allow using assumeRoleChain with IAM resources

Author: ctkeyser

apis/v1beta1/types.go

@@ -17,6 +17,10 @@ type ProviderConfigSpec struct {
 	// AssumeRoleChain defines the options for assuming an IAM role
 	AssumeRoleChain []AssumeRoleOptions `json:"assumeRoleChain,omitempty"`
 
+	// AssumeRoleSTSRegion defines the region used for STS requests. If not defined,
+	// the managed resource region will be used if available
+	AssumeRoleSTSRegion *string `json:"assumeRoleSTSRegion,omitempty"`
+
 	// Endpoint is where you can override the default endpoint configuration
 	// of AWS calls made by the provider.
 	// +optional

apis/v1beta1/zz_generated.deepcopy.go

@@ -264,9 +264,14 @@ func UseProviderSecret(ctx context.Context, data []byte, profile, region string)
 // AssumeRoleWithWebIdentity & AssumeRoles.
 func GetRoleChainConfig(ctx context.Context, pcs *v1beta1.ProviderConfigSpec, cfg *aws.Config) (*aws.Config, error) {
 	pCfg := cfg
+	regionOpt := func(o *sts.Options) {
+		if pcs.AssumeRoleSTSRegion != nil {
+			o.Region = *pcs.AssumeRoleSTSRegion
+		}
+	}
 	for _, aro := range pcs.AssumeRoleChain {
 		stsAssume := stscreds.NewAssumeRoleProvider(
-			sts.NewFromConfig(*pCfg), //nolint:contextcheck
+			sts.NewFromConfig(*pCfg, regionOpt), //nolint:contextcheck
 			aws.ToString(aro.RoleARN),
 			SetAssumeRoleOptions(aro),
 		)

internal/clients/provider_config.go

@@ -93,6 +93,10 @@ spec:
                       type: array
                   type: object
                 type: array
+              assumeRoleSTSRegion:
+                description: AssumeRoleSTSRegion defines the region used for STS requests.
+                  If not defined, the managed resource region will be used if available
+                type: string
               credentials:
                 description: Credentials required to authenticate to this provider.
                 properties: