { auth_scheme_option_resolver: Tracked { _origin: "AssumeRole", value: SharedAuthSchemeOptionResolver(StaticAuthSchemeOptionResolver { auth_scheme_options: [AuthSchemeId { scheme_id: "sigv4" }] }) }, http_connector: Some(Tracked { _origin: "service config", value: SharedHttpConnector(DynConnectorAdapter { dyn_connector: Mutex { data: DynConnector, poisoned: false, .. } }) }), endpoint_resolver: Tracked { _origin: "service config", value: SharedEndpointResolver(DefaultEndpointResolver { inner: SharedEndpointResolver }) }, auth_schemes: [Tracked { _origin: "ServiceRuntimePlugin", value: SharedAuthScheme(SigV4AuthScheme { signer: SigV4Signer }) }, Tracked { _origin: "NoAuthRuntimePlugin", value: SharedAuthScheme(NoAuthScheme { signer: NoAuthSigner }) }], identity_resolvers: [Tracked { _origin: "ServiceRuntimePlugin", value: ConfiguredIdentityResolver { auth_scheme: AuthSchemeId { scheme_id: "sigv4" }, identity_resolver: SharedIdentityResolver(CredentialsIdentityResolver { credentials_cache: SharedCredentialsCache(NoCredentialsCache { provider: SharedCredentialsProvider(DefaultCredentialsChain { provider_chain: CredentialsProviderChain { providers: [("Environment", EnvironmentVariableCredentialsProvider { env: Env(Real) }), ("Profile", ProfileFileCredentialsProvider { factory: NamedProviderFactory { providers: {"ecscontainer": EcsCredentialsProvider { inner: OnceCell { value: None }, env: Env(Real), builder: Builder { provider_config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }), dns: None, connect_timeout: None, read_timeout: None } }, "ec2instancemetadata": ImdsCredentialsProvider { client: LazyClient { client: OnceCell { value: None }, builder: Builder { max_attempts: None, endpoint: None, mode_override: None, token_ttl: None, connect_timeout: None, read_timeout: None, config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }) } }, env: Env(Real), profile: None, time_source: SharedTimeSource(SystemTimeSource), last_retrieved_credentials: RwLock { data: None, poisoned: false, .. } }, "environment": EnvironmentVariableCredentialsProvider { env: Env(Real) }} }, sts_config: Builder { config: CloneableLayer(Layer { name: "", items: [TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false })] }), runtime_components: RuntimeComponentsBuilder { builder_name: "service config", auth_scheme_option_resolver: None, http_connector: None, endpoint_resolver: None, auth_schemes: [], identity_resolvers: [], interceptors: [], retry_classifiers: None, retry_strategy: None, time_source: Some(Tracked { _origin: "service config", value: SharedTimeSource(SystemTimeSource) }), sleep_impl: Some(Tracked { _origin: "service config", value: SharedAsyncSleep(TokioSleep) }) }, runtime_plugins: [] }, provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) } }), ("WebIdentityToken", WebIdentityTokenCredentialsProvider { source: Env(Env(Real)), time_source: SharedTimeSource(SystemTimeSource), fs: Fs(Real), sts_client: Client { handle: Handle { conf: Config { config: FrozenLayer(Layer { name: "aws_sdk_sts::config::Config", items: [TypeErasedBox[Clone]:Set(SigningService("sts")), TypeErasedBox[Clone]:Set(ApiMetadata { service_id: "sts", version: "0.30.0" }), TypeErasedBox[Clone]:Set(SigningRegion("us-east-1")), TypeErasedBox[Clone]:Set(TimeoutConfig { connect_timeout: None, read_timeout: None, operation_timeout: None, operation_attempt_timeout: None }), TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false }), TypeErasedBox[Clone]:Set(RetryPartition { inner: "sts" }), TypeErasedBox[Clone]:Set(TokenBucket { semaphore: Semaphore { ll_sem: Semaphore { permits: 500 } }, max_permits: 500, timeout_retry_cost: 10, retry_cost: 5 })] }), cloneable: CloneableLayer(Layer { name: "", items: [TypeErasedBox[Clone]:Set(SigningService("sts")), TypeErasedBox[Clone]:Set(ApiMetadata { service_id: "sts", version: "0.30.0" }), TypeErasedBox[Clone]:Set(SigningRegion("us-east-1")), TypeErasedBox[Clone]:Set(TimeoutConfig { connect_timeout: None, read_timeout: None, operation_timeout: None, operation_attempt_timeout: None }), TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false }), TypeErasedBox[Clone]:Set(RetryPartition { inner: "sts" }), TypeErasedBox[Clone]:Set(TokenBucket { semaphore: Semaphore { ll_sem: Semaphore { permits: 500 } }, max_permits: 500, timeout_retry_cost: 10, retry_cost: 5 })] }), runtime_components: RuntimeComponentsBuilder { builder_name: "service config", auth_scheme_option_resolver: None, http_connector: Some(Tracked { _origin: "service config", value: SharedHttpConnector(DynConnectorAdapter { dyn_connector: Mutex { data: DynConnector, poisoned: false, .. } }) }), endpoint_resolver: Some(Tracked { _origin: "service config", value: SharedEndpointResolver(DefaultEndpointResolver { inner: SharedEndpointResolver }) }), auth_schemes: [], identity_resolvers: [], interceptors: [], retry_classifiers: None, retry_strategy: Some(Tracked { _origin: "service config", value: SharedRetryStrategy(StandardRetryStrategy { base: 0x10547250c, initial_backoff: 1s, max_attempts: 3, max_backoff: 20s, retry_permit: Mutex { data: None, poisoned: false, .. } }) }), time_source: Some(Tracked { _origin: "service config", value: SharedTimeSource(SystemTimeSource) }), sleep_impl: Some(Tracked { _origin: "service config", value: SharedAsyncSleep(TokioSleep) }) }, runtime_plugins: [] }, runtime_plugins: RuntimePlugins { client_plugins: [SharedRuntimePlugin(StaticRuntimePlugin { config: Some(FrozenLayer(Layer { name: "aws_sdk_sts::config::Config", items: [TypeErasedBox[Clone]:Set(SigningService("sts")), TypeErasedBox[Clone]:Set(ApiMetadata { service_id: "sts", version: "0.30.0" }), TypeErasedBox[Clone]:Set(SigningRegion("us-east-1")), TypeErasedBox[Clone]:Set(TimeoutConfig { connect_timeout: None, read_timeout: None, operation_timeout: None, operation_attempt_timeout: None }), TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false }), TypeErasedBox[Clone]:Set(RetryPartition { inner: "sts" }), TypeErasedBox[Clone]:Set(TokenBucket { semaphore: Semaphore { ll_sem: Semaphore { permits: 500 } }, max_permits: 500, timeout_retry_cost: 10, retry_cost: 5 })] })), runtime_components: Some(RuntimeComponentsBuilder { builder_name: "service config", auth_scheme_option_resolver: None, http_connector: Some(Tracked { _origin: "service config", value: SharedHttpConnector(DynConnectorAdapter { dyn_connector: Mutex { data: DynConnector, poisoned: false, .. } }) }), endpoint_resolver: Some(Tracked { _origin: "service config", value: SharedEndpointResolver(DefaultEndpointResolver { inner: SharedEndpointResolver }) }), auth_schemes: [], identity_resolvers: [], interceptors: [], retry_classifiers: None, retry_strategy: Some(Tracked { _origin: "service config", value: SharedRetryStrategy(StandardRetryStrategy { base: 0x10547250c, initial_backoff: 1s, max_attempts: 3, max_backoff: 20s, retry_permit: Mutex { data: None, poisoned: false, .. } }) }), time_source: Some(Tracked { _origin: "service config", value: SharedTimeSource(SystemTimeSource) }), sleep_impl: Some(Tracked { _origin: "service config", value: SharedAsyncSleep(TokioSleep) }) }) }), SharedRuntimePlugin(ServiceRuntimePlugin { config: None, runtime_components: RuntimeComponentsBuilder { builder_name: "ServiceRuntimePlugin", auth_scheme_option_resolver: None, http_connector: None, endpoint_resolver: None, auth_schemes: [Tracked { _origin: "ServiceRuntimePlugin", value: SharedAuthScheme(SigV4AuthScheme { signer: SigV4Signer }) }], identity_resolvers: [], interceptors: [Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: ConnectionPoisoningInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: ServiceClockSkewInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: RequestInfoInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: UserAgentInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: InvocationIdInterceptor { default: DefaultInvocationIdGenerator { rng: Mutex { data: Rng(18059856492451820883), poisoned: false, .. } } } } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: RecursionDetectionInterceptor { env: Env(Real) } } }], retry_classifiers: None, retry_strategy: None, time_source: None, sleep_impl: None } }), SharedRuntimePlugin(NoAuthRuntimePlugin(RuntimeComponentsBuilder { builder_name: "NoAuthRuntimePlugin", auth_scheme_option_resolver: None, http_connector: None, endpoint_resolver: None, auth_schemes: [Tracked { _origin: "NoAuthRuntimePlugin", value: SharedAuthScheme(NoAuthScheme { signer: NoAuthSigner }) }], identity_resolvers: [Tracked { _origin: "NoAuthRuntimePlugin", value: ConfiguredIdentityResolver { auth_scheme: AuthSchemeId { scheme_id: "no_auth" }, identity_resolver: SharedIdentityResolver(NoAuthIdentityResolver) } }], interceptors: [], retry_classifiers: None, retry_strategy: None, time_source: None, sleep_impl: None }))], operation_plugins: [] } } } }), ("EcsContainer", EcsCredentialsProvider { inner: OnceCell { value: None }, env: Env(Real), builder: Builder { provider_config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }), dns: None, connect_timeout: None, read_timeout: None } }), ("Ec2InstanceMetadata", ImdsCredentialsProvider { client: LazyClient { client: OnceCell { value: None }, builder: Builder { max_attempts: None, endpoint: None, mode_override: None, token_ttl: None, connect_timeout: None, read_timeout: None, config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }) } }, env: Env(Real), profile: None, time_source: SharedTimeSource(SystemTimeSource), last_retrieved_credentials: RwLock { data: None, poisoned: false, .. } })] } }) }) }) } }, Tracked { _origin: "NoAuthRuntimePlugin", value: ConfiguredIdentityResolver { auth_scheme: AuthSchemeId { scheme_id: "no_auth" }, identity_resolver: SharedIdentityResolver(NoAuthIdentityResolver) } }], interceptors: [Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: ConnectionPoisoningInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: ServiceClockSkewInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: RequestInfoInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: UserAgentInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: InvocationIdInterceptor { default: DefaultInvocationIdGenerator { rng: Mutex { data: Rng(16695115498260608638), poisoned: false, .. } } } } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: RecursionDetectionInterceptor { env: Env(Real) } } }, Tracked { _origin: "AssumeRole", value: SharedInterceptor { interceptor: AssumeRoleEndpointParamsInterceptor } }], retry_classifiers: Some(Tracked { _origin: "AssumeRole", value: RetryClassifiers { inner: [SmithyErrorClassifier { _inner: PhantomData<aws_sdk_sts::operation::assume_role::AssumeRoleError> }, AmzRetryAfterHeaderClassifier, ModeledAsRetryableClassifier { _inner: PhantomData<aws_sdk_sts::operation::assume_role::AssumeRoleError> }, AwsErrorCodeClassifier { _inner: PhantomData<aws_sdk_sts::operation::assume_role::AssumeRoleError> }, HttpStatusCodeClassifier { retryable_status_codes: [500, 502, 503, 504] }] } }), retry_strategy: Tracked { _origin: "service config", value: SharedRetryStrategy(StandardRetryStrategy { base: 0x10547250c, initial_backoff: 1s, max_attempts: 1, max_backoff: 20s, retry_permit: Mutex { data: None, poisoned: false, .. } }) }, time_source: Some(Tracked { _origin: "service config", value: SharedTimeSource(SystemTimeSource) }), sleep_impl: Some(Tracked { _origin: "service config", value: SharedAsyncSleep(TokioSleep) }) }
2023-08-25T22:54:29.294669Z TRACE assume_role:invoke{service=sts operation=AssumeRole}: aws_smithy_runtime::client::orchestrator: operation_timeout_config=MaybeTimeoutConfig { sleep_impl: Some(SharedAsyncSleep(TokioSleep)), timeout: None, timeout_kind: Operation }
2023-08-25T22:54:29.294773Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::interceptors: running `modify_before_serialization` interceptors
2023-08-25T22:54:29.294801Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime_api::client::interceptors::context: entering 'serialization' phase
2023-08-25T22:54:29.295019Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime_api::client::interceptors::context: entering 'before transmit' phase
2023-08-25T22:54:29.295073Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::interceptors: running `modify_before_retry_loop` interceptors
2023-08-25T22:54:29.295106Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::retries::strategy::standard: no client rate limiter configured, so no token is required for the initial request.
2023-08-25T22:54:29.295127Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::orchestrator: retry strategy has OKed initial request
2023-08-25T22:54:29.295138Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime_api::client::interceptors::context: saving request checkpoint...
2023-08-25T22:54:29.295160Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime_api::client::interceptors::context: successfully saved request checkpoint
2023-08-25T22:54:29.295181Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::orchestrator: checking if context can be rewound for attempt #1
2023-08-25T22:54:29.295191Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::orchestrator: attempt_timeout_config=MaybeTimeoutConfig { sleep_impl: Some(SharedAsyncSleep(TokioSleep)), timeout: None, timeout_kind: OperationAttempt }
2023-08-25T22:54:29.295201Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::orchestrator: beginning attempt #1
2023-08-25T22:54:29.295242Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator::endpoints: orchestrating endpoint resolution
2023-08-25T22:54:29.295288Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator::endpoints: will use endpoint Endpoint { url: "https://sts.us-east-2.amazonaws.com", headers: {}, properties: {} }
2023-08-25T22:54:29.295410Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::interceptors: running `modify_before_signing` interceptors
2023-08-25T22:54:29.295519Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator::auth: orchestrating auth auth_scheme_option_resolver_params=AuthSchemeOptionResolverParams(TypeErasedBox[!Clone]:StaticAuthSchemeOptionResolverParams) auth_scheme_options=[AuthSchemeId { scheme_id: "sigv4" }]
2023-08-25T22:54:29.295537Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator::auth: resolved auth scheme, identity resolver, and signing implementation auth_scheme=SharedAuthScheme(SigV4AuthScheme { signer: SigV4Signer }) identity_resolver=SharedIdentityResolver(CredentialsIdentityResolver { credentials_cache: SharedCredentialsCache(NoCredentialsCache { provider: SharedCredentialsProvider(DefaultCredentialsChain { provider_chain: CredentialsProviderChain { providers: [("Environment", EnvironmentVariableCredentialsProvider { env: Env(Real) }), ("Profile", ProfileFileCredentialsProvider { factory: NamedProviderFactory { providers: {"ecscontainer": EcsCredentialsProvider { inner: OnceCell { value: None }, env: Env(Real), builder: Builder { provider_config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }), dns: None, connect_timeout: None, read_timeout: None } }, "ec2instancemetadata": ImdsCredentialsProvider { client: LazyClient { client: OnceCell { value: None }, builder: Builder { max_attempts: None, endpoint: None, mode_override: None, token_ttl: None, connect_timeout: None, read_timeout: None, config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }) } }, env: Env(Real), profile: None, time_source: SharedTimeSource(SystemTimeSource), last_retrieved_credentials: RwLock { data: None, poisoned: false, .. } }, "environment": EnvironmentVariableCredentialsProvider { env: Env(Real) }} }, sts_config: Builder { config: CloneableLayer(Layer { name: "", items: [TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false })] }), runtime_components: RuntimeComponentsBuilder { builder_name: "service config", auth_scheme_option_resolver: None, http_connector: None, endpoint_resolver: None, auth_schemes: [], identity_resolvers: [], interceptors: [], retry_classifiers: None, retry_strategy: None, time_source: Some(Tracked { _origin: "service config", value: SharedTimeSource(SystemTimeSource) }), sleep_impl: Some(Tracked { _origin: "service config", value: SharedAsyncSleep(TokioSleep) }) }, runtime_plugins: [] }, provider_config: ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) } }), ("WebIdentityToken", WebIdentityTokenCredentialsProvider { source: Env(Env(Real)), time_source: SharedTimeSource(SystemTimeSource), fs: Fs(Real), sts_client: Client { handle: Handle { conf: Config { config: FrozenLayer(Layer { name: "aws_sdk_sts::config::Config", items: [TypeErasedBox[Clone]:Set(SigningService("sts")), TypeErasedBox[Clone]:Set(ApiMetadata { service_id: "sts", version: "0.30.0" }), TypeErasedBox[Clone]:Set(SigningRegion("us-east-1")), TypeErasedBox[Clone]:Set(TimeoutConfig { connect_timeout: None, read_timeout: None, operation_timeout: None, operation_attempt_timeout: None }), TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false }), TypeErasedBox[Clone]:Set(RetryPartition { inner: "sts" }), TypeErasedBox[Clone]:Set(TokenBucket { semaphore: Semaphore { ll_sem: Semaphore { permits: 500 } }, max_permits: 500, timeout_retry_cost: 10, retry_cost: 5 })] }), cloneable: CloneableLayer(Layer { name: "", items: [TypeErasedBox[Clone]:Set(SigningService("sts")), TypeErasedBox[Clone]:Set(ApiMetadata { service_id: "sts", version: "0.30.0" }), TypeErasedBox[Clone]:Set(SigningRegion("us-east-1")), TypeErasedBox[Clone]:Set(TimeoutConfig { connect_timeout: None, read_timeout: None, operation_timeout: None, operation_attempt_timeout: None }), TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false }), TypeErasedBox[Clone]:Set(RetryPartition { inner: "sts" }), TypeErasedBox[Clone]:Set(TokenBucket { semaphore: Semaphore { ll_sem: Semaphore { permits: 500 } }, max_permits: 500, timeout_retry_cost: 10, retry_cost: 5 })] }), runtime_components: RuntimeComponentsBuilder { builder_name: "service config", auth_scheme_option_resolver: None, http_connector: Some(Tracked { _origin: "service config", value: SharedHttpConnector(DynConnectorAdapter { dyn_connector: Mutex { data: DynConnector, poisoned: false, .. } }) }), endpoint_resolver: Some(Tracked { _origin: "service config", value: SharedEndpointResolver(DefaultEndpointResolver { inner: SharedEndpointResolver }) }), auth_schemes: [], identity_resolvers: [], interceptors: [], retry_classifiers: None, retry_strategy: Some(Tracked { _origin: "service config", value: SharedRetryStrategy(StandardRetryStrategy { base: 0x10547250c, initial_backoff: 1s, max_attempts: 3, max_backoff: 20s, retry_permit: Mutex { data: None, poisoned: false, .. } }) }), time_source: Some(Tracked { _origin: "service config", value: SharedTimeSource(SystemTimeSource) }), sleep_impl: Some(Tracked { _origin: "service config", value: SharedAsyncSleep(TokioSleep) }) }, runtime_plugins: [] }, runtime_plugins: RuntimePlugins { client_plugins: [SharedRuntimePlugin(StaticRuntimePlugin { config: Some(FrozenLayer(Layer { name: "aws_sdk_sts::config::Config", items: [TypeErasedBox[Clone]:Set(SigningService("sts")), TypeErasedBox[Clone]:Set(ApiMetadata { service_id: "sts", version: "0.30.0" }), TypeErasedBox[Clone]:Set(SigningRegion("us-east-1")), TypeErasedBox[Clone]:Set(TimeoutConfig { connect_timeout: None, read_timeout: None, operation_timeout: None, operation_attempt_timeout: None }), TypeErasedBox[Clone]:Set(Prebuilt(DynConnector)), TypeErasedBox[Clone]:Set(Region("us-east-1")), TypeErasedBox[Clone]:Set(RetryConfig { mode: Standard, max_attempts: 3, initial_backoff: 1s, max_backoff: 20s, reconnect_mode: ReconnectOnTransientError, use_static_exponential_base: false }), TypeErasedBox[Clone]:Set(RetryPartition { inner: "sts" }), TypeErasedBox[Clone]:Set(TokenBucket { semaphore: Semaphore { ll_sem: Semaphore { permits: 500 } }, max_permits: 500, timeout_retry_cost: 10, retry_cost: 5 })] })), runtime_components: Some(RuntimeComponentsBuilder { builder_name: "service config", auth_scheme_option_resolver: None, http_connector: Some(Tracked { _origin: "service config", value: SharedHttpConnector(DynConnectorAdapter { dyn_connector: Mutex { data: DynConnector, poisoned: false, .. } }) }), endpoint_resolver: Some(Tracked { _origin: "service config", value: SharedEndpointResolver(DefaultEndpointResolver { inner: SharedEndpointResolver }) }), auth_schemes: [], identity_resolvers: [], interceptors: [], retry_classifiers: None, retry_strategy: Some(Tracked { _origin: "service config", value: SharedRetryStrategy(StandardRetryStrategy { base: 0x10547250c, initial_backoff: 1s, max_attempts: 3, max_backoff: 20s, retry_permit: Mutex { data: None, poisoned: false, .. } }) }), time_source: Some(Tracked { _origin: "service config", value: SharedTimeSource(SystemTimeSource) }), sleep_impl: Some(Tracked { _origin: "service config", value: SharedAsyncSleep(TokioSleep) }) }) }), SharedRuntimePlugin(ServiceRuntimePlugin { config: None, runtime_components: RuntimeComponentsBuilder { builder_name: "ServiceRuntimePlugin", auth_scheme_option_resolver: None, http_connector: None, endpoint_resolver: None, auth_schemes: [Tracked { _origin: "ServiceRuntimePlugin", value: SharedAuthScheme(SigV4AuthScheme { signer: SigV4Signer }) }], identity_resolvers: [], interceptors: [Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: ConnectionPoisoningInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: ServiceClockSkewInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: RequestInfoInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: UserAgentInterceptor } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: InvocationIdInterceptor { default: DefaultInvocationIdGenerator { rng: Mutex { data: Rng(18059856492451820883), poisoned: false, .. } } } } }, Tracked { _origin: "ServiceRuntimePlugin", value: SharedInterceptor { interceptor: RecursionDetectionInterceptor { env: Env(Real) } } }], retry_classifiers: None, retry_strategy: None, time_source: None, sleep_impl: None } }), SharedRuntimePlugin(NoAuthRuntimePlugin(RuntimeComponentsBuilder { builder_name: "NoAuthRuntimePlugin", auth_scheme_option_resolver: None, http_connector: None, endpoint_resolver: None, auth_schemes: [Tracked { _origin: "NoAuthRuntimePlugin", value: SharedAuthScheme(NoAuthScheme { signer: NoAuthSigner }) }], identity_resolvers: [Tracked { _origin: "NoAuthRuntimePlugin", value: ConfiguredIdentityResolver { auth_scheme: AuthSchemeId { scheme_id: "no_auth" }, identity_resolver: SharedIdentityResolver(NoAuthIdentityResolver) } }], interceptors: [], retry_classifiers: None, retry_strategy: None, time_source: None, sleep_impl: None }))], operation_plugins: [] } } } }), ("EcsContainer", EcsCredentialsProvider { inner: OnceCell { value: None }, env: Env(Real), builder: Builder { provider_config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }), dns: None, connect_timeout: None, read_timeout: None } }), ("Ec2InstanceMetadata", ImdsCredentialsProvider { client: LazyClient { client: OnceCell { value: None }, builder: Builder { max_attempts: None, endpoint: None, mode_override: None, token_ttl: None, connect_timeout: None, read_timeout: None, config: Some(ProviderConfig { env: Env(Real), fs: Fs(Real), sleep: Some(SharedAsyncSleep(TokioSleep)), region: Some(Region("us-east-1")) }) } }, env: Env(Real), profile: None, time_source: SharedTimeSource(SystemTimeSource), last_retrieved_credentials: RwLock { data: None, poisoned: false, .. } })] } }) }) }) signer=SigV4Signer
2023-08-25T22:54:29.295610Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator::auth: extracted auth scheme endpoint config auth_scheme_endpoint_config=AuthSchemeEndpointConfig(None)
2023-08-25T22:54:29.295622Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_credential_types::cache::no_caching: Delegating `provide_cached_credentials` to `provide_credentials` on the provider
2023-08-25T22:54:29.295656Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt:provide_credentials{provider=default_chain}: aws_config::meta::credentials::chain: loaded credentials provider=Environment
2023-08-25T22:54:29.295672Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator::auth: resolved identity identity=Identity { data: Credentials { provider_name: "EnvironmentVariable", access_key_id: "foo", secret_access_key: "** redacted **" }, expiration: None }
2023-08-25T22:54:29.295684Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator::auth: signing request
2023-08-25T22:54:29.295728Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_sigv4::http_request::sign: signing request request=SignableRequest { method: POST, uri: https://sts.us-east-2.amazonaws.com/, headers: {"content-type": "application/x-www-form-urlencoded", "content-length": "115", "user-agent": "aws-sdk-rust/0.56.1 os/macos lang/rust/1.71.1", "x-amz-user-agent": "aws-sdk-rust/0.56.1 api/sts/0.30.0 os/macos lang/rust/1.71.1"}, body: Bytes([65, 99, 116, 105, 111, 110, 61, 65, 115, 115, 117, 109, 101, 82, 111, 108, 101, 38, 86, 101, 114, 115, 105, 111, 110, 61, 50, 48, 49, 49, 45, 48, 54, 45, 49, 53, 38, 82, 111, 108, 101, 65, 114, 110, 61, 97, 114, 110, 37, 51, 65, 97, 119, 115, 37, 51, 65, 105, 97, 109, 37, 51, 65, 37, 51, 65, 49, 50, 51, 52, 53, 54, 55, 56, 57, 48, 49, 50, 37, 51, 65, 114, 111, 108, 101, 37, 50, 70, 100, 101, 109, 111, 38, 82, 111, 108, 101, 83, 101, 115, 115, 105, 111, 110, 78, 97, 109, 101, 61, 116, 101, 115, 116, 65, 82]) } params=SigningParams { access_key: "** redacted **", secret_key: "** redacted **", security_token: "** redacted **", region: "us-east-2", service_name: "sts", time: SystemTime { tv_sec: 1693004069, tv_nsec: 295696000 }, settings: SigningSettings { percent_encoding_mode: Double, payload_checksum_kind: NoHeader, signature_location: Headers, expires_in: None, excluded_headers: Some(["authorization", "user-agent", "x-amzn-trace-id"]), uri_path_normalization_mode: Enabled, session_token_mode: Include } }
2023-08-25T22:54:29.296026Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_sigv4::http_request::sign: canonical_request=POST
/

content-length:115
content-type:application/x-www-form-urlencoded
host:sts.us-east-2.amazonaws.com
x-amz-date:20230825T225429Z
x-amz-user-agent:aws-sdk-rust/0.56.1 api/sts/0.30.0 os/macos lang/rust/1.71.1

content-length;content-type;host;x-amz-date;x-amz-user-agent
7181f6b9a18ffedcf6b9e0cb5fcdf6b588a3d71e624571c386b7cbde629b5680
2023-08-25T22:54:29.296200Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::interceptors: running `modify_before_transmit` interceptors
2023-08-25T22:54:29.296253Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::interceptors::context: entering 'transmit' phase
2023-08-25T22:54:29.296266Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator: transmitting request request=Request { method: POST, uri: https://sts.us-east-2.amazonaws.com/, version: HTTP/1.1, headers: {"content-type": "application/x-www-form-urlencoded", "content-length": "115", "user-agent": "aws-sdk-rust/0.56.1 os/macos lang/rust/1.71.1", "x-amz-user-agent": "aws-sdk-rust/0.56.1 api/sts/0.30.0 os/macos lang/rust/1.71.1", "x-amz-date": "20230825T225429Z", "authorization": Sensitive, "amz-sdk-request": "attempt=1; max=1", "amz-sdk-invocation-id": "a7349dd4-c1b3-49bf-9364-d34f141618a5"}, body: SdkBody { inner: Once(Some(b"Action=AssumeRole&Version=2011-06-15&RoleArn=arn%3Aaws%3Aiam%3A%3A123456789012%3Arole%2Fdemo&RoleSessionName=testAR")), retryable: true } }
2023-08-25T22:54:29.296503Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: hyper::client::pool: checkout waiting for idle connection: ("https", sts.us-east-2.amazonaws.com)
2023-08-25T22:54:29.296594Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: hyper::client::connect::http: Http::connect; scheme=Some("https"), host=Some("sts.us-east-2.amazonaws.com"), port=None
2023-08-25T22:54:29.296725Z DEBUG hyper::client::connect::dns: resolving host="sts.us-east-2.amazonaws.com"
2023-08-25T22:54:29.298175Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: hyper::client::connect::http: connecting to 52.95.16.30:443
2023-08-25T22:54:29.370648Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: hyper::client::connect::http: connected to 52.95.16.30:443
2023-08-25T22:54:29.370736Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::hs: No cached session for DnsName("sts.us-east-2.amazonaws.com")    
2023-08-25T22:54:29.370952Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::hs: Not resuming any session    
2023-08-25T22:54:29.371147Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::hs: Sending ClientHello Message {
    version: TLSv1_0,
    payload: Handshake {
        parsed: HandshakeMessagePayload {
            typ: ClientHello,
            payload: ClientHello(
                ClientHelloPayload {
                    client_version: TLSv1_2,
                    random: 4fbb89aeb63382959d17dfee6ce0f3968136c2c6519b543cbc39d2480f452c39,
                    session_id: 66671f2e519687491513969d529328a7d0e843cdc8affc5c831799908d6e8280,
                    cipher_suites: [
                        TLS13_AES_256_GCM_SHA384,
                        TLS13_AES_128_GCM_SHA256,
                        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
                        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
                        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
                        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
                        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
                        TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
                    ],
                    compression_methods: [
                        Null,
                    ],
                    extensions: [
                        SupportedVersions(
                            [
                                TLSv1_3,
                                TLSv1_2,
                            ],
                        ),
                        ECPointFormats(
                            [
                                Uncompressed,
                            ],
                        ),
                        NamedGroups(
                            [
                                X25519,
                                secp256r1,
                                secp384r1,
                            ],
                        ),
                        SignatureAlgorithms(
                            [
                                ECDSA_NISTP384_SHA384,
                                ECDSA_NISTP256_SHA256,
                                ED25519,
                                RSA_PSS_SHA512,
                                RSA_PSS_SHA384,
                                RSA_PSS_SHA256,
                                RSA_PKCS1_SHA512,
                                RSA_PKCS1_SHA384,
                                RSA_PKCS1_SHA256,
                            ],
                        ),
                        ExtendedMasterSecretRequest,
                        CertificateStatusRequest(
                            OCSP(
                                OCSPCertificateStatusRequest {
                                    responder_ids: [],
                                    extensions: ,
                                },
                            ),
                        ),
                        ServerName(
                            [
                                ServerName {
                                    typ: HostName,
                                    payload: HostName(
                                        DnsName(
                                            "sts.us-east-2.amazonaws.com",
                                        ),
                                    ),
                                },
                            ],
                        ),
                        SignedCertificateTimestampRequest,
                        KeyShare(
                            [
                                KeyShareEntry {
                                    group: X25519,
                                    payload: d1bcb2445b6aaafd3b5b0826d35e4a373c28cbb24151a4f96b9d729aa858847d,
                                },
                            ],
                        ),
                        PresharedKeyModes(
                            [
                                PSK_DHE_KE,
                            ],
                        ),
                        Protocols(
                            [
                                ProtocolName(
                                    6832,
                                ),
                                ProtocolName(
                                    687474702f312e31,
                                ),
                            ],
                        ),
                        SessionTicket(
                            Request,
                        ),
                    ],
                },
            ),
        },
        encoded: 0100010703034fbb89aeb63382959d17dfee6ce0f3968136c2c6519b543cbc39d2480f452c392066671f2e519687491513969d529328a7d0e843cdc8affc5c831799908d6e8280001013021301c02cc02bc030c02fcca800ff010000ae002b00050403040303000b00020100000a00080006001d00170018000d001400120503040308070806080508040601050104010017000000050005010000000000000020001e00001b7374732e75732d656173742d322e616d617a6f6e6177732e636f6d00120000003300260024001d0020d1bcb2445b6aaafd3b5b0826d35e4a373c28cbb24151a4f96b9d729aa858847d002d000201010010000e000c02683208687474702f312e3100230000,
    },
}    
2023-08-25T22:54:29.444615Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::hs: We got ServerHello ServerHelloPayload {
    legacy_version: TLSv1_2,
    random: d8e5b96a7c943d9de8caeca7159323977d048b26ad9284218ed2feeec7a60574,
    session_id: 92ffadac842dcfe21df8b9ac880bb13a6e950bb6b99ef85da2a189caf9120b46,
    cipher_suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
    compression_method: Null,
    extensions: [
        ServerNameAck,
        ECPointFormats(
            [
                Uncompressed,
            ],
        ),
        RenegotiationInfo(
            ,
        ),
        Protocols(
            [
                ProtocolName(
                    687474702f312e31,
                ),
            ],
        ),
        ExtendedMasterSecretAck,
    ],
}    
2023-08-25T22:54:29.444717Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::hs: ALPN protocol is Some(b"http/1.1")    
2023-08-25T22:54:29.444750Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::hs: Using ciphersuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256    
2023-08-25T22:54:29.444935Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::tls12: ECDHE curve is ECParameters { curve_type: NamedCurve, named_group: secp256r1 }    
2023-08-25T22:54:29.444970Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::tls12: Server cert is [Certificate(b"0\x82\x06\x070\x82\x04\xef\xa0\x03\x02\x01\x02\x02\x10\x04\x0c\x8e\xa5SUv\x9f\xbe\xa3\\7\0<\xec\x060\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\00<1\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x0f0\r\x06\x03U\x04\n\x13\x06Amazon1\x1c0\x1a\x06\x03U\x04\x03\x13\x13Amazon RSA 2048 M010\x1e\x17\r230308000000Z\x17\r240307235959Z0&1$0\"\x06\x03U\x04\x03\x13\x1bsts.us-east-2.amazonaws.com0\x82\x01\"0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\0\x03\x82\x01\x0f\00\x82\x01\n\x02\x82\x01\x01\0\xb3\xe7\xdb\xdb\x93w\xef\xc9\xa26\x81e\xeef\xf0\x97\x89\xee\xee\xa4\xe5\xd7\xb4l\xbb\xfd3\x975*\x04K\xe0o%DR\xc55\xb8\x8f\x0e\xd2\x9d\xfa\x80\x94b\xd6*\0\xdc$\xc0r\\\xaf\xcc\xea\x90\x91`\xf8\x1c\x949\xfbD\x85\x1d\xb0\x98\xd1\x8a\x04\"\x9a\x8a\x96\xf3\xdf\xbc\x83[\xed\xc2\x9fB\xad\x8d\xc5\xfa\xf5\xa1\x94\x86\xf45!\x1a\xaa\xfd\xbe\x04\"J\xe2W[\xa9\xf7\x88X,\xf62\xb9<\xae\xda\xf9\xdcRtAs\x8b\x86\xe0\x81\xd2\x17\x8f\x89\x98\r\xd3\x9aW\x02\x08\x88<\xcc\xa1\x194\xf8Z\xf0O\xa3i\xb8JY\xdd`p\x98\xea\x96)E\xba\xe9\xf4\xb6L6\xd9\x04I\x99\xb0\xd7\x9f\xa3\x1a?\xa30)V\x94R\x138L\xbb\xdd\xf9\xb20\x97\x0b\xea\x1bN|\x02g\xda4\xb5\xad\xf6E{U\xda\xccU\x7f\xcd\xe46h.\xcb\xf2\xb1\xd4\xff\xa4\x81p\xa3\xd1`\x1ax\xf6\xd6\xa8\xb6\x19\xe2\x05*b\xb7\x06\xc4\x04Os\x8d\xb9\x10j\x0e\xf7\0\x8b\xc7\x02\x03\x01\0\x01\xa3\x82\x03\x190\x82\x03\x150\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\x81\xb8\x0ec\x8a\x89\x12\x18\xe5\xfa;;P\x95\x9f\xe6\xe5\x90\x13\x850\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\x7f/\x07@\x8f5\xd7PS\x05Y/@\x8a\xc3\x02t\x97~\xd00J\x06\x03U\x1d\x11\x04C0A\x82\x1bsts.us-east-2.amazonaws.com\x82\"*.sts.us-east-2.vpce.amazonaws.com0\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x05\xa00\x1d\x06\x03U\x1d%\x04\x160\x14\x06\x08+\x06\x01\x05\x05\x07\x03\x01\x06\x08+\x06\x01\x05\x05\x07\x03\x020;\x06\x03U\x1d\x1f\x0440200\xa0.\xa0,\x86*http://crl.r2m01.amazontrust.com/r2m01.crl0\x13\x06\x03U\x1d \x04\x0c0\n0\x08\x06\x06g\x81\x0c\x01\x02\x010u\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04i0g0-\x06\x08+\x06\x01\x05\x05\x070\x01\x86!http://ocsp.r2m01.amazontrust.com06\x06\x08+\x06\x01\x05\x05\x070\x02\x86*http://crt.r2m01.amazontrust.com/r2m01.cer0\x0c\x06\x03U\x1d\x13\x01\x01\xff\x04\x020\00\x82\x01\x7f\x06\n+\x06\x01\x04\x01\xd6y\x02\x04\x02\x04\x82\x01o\x04\x82\x01k\x01i\0w\0\xee\xcd\xd0d\xd5\xdb\x1a\xce\xc5\\\xb7\x9d\xb4\xcd\x13\xa22\x87F|\xbc\xec\xde\xc3QHYFq\x1f\xb5\x9b\0\0\x01\x86\xc2\xc4\x987\0\0\x04\x03\0H0F\x02!\0\xc1\xeb\xd4G\xa7rK\x07\xd1\xb1J\xf3!-SJ\xb0\xf5\x10\xae i\"F\x9cM<N&(\xdcr\x02!\0\xd1\xab\xaa\xdb\x99X+kn\x12\xc8e^\xc6#\xc9$J\xd9\xa9\x01\x9b\xd9\x12\x07\xde\xabn\x1c<\x1em\0v\0s\xd9\x9e\x89\x1bL\x96x\xa0 }G\x9d\xe6\xb2\xc6\x1c\xd0Q^q\x19*\x8ck\x80\x10z\xc1wr\xb5\0\0\x01\x86\xc2\xc4\x98\x97\0\0\x04\x03\0G0E\x02!\0\xfe\xb0\x97%E\xeb%\x1c\x895\xff\x15\xd7\x81\xd5\x91Y\x82\xdb\x010\x08\xb0\x06[sA\xed\xfb\x1d1\x82\x02 ;\xc9\xbc!b\xfe_P\xc7\x99\xbc\x95*\xe9\x907Z\xce\r\x17\x98E\xf5\xa1\x06\xe6\x05\x89\\\xb4\xbcU\0v\0H\xb0\xe3k\xda\xa6G4\x0f\xe5j\x02\xfa\x9d0\xeb\x1cR\x01\xcbV\xdd,\x81\xd9\xbb\xbf\xab9\xd8\x84s\0\0\x01\x86\xc2\xc4\x98`\0\0\x04\x03\0G0E\x02 zU>\xa0\x1f\xe4b\x01\xa4\xb6\xa8)\x98c\xb7\x13Ou\x8b\xd6j\"\n\xcf\x93\xc8vV\x04\x1c\xb7e\x02!\0\x94\xfb\x9b\xd4m\xe4\x93X\xd7h6Z\xea\xe6\xcb\xeb\xc2\x04l?F\rX;%\xc7\x91\x1c\xd8Ku[0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\0\x03\x82\x01\x01\0\x83\xc6\xae3n\xc2\xeaY\xb0\xd72\xebU;\xa0\xb4\x08wdV\xe0\x976nX#_{zWx}\x1a\x84\x9aer\xd7\xbc\xb0\x1dC\x96\x9d\xe5o\xb6\xb3\xa9\xe4\x9c\xc6\xe5J\x98/P\xa6o\xb1\xb9\xd24H\0-\xe4eG\x9b0\xc9\xa19\x93\xef&{\xcav\x11\x1c\x06g\xe0\xe4[L\xa4\x06\xdfE\x03\x10\x03\xcacrO7\td'\x06\x13a\x1cJr\xc7uMw\x9e\x066\xe2\xc0\xa5CF\x9c\xe8R\xd8]\xa0\xd3;k)\xb3\xc5Z\x8e\x08\xd2\x06\xbc\x19\x0b\t,\x99\x18\x9b\x0e\xb2\xda\xd8\x1d\xd5\x19\xd7l\xe4T\x83X$\x18i\xc4\xa8\xb3r\xf8\xa98F\xd3\x19\xf1n\x07\xfeh\xc5w\xca{\xf2L\x16Rq&\x81\xe5\x1a\xb0T\xd9\x84\xc9\xa4@\xb7 @0\xfd\xfb\xdcy6g\x8e\xb5\x80\xdcW\xb0\xd3\xc7\x83\xec\xd7W\xc5\x97\xc6G\xc1p\x8f^\x08sux\xd5\x1a;`\xd3\xb8\xc2\x8dl6T4\xd6\x02w|\xab\xf0\x13\x93\xafc\x860\xc9"), Certificate(b"0\x82\x04^0\x82\x03F\xa0\x03\x02\x01\x02\x02\x13\x07s\x128\x0b\x9df\x88\xa3;\x1e\xd9\xbf\x9c\xcd\xa6\x8e\x0e\x0f0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\0091\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x0f0\r\x06\x03U\x04\n\x13\x06Amazon1\x190\x17\x06\x03U\x04\x03\x13\x10Amazon Root CA 10\x1e\x17\r220823222128Z\x17\r300823222128Z0<1\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x0f0\r\x06\x03U\x04\n\x13\x06Amazon1\x1c0\x1a\x06\x03U\x04\x03\x13\x13Amazon RSA 2048 M010\x82\x01\"0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\0\x03\x82\x01\x0f\00\x82\x01\n\x02\x82\x01\x01\0\xebq,\xa9\xcb\x1f\x88(\x9220\xaf\x8aW\x0fx\xb77%\x95U\x87\xacg\\\x97\xd3\"\xc8\xda\xa2\x14gk|\xf0g\xda\xe2\x03*\xb3V\x12]\xc6\xb5G\xf9g\x08\xa7\x93z\x95\x92\x18\x0f\xb4\xf9\xf9\x106\x9a\x7f/\x80\xb6O\xba\x13N\xc7]S\x1e\xe0\xdd\x963\x07 \xd3\x96\xbc\x12\xe4tPB\xa1\x05\x13s\xb5O\x9bD$\xfe-\x7f\xed\xbc\"\x85\xec6!3\x97u\x06\xce'\x18\x82\xdc\xe3\xd9\xc5\x82\x07\x8d^&\x01&&g\x1f\xd9?\x13\xcf2\xbak\xadxd\xfc\xaa\xff\x0e\x02<\x07\xdf\x9c\x05xr\x8c\xfd\xeau\xb7\x03(\x84\xda\xe8n\x07\x8c\xd0P\x85\xef\x81T\xb2qn\xecmb\xef\x8f\x94\xc3^\xe9\xc4\xa4\xd0\x91\xc0.$\x91\x98\xca\xee\xba%\x8e\xd4\xf6q\xb6\xfb[k8\x06H7G\x8d\x86\xdc\xf2\xea\x06\xfbv7}\x9e\xffBNMX\x82\x93\xcf\xe2q\xc2x\xb1z\xabK[\x947\x88\x81\xe4\xd9\xaf$\xae\xf8r\xc5e\xfbK\xb4Q\xe7\x02\x03\x01\0\x01\xa3\x82\x01Z0\x82\x01V0\x12\x06\x03U\x1d\x13\x01\x01\xff\x04\x080\x06\x01\x01\xff\x02\x01\00\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x01\x860\x1d\x06\x03U\x1d%\x04\x160\x14\x06\x08+\x06\x01\x05\x05\x07\x03\x01\x06\x08+\x06\x01\x05\x05\x07\x03\x020\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\x81\xb8\x0ec\x8a\x89\x12\x18\xe5\xfa;;P\x95\x9f\xe6\xe5\x90\x13\x850\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\x84\x18\xcc\x854\xec\xbc\x0c\x94\x94.\x08Y\x9c\xc7\xb2\x10N\n\x080{\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04o0m0/\x06\x08+\x06\x01\x05\x05\x070\x01\x86#http://ocsp.rootca1.amazontrust.com0:\x06\x08+\x06\x01\x05\x05\x070\x02\x86.http://crt.rootca1.amazontrust.com/rootca1.cer0?\x06\x03U\x1d\x1f\x0480604\xa02\xa00\x86.http://crl.rootca1.amazontrust.com/rootca1.crl0\x13\x06\x03U\x1d \x04\x0c0\n0\x08\x06\x06g\x81\x0c\x01\x02\x010\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\0\x03\x82\x01\x01\0\xad\0\xde\x02\x05#.\x062b\xb4k\xb1\x94\x16\xe4\x11@\xde+\xfaY\xc15\xef\xe0\xaa\x8f+A\xb9\xd1\xf3\x879\0\x1d\xf2=\xb5\xa7G\x0c\x06\x06\xc6\x91\xf3\x07W\x02\xd4\xed\xbd\x17\xc1\x90\x9a\xbfHu\xa2\x07O0\xddJjB\xb5\r=\x15\xc0\x0f\xfe\x84[\xc6<\x99\xccWR\xb1\xd8n\x12\xd5\x96\x92\x93K\x94\xe5\x07\xe8\x89\x82\x08jz4\xd4\x9ed\xe1=\x87j\x92\x90\x9ac\xa1K\xf8\x8f\xb6\xea4\xd3\x05\xbe \xc2\xde\x06\xe2\x8c\x9fs\x8b\x9fM9\x85\xca\xce\x196\x9d\x85\xc9\x9e\xc9\xf8P?\xb6~\x88\xa1\xef\xca\x84\x06\x8bP\xb4\n\\\xa6\x1cD\xf1\xfd\xc8a@`\xf2a%\xaa\x07\xf4\xc7\xc2su\xe4\x0c\x0bB\x8d\x04\xe5_DH\x99[{\x89\x81\x96\xa7\x88\x9dK\rb\xe8\x04\xc4\xd7\xfe\xb4\xe8\xb2m\xca\xec\xc0\x1c\xbc8[\x1d\xdf\x85\xce[z\xe3IKl\xb9\xa7\xdd\xf4\x05\xb2I\xad\xe1\xc5\x14k\xc2\xcc\xeb\xcd\x7f\xd6Xi\xba\xc3 ~\x7f\xb0\xb8"), Certificate(b"0\x82\x04\x920\x82\x03z\xa0\x03\x02\x01\x02\x02\x13\x06\x7f\x94J*'\xcd\xf3\xfa\xc2\xae+\x01\xf9\x08\xee\xb9\xc4\xc60\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\00\x81\x981\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x100\x0e\x06\x03U\x04\x08\x13\x07Arizona1\x130\x11\x06\x03U\x04\x07\x13\nScottsdale1%0#\x06\x03U\x04\n\x13\x1cStarfield Technologies, Inc.1;09\x06\x03U\x04\x03\x132Starfield Services Root Certificate Authority - G20\x1e\x17\r150525120000Z\x17\r371231010000Z091\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x0f0\r\x06\x03U\x04\n\x13\x06Amazon1\x190\x17\x06\x03U\x04\x03\x13\x10Amazon Root CA 10\x82\x01\"0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\0\x03\x82\x01\x0f\00\x82\x01\n\x02\x82\x01\x01\0\xb2x\x80q\xcax\xd5\xe3q\xafG\x80Pt}n\xd8\xd7\x88v\xf4\x99h\xf7X!`\xf9t\x84\x01/\xac\x02-\x86\xd3\xa0CzN\xb2\xa4\xd06\xba\x01\xbe\x8d\xdbH\xc8\x07\x176L\xf4\xee\x88#\xc7>\xeb7\xf5\xb5\x19\xf8Ih\xb0\xde\xd7\xb9v8\x1da\x9e\xa4\xfe\x826\xa5\xe5JV\xe4E\xe1\xf9\xfd\xb4\x16\xfat\xda\x9c\x9b59/\xfa\xb0 P\x06lz\xd0\x80\xb2\xa6\xf9\xaf\xecG\x19\x8fP8\x07\xdc\xa2\x879X\xf8\xba\xd5\xa9\xf9Hg0\x96\xee\x94x^o\x89\xa3Q\xc00\x86f\xa1Ef\xbaT\xeb\xa3\xc3\x91\xf9H\xdc\xff\xd1\xe80-}-tp5\xd7\x88$\xf7\x9e\xc4Yn\xbbs\x87\x17\xf22F(\xb8C\xfa\xb7\x1d\xaa\xca\xb4\xf2\x9f$\x0e-K\xf7q\\^i\xff\xea\x95\x02\xcb8\x8a\xaeP8o\xdb\xfb-b\x1b\xc5\xc7\x1eT\xe1w\xe0g\xc8\x0f\x9c\x87#\xd6?@ \x7f \x80\xc4\x80L>;$&\x8e\x04\xael\x9a\xc8\xaa\r\x02\x03\x01\0\x01\xa3\x82\x0110\x82\x01-0\x0f\x06\x03U\x1d\x13\x01\x01\xff\x04\x050\x03\x01\x01\xff0\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x01\x860\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\x84\x18\xcc\x854\xec\xbc\x0c\x94\x94.\x08Y\x9c\xc7\xb2\x10N\n\x080\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\x9c_\0\xdf\xaa\x01\xd70+8\x88\xa2\xb8mJ\x9c\xf2\x11\x91\x830x\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04l0j0.\x06\x08+\x06\x01\x05\x05\x070\x01\x86\"http://ocsp.rootg2.amazontrust.com08\x06\x08+\x06\x01\x05\x05\x070\x02\x86,http://crt.rootg2.amazontrust.com/rootg2.cer0=\x06\x03U\x1d\x1f\x0460402\xa00\xa0.\x86,http://crl.rootg2.amazontrust.com/rootg2.crl0\x11\x06\x03U\x1d \x04\n0\x080\x06\x06\x04U\x1d \00\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\0\x03\x82\x01\x01\0b7B\\\xbc\x10\xb5>\x8b,\xe9\x0c\x9blE\xe2\x07\0z\xf9\xc5X\x0b\xb9\x08\x8c>\xed\xb3%<\xb5oP\xe4\xcd5j\xa7\x934\x962!\xa9HD\xab\x9c\xed=\xb4\xaasm\xe4\x7f\x16\x80\x89l\xcf(\x03\x18\x83Gy\xa3\x10~0[\xac;\xb0`\xe0w\xd4\x08\xa6\xe1\x1d|^\xc0\xbb\xf9\x9a{\"\x9d\xa7\0\t~\xacF\x17\x83\xdc\x9c&W\x9909b\x96\x8f\xed\xda\xde\xaa\xc5\xcc\x1b>\xcaChlW\x16\xbc\xd5\x0e .\xfe\xff\xc2j].\xa0Jm\x14X\x87\x94\xe691_|s\xcb\x90\x88j\x84\x11\x96'\xa6\xed\xd9\x81F\xa6~\xa3r\0\nR>\x83\x88\x07cw\x89i\x17\x0f9\x85\xd2\xab\x08EM\xd0Q:\xfd]]7dL~0\xb2U$B\x9d6\xb0]\x9c\x17\x81a\xf1\xca\xf9\x10\x02$\xab\xeb\rt\x91\x8d{E)P9\x88\xb2\xa6\x895%\x1e\x14jG#1/\\\x9a\xfa\xad\x9a\x0ebQ\xa4*\xa9\xc4\xf94\x9d!\x18"), Certificate(b"0\x82\x04u0\x82\x03]\xa0\x03\x02\x01\x02\x02\t\0\xa7\x0eJL4\x82\xb7\x7f0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\00h1\x0b0\t\x06\x03U\x04\x06\x13\x02US1%0#\x06\x03U\x04\n\x13\x1cStarfield Technologies, Inc.1200\x06\x03U\x04\x0b\x13)Starfield Class 2 Certification Authority0\x1e\x17\r090902000000Z\x17\r340628173916Z0\x81\x981\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x100\x0e\x06\x03U\x04\x08\x13\x07Arizona1\x130\x11\x06\x03U\x04\x07\x13\nScottsdale1%0#\x06\x03U\x04\n\x13\x1cStarfield Technologies, Inc.1;09\x06\x03U\x04\x03\x132Starfield Services Root Certificate Authority - G20\x82\x01\"0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\0\x03\x82\x01\x0f\00\x82\x01\n\x02\x82\x01\x01\0\xd5\x0c:\xc4*\xf9N\xe2\xf5\xbe\x19\x97_\x8e\x88S\xb1\x1f?\xcb\xcf\x9f \x13m):\xc8\x0f}<\xf7kv8c\xd96`\xa8\x9b^\\\0\x80\xb2/Y\x7f\xf6\x87\xf9%C\x86\xe7i\x1bR\x9a\x90\xe1q\xe3\xd8-\rNo\xf6\xc8I\xd9\xb6\xf3\x1aV\xae+\xb6t\x14\xeb\xcf\xfb&\xe3\x1a\xba\x1d\x96.j;X\x94\x89GV\xff%\xa0\x93pS\x83\xda\x84t\x14\xc3g\x9e\x04h:\xdf\x8e@Z\x1dJN\xcfC\x91;\xe7V\xd6\0p\xcbR\xee{}\xae:\xe7\xbc1\xf9E\xf6\xc2`\xcf\x13Y\x02+\x80\xcc4G\xdf\xb9\xde\x90em\x02\xcf,\x91\xa6\xa6\xe7\xde\x85\x18I|fN\xa3:m\xa9\xb5\xee4.\xba\r\x03\xb83\xdfG\xeb\xb1k\x8d%\xd9\x9b\xce\x81\xd1EF2\x96p\x87\xde\x02\x0eIC\x85\xb6ls\xbbd\xeaaA\xac\xc9\xd4T\xdf\x87/\xc7\"\xb2&\xcc\x9fYTh\x9f\xfc\xbe*/\xc4U\x1cu@`\x17\x85\x02U9\x8b\x7f\x05\x02\x03\x01\0\x01\xa3\x81\xf00\x81\xed0\x0f\x06\x03U\x1d\x13\x01\x01\xff\x04\x050\x03\x01\x01\xff0\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x01\x860\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\x9c_\0\xdf\xaa\x01\xd70+8\x88\xa2\xb8mJ\x9c\xf2\x11\x91\x830\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\xbf_\xb7\xd1\xce\xdd\x1f\x86\xf4[U\xac\xdc\xd7\x10\xc2\x0e\xa9\x88\xe70O\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04C0A0\x1c\x06\x08+\x06\x01\x05\x05\x070\x01\x86\x10http://o.ss2.us/0!\x06\x08+\x06\x01\x05\x05\x070\x02\x86\x15http://x.ss2.us/x.cer0&\x06\x03U\x1d\x1f\x04\x1f0\x1d0\x1b\xa0\x19\xa0\x17\x86\x15http://s.ss2.us/r.crl0\x11\x06\x03U\x1d \x04\n0\x080\x06\x06\x04U\x1d \00\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\0\x03\x82\x01\x01\0#\x1d\xe3\x8aW\xca}\xe9\x17yL\xf1\x1eU\xfd\xccSn>G\x0f\xdf\xc6U\xf2\xb2\x046\xed\x80\x1fS\xc4]4(k\xbe\xc7U\xfcg\xea\xcb?\x7f\x90\xb23\xcd\x1bX\x10\x82\x02\xf8\xf8/\xf5\x13`\xd4\x05\xce\xf1\x81\x08\xc1\xdd\xa7u\x97O\x18\xb9m\xde\xf7\x93\x91\x08\xba~@,\xed\xc1\xea\xbbv\x9e3\x06w\x1d\r\x08\x7fS\xdd\x1bd\xab\x82'\xf1i\xd5M^\xae\xf4\xa1\xc3u\xa7XD-\xf2<p\x98\xac\xbai\xb6\x95w\x7f\x0f1^,\xfc\xa0\x87:Gi\xf0y_\xf4\x14T\xa4\x95^\x11x\x12`'\xce\x9f\xc2w\xff#Sw]\xba\xff\xeaY\xe7\xdb\xcf\xaf\x92\x96\xef$\x9a5\x10z\x9c\x91\xc6\x0e}\x99\xf6?\x19\xdf\xf5rT\xe1\x15\xa9\x07Y{\x83\xbfR.F\x8c\xb2\0dv\x1cH\xd3\xd8y\xe8nV\xcc\xae,\x03\x90\xd7\x198\x99\xe4\xca\t\x19[\xff\x07\x96\xb0\xa8\x7f4I\xdfV\xa9\xf7\xb0_\xed3\xed\x8cG\xb70\x03]\xf4\x03\x8c")]    
2023-08-25T22:54:29.445662Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: rustls::client::tls12: Server DNS name is DnsName("sts.us-east-2.amazonaws.com")    
2023-08-25T22:54:29.519867Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: hyper::client::conn: client handshake Http1
2023-08-25T22:54:29.520122Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: hyper::client::client: handshake complete, spawning background dispatcher task
2023-08-25T22:54:29.520749Z TRACE hyper::proto::h1::conn: flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Busy }
2023-08-25T22:54:29.520771Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: hyper::client::pool: checkout dropped for ("https", sts.us-east-2.amazonaws.com)
2023-08-25T22:54:29.521164Z TRACE encode_headers: hyper::proto::h1::role: Client::encode method=POST, body=Some(Known(115))
2023-08-25T22:54:29.521426Z TRACE hyper::proto::h1::encode: sized write, len = 115
2023-08-25T22:54:29.521446Z TRACE hyper::proto::h1::io: buffer.flatten self.len=625 buf.len=115
2023-08-25T22:54:29.521856Z DEBUG hyper::proto::h1::io: flushed 740 bytes
2023-08-25T22:54:29.521872Z TRACE hyper::proto::h1::conn: flushed({role=client}): State { reading: Init, writing: KeepAlive, keep_alive: Busy }
2023-08-25T22:54:29.596693Z TRACE hyper::proto::h1::conn: Conn::read_head
2023-08-25T22:54:29.597138Z TRACE hyper::proto::h1::io: received 470 bytes
2023-08-25T22:54:29.597306Z TRACE parse_headers: hyper::proto::h1::role: Response.parse bytes=470
2023-08-25T22:54:29.597622Z TRACE parse_headers: hyper::proto::h1::role: Response.parse Complete(164)
2023-08-25T22:54:29.597817Z DEBUG hyper::proto::h1::io: parsed 4 headers
2023-08-25T22:54:29.597837Z DEBUG hyper::proto::h1::conn: incoming body is content-length (306 bytes)
2023-08-25T22:54:29.597955Z TRACE hyper::proto::h1::decode: decode; state=Length(306)
2023-08-25T22:54:29.597978Z DEBUG hyper::proto::h1::conn: incoming body completed
2023-08-25T22:54:29.598027Z TRACE hyper::proto::h1::conn: maybe_notify; read_from_io blocked
2023-08-25T22:54:29.598099Z TRACE hyper::proto::h1::conn: flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Idle }
2023-08-25T22:54:29.598122Z TRACE hyper::proto::h1::conn: flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Idle }
2023-08-25T22:54:29.598152Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator: received response from service response=Response { status: 403, version: HTTP/1.1, headers: {"x-amzn-requestid": "9673f301-e15f-4178-a6a3-7ea53b57cea5", "content-type": "text/xml", "content-length": "306", "date": "Fri, 25 Aug 2023 22:54:29 GMT"}, body: SdkBody { inner: Streaming(Body(Streaming)), retryable: false } }
2023-08-25T22:54:29.598215Z TRACE hyper::client::pool: put; add idle connection for ("https", sts.us-east-2.amazonaws.com)
2023-08-25T22:54:29.598232Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::interceptors::context: entering 'before deserialization' phase
2023-08-25T22:54:29.598267Z DEBUG hyper::client::pool: pooling idle connection for ("https", sts.us-east-2.amazonaws.com)
2023-08-25T22:54:29.598331Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::interceptors: running `modify_before_deserialization` interceptors
2023-08-25T22:54:29.598391Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::retries: "Retryable Smithy Errors" classifier ignored the error
2023-08-25T22:54:29.598434Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::retries: "'Retry After' Header" classifier ignored the error
2023-08-25T22:54:29.598464Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::retries: "Errors Modeled As Retryable" classifier ignored the error
2023-08-25T22:54:29.598495Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::retries: "AWS Error Code" classifier ignored the error
2023-08-25T22:54:29.598528Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::retries: "HTTP Status Code" classifier ignored the error
2023-08-25T22:54:29.598633Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::interceptors::context: entering 'deserialization' phase
2023-08-25T22:54:29.598792Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt:deserialization:deserialize_nonstreaming: aws_sdk_sts::operation::assume_role: request_id=Some("9673f301-e15f-4178-a6a3-7ea53b57cea5")
2023-08-25T22:54:29.598867Z TRACE hyper::proto::h1::conn: flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Idle }
2023-08-25T22:54:29.599023Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime::client::orchestrator: output_or_error=Err(OrchestratorError { kind: Operation { err: Error(TypeErasedError:Unhandled(Unhandled { source: ErrorMetadata { code: Some("InvalidClientTokenId"), message: Some("The security token included in the request is invalid."), extras: Some({"aws_request_id": "9673f301-e15f-4178-a6a3-7ea53b57cea5"}) }, meta: ErrorMetadata { code: Some("InvalidClientTokenId"), message: Some("The security token included in the request is invalid."), extras: Some({"aws_request_id": "9673f301-e15f-4178-a6a3-7ea53b57cea5"}) } })) } })
2023-08-25T22:54:29.599103Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op:try_attempt: aws_smithy_runtime_api::client::interceptors::context: entering 'after deserialization' phase
2023-08-25T22:54:29.599227Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:finally_attempt: aws_smithy_runtime::client::interceptors: running `modify_before_attempt_completion` interceptors
2023-08-25T22:54:29.599276Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:try_op:finally_attempt: aws_smithy_runtime::client::interceptors: running `read_after_attempt` interceptors
2023-08-25T22:54:29.599406Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::retries::strategy::standard: not retrying because we are out of attempts attempts=1 max_attempts=1
2023-08-25T22:54:29.599448Z DEBUG assume_role:invoke{service=sts operation=AssumeRole}:try_op: aws_smithy_runtime::client::orchestrator: a retry is either unnecessary or not possible, exiting attempt loop
2023-08-25T22:54:29.599513Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:finally_op: aws_smithy_runtime::client::interceptors: running `modify_before_completion` interceptors
2023-08-25T22:54:29.599559Z TRACE assume_role:invoke{service=sts operation=AssumeRole}:finally_op: aws_smithy_runtime::client::interceptors: running `read_after_execution` interceptors
2023-08-25T22:54:29.599839Z  WARN assume_role: aws_config::sts::assume_role: STS refused to grant assume role error=unhandled error: unhandled error: Error { code: "InvalidClientTokenId", message: "The security token included in the request is invalid.", aws_request_id: "9673f301-e15f-4178-a6a3-7ea53b57cea5" } (Unhandled(Unhandled { source: ErrorMetadata { code: Some("InvalidClientTokenId"), message: Some("The security token included in the request is invalid."), extras: Some({"aws_request_id": "9673f301-e15f-4178-a6a3-7ea53b57cea5"}) }, meta: ErrorMetadata { code: Some("InvalidClientTokenId"), message: Some("The security token included in the request is invalid."), extras: Some({"aws_request_id": "9673f301-e15f-4178-a6a3-7ea53b57cea5"}) } }))
[src/main.rs:15] &provider.provide_credentials().await = Err(
    ProviderError(
        ProviderError {
            source: ServiceError(
                ServiceError {
                    source: Unhandled(
                        Unhandled {
                            source: ErrorMetadata {
                                code: Some(
                                    "InvalidClientTokenId",
                                ),
                                message: Some(
                                    "The security token included in the request is invalid.",
                                ),
                                extras: Some(
                                    {
                                        "aws_request_id": "9673f301-e15f-4178-a6a3-7ea53b57cea5",
                                    },
                                ),
                            },
                            meta: ErrorMetadata {
                                code: Some(
                                    "InvalidClientTokenId",
                2023-08-25T22:54:29.600217Z TRACE hyper::client::pool: idle interval checking for expired
                ),
                                message: Some(
                                    "The security token included in the request is invalid.",
                                ),
                                extras: Some(
                                    {
                                        "aws_request_id": "9673f301-e15f-4178-a6a3-7ea53b57cea5",
                                    },
                                ),
                            },
                        },
                    ),
                    raw: Response {
                        status: 403,
                        version: HTTP/1.1,
                        headers: {
                            "x-amzn-requestid": "9673f301-e15f-4178-a6a3-7ea53b57cea5",
                            "content-type": "text/xml",
                            "content-length": "306",
                            "date": "Fri, 25 Aug 2023 22:54:29 GMT",
                        },
                        body: SdkBody {
                            inner: Once(
                                Some(
                                    b"<ErrorResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\n  <Error>\n    <Type>Sender</Type>\n    <Code>InvalidClientTokenId</Code>\n    <Message>The security token included in the request is invalid.</Message>\n  </Error>\n  <RequestId>9673f301-e15f-4178-a6a3-7ea53b57cea5</RequestId>\n</ErrorResponse>\n",
                                ),
                            ),
                            retryable: true,
                        },
                    },
                },
            ),
        },
    ),
)
2023-08-25T22:54:29.601526Z TRACE hyper::proto::h1::dispatch: client tx closed
2023-08-25T22:54:29.601684Z TRACE hyper::proto::h1::conn: State::close_read()
2023-08-25T22:54:29.601697Z TRACE hyper::proto::h1::conn: State::close_write()
2023-08-25T22:54:29.601709Z TRACE hyper::proto::h1::conn: flushed({role=client}): State { reading: Closed, writing: Closed, keep_alive: Disabled }
2023-08-25T22:54:29.601781Z DEBUG rustls::common_state: Sending warning alert CloseNotify    
2023-08-25T22:54:29.602335Z TRACE hyper::client::pool: pool closed, canceling idle interval
2023-08-25T22:54:29.602603Z TRACE hyper::proto::h1::conn: shut down IO complete

[jdisanti]

I think this is a bug. Filed an issue to track fixing it: #882

[mehta-ankit]

@jszwedko @jdisanti
I wanted to clarify something. We are using FIPS endpoints in gov cloud and since STS endpoints in gov cloud and do not have any such issues. Reading above where you say:
I see it, reasonably, fail to fetch credentials, but, crucially, I see it hitting the normal STS endpoints rather than the FIPS ones.

I am assuming you reached that conclusion by just comparing AWS US East/West endpoints here which have the word fips in the URL's vs AWS gov cloud STS endpoints which are simply sts.us-gov-east-1.amazonaws.com.

Basically what i am saying is, URL's do not need to have the word fips in them to be FIPS compliant. Every URL on the FIPS docs page is FIPS compliant.

[alex-rowe]

For our use case, we're not in GovCloud, but still need the FIPS endpoints to be used.

When testing using the newest release of Vector (where this discussion came from), which now takes into account the AWS_USE_FIPS_ENDPOINT variable, we get the following output in us-west-2

hyper::client::connect::dns: resolving host="monitoring-fips.us-west-2.amazonaws.com"
hyper::client::connect::dns: resolving host="sts.us-west-2.amazonaws.com"
hyper::client::connect::dns: resolving host="kinesis-fips.us-west-2.amazonaws.com"

[mehta-ankit]

yea, that's what i wanted to confirm that, the bug only affects STS FIPS endpoints in non gov cloud for now.