Using FIPS Endpoints with Secrets Manager

[horvski]

I am trying to call FIPS endpoints with AWS Secrets Manager, and am having some troubles.

When I try the following:

	sdkConfig, err := config.LoadDefaultConfig(ctx, config.WithUseFIPSEndpoint(aws.FIPSEndpointStateEnabled))

Requests to secrets manager hang until a timeout occurs.

Running the following works fine:

	sdkConfig, err := config.LoadDefaultConfig(ctx)

After doing some debugging and reading, it sounded like my VPC could be the issue. I then tried the first approach above with S3, and it worked fine, so I do not think the VPC is the problem (unless secrets manager fips endpoints need additional VPC configurations for some reason).

After getting the FIPS endpoint timeout issue resolved, I'd like to figure out how to use the FIPS endpoint with github.com/aws/aws-secretsmanager-caching-go/secretcache

[lucix-aws]

The SDK itself is fairly removed from the networking element of making requests, all it really does is construct HTTP requests from the input, send them, and deserialize the responses into the corresponding output struct. The entire networking element is a black box from our perspective within the client's HTTPClient.Do method. If it's an issue of not being able to connect to the endpoint, in all likelihood it doesn't have anything to do with the SDK.

Requests to secrets manager hang until a timeout occurs.

Without seeing the actual error that the operation call returns it's going to be difficult to dive deeper here.

You're going to first need to confirm what endpoint for secrets manager the SDK is trying to connect to. The easiest way to do that is going to be through setting your client's ClientLogMode to aws.LogRequest and checking the value of the host header in what's printed.

Beyond that, we'd recommend you try to ping that endpoint without using the SDK itself (trying a ping-type command from the lambda, a net.LookupIP and net.Dial, etc.). If you still can't reach it from Lambda at all, you're going to need to open a support ticket through the console with the secrets manager team to take this further.