Update the AWS STS endpoint to be regional as the method is now regional

[snorlaX-sleeps]

Required to support AWS GovCloud.
Currently the token method accepts a region to create the signature for logging into an AWS Cluster, which should make it "quicker" on a regional basis.
However the AWS GovCloud partition does not / is not supported by the URL https://sts.amazonaws.com as AWS treats it as a totally separate entity.

This change updates the STS endpoint to match the region provided with the method.

I would be happy to change the PR to update the token method (even the parameters) to pass a gov_cloud named parameter (similar to the region one), then the original https://sts.amazonaws.com could be kept for speed / efficiency for end-users that do not set region and use normal AWS regions - then only set the region in the URL when using the govCloud partition?

List of AWS STS endpoint URLs

Fixes #527
Follows on from #507

[cben]

from the doc you linked:

AWS recommends using Regional STS endpoints to reduce latency, build in redundancy, and increase session token validity. Most Regional endpoints are active by default, but you must manually enable endpoints for some Regions, such as Asia Pacific (Hong Kong). You can deactivate STS endpoints for any Regions that are enabled by default if you do not intend to use those Regions.

So sounds like defaulting to per-region endpoint is best practice, not clear that a gov_cloud: false param should imply using https://sts.amazonaws.com. If you think this is useful to control, consider an explicit use_global_sts param?
(I never used this, deferring to you on what's actually best)

Meanwhile this LGTM as-is, merging. (and sorry for my non-responsiveness 🐌)

[cben]

close-cycling to rerun CI

[snorlaX-sleeps]

Hey @cben - thanks for getting back to me (I had a local copy of the gem so this was not an issue)

not clear that a gov_cloud: false param should imply using https://sts.amazonaws.com. If you think this is useful to control, consider an explicit use_global_sts param?

The https://sts.amazonaws.com endpoint is regional, that is just a common endpoint for any commercial (non-gov_cloud or certain other regions) to hit without needing to be region specific.
I think they are equivalent, I just didn't want to change pre-written functionality too much if you preferred.
There is a hard partition between commercial AWS accounts and gov_cloud accounts, so they have to use different services, hence the issue

[agrare]

Great fix @snorlaX-sleeps thank you