Skip to content
This repository was archived by the owner on Mar 23, 2026. It is now read-only.

STS: New internalized STS provider#13737

Merged
pinzon merged 7 commits into
iam/moto-migrationfrom
sts/new-provider
Feb 27, 2026
Merged

STS: New internalized STS provider#13737
pinzon merged 7 commits into
iam/moto-migrationfrom
sts/new-provider

Conversation

@pinzon

@pinzon pinzon commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Motivation

With the objective to internalize the STS service. This PR implements a new service provider based on ASF and LocalStack stores, completly independent of the Moto library.

Changes

  • Added STS store with support for Cross-Account attributes.
  • Replaced the STS provider with an entirely new provider.
  • Added the necessary changes to providers.py

@github-actions

github-actions Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results - Preflight, Unit

23 070 tests  ±0   21 179 ✅ ±0   6m 20s ⏱️ +11s
     1 suites ±0    1 891 💤 ±0 
     1 files   ±0        0 ❌ ±0 

Results for commit bca7f0d. ± Comparison against base commit 69158c9.

♻️ This comment has been updated with latest results.

@pinzon pinzon added aws:sts AWS Security Token Service semver: minor Non-breaking changes which can be included in minor releases, but not in patch releases docs: skip Pull request does not require documentation changes notes: skip Pull request does not have to be mentioned in the release notes labels Feb 10, 2026
@github-actions

github-actions Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results (amd64) - Acceptance

7 tests  ±0   5 ✅ ±0   3m 9s ⏱️ +5s
1 suites ±0   2 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit bca7f0d. ± Comparison against base commit 69158c9.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results (amd64) - Integration, Bootstrap

    5 files  ±0      5 suites  ±0   2h 41m 10s ⏱️ - 2m 4s
6 039 tests ±0  5 510 ✅ +14  528 💤 ±0  1 ❌  - 14 
6 045 runs  ±0  5 510 ✅ +14  534 💤 ±0  1 ❌  - 14 

For more details on these failures, see this check.

Results for commit bca7f0d. ± Comparison against base commit 69158c9.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

LocalStack Community integration with Pro

    2 files  ±0    2 suites  ±0   1h 33m 19s ⏱️ - 33m 30s
5 634 tests ±0  135 ✅  - 5 112  363 💤  - 9  420 ❌ +405  4 716 🔥 +4 716 
5 636 runs  ±0  135 ✅  - 5 112  365 💤  - 9  420 ❌ +405  4 716 🔥 +4 716 

For more details on these failures and errors, see this check.

Results for commit bca7f0d. ± Comparison against base commit 69158c9.

♻️ This comment has been updated with latest results.

@pinzon pinzon marked this pull request as ready for review February 11, 2026 19:30
@pinzon pinzon requested a review from dfangl as a code owner February 11, 2026 19:30
@dfangl dfangl mentioned this pull request Feb 12, 2026
Merged
@dfangl dfangl force-pushed the iam/moto-migration branch from a2a079c to 37f4eb0 Compare February 12, 2026 10:25
@pinzon pinzon added this to the 4.14 milestone Feb 16, 2026
@dfangl dfangl force-pushed the iam/moto-migration branch from cdcd4df to 4526785 Compare February 16, 2026 18:25
@dfangl dfangl force-pushed the iam/moto-migration branch from 7211a8d to aabae16 Compare February 17, 2026 13:30
@dfangl dfangl force-pushed the iam/moto-migration branch from 49e13e2 to cbcd0f4 Compare February 19, 2026 18:50
@bentsku bentsku removed their request for review February 20, 2026 13:56
@anisaoshafi

anisaoshafi commented Feb 25, 2026

Copy link
Copy Markdown
Contributor

ℹ️ @pinzon I've changed the milestone to playground for now.

@anisaoshafi anisaoshafi modified the milestones: 4.14, Playground Feb 25, 2026
@dfangl dfangl modified the milestones: Playground, 2026.03 Feb 26, 2026
@dfangl dfangl force-pushed the iam/moto-migration branch from b1990ab to 4b158e1 Compare February 26, 2026 09:17
dfangl
dfangl suggested changes Feb 26, 2026
View reviewed changes
Comment thread localstack-core/localstack/services/sts/models.py Outdated
Comment thread localstack-core/localstack/services/sts/models.py Outdated
Comment thread localstack-core/localstack/services/sts/models.py Outdated
Comment thread localstack-core/localstack/services/sts/models.py
Comment thread localstack-core/localstack/services/sts/provider.py Outdated

# For permanent access keys (AKIA prefix), extract account from the key
# In LocalStack, we often encode the account ID in the access key
if access_key_id.startswith("AKIA"):

@dfangl dfangl Feb 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In LocalStack, this is LKIA - we should use the PARITY_AWS_ACCESS_KEY_ID variable here as well!

@dfangl dfangl Feb 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was this resolved?

@pinzon pinzon Feb 27, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad. I mixed up this comment with the comment about using config var to generate the Key

@pinzon pinzon Feb 27, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm removing that condition. It provides no value.

Comment thread localstack-core/localstack/services/sts/provider.py Outdated
@dfangl dfangl force-pushed the iam/moto-migration branch from 1751aaf to 2347778 Compare February 26, 2026 16:47
@pinzon pinzon requested a review from dfangl February 26, 2026 20:53
dfangl
dfangl approved these changes Feb 26, 2026
View reviewed changes

@dfangl dfangl left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, I have some more suggestions/questions, then it's good to merge from my side!

Comment thread localstack-core/localstack/services/sts/provider.py Outdated
Comment thread localstack-core/localstack/services/sts/provider.py Outdated
Comment thread localstack-core/localstack/services/sts/provider.py
role_id = generate_role_id(target_account_id)
if role := self._get_role_from_arn(role_arn):
role_id = role["RoleId"]
role_id = role_id.replace("AROA", "ARO1")

@dfangl dfangl Feb 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where does this come from?

@pinzon pinzon Feb 27, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the test test_sts.TestSTSIntegrations.test_assume_role_with_web_identity. It's marked as only_localstack so it could be wrong but it was migrated from moto

Comment thread localstack-core/localstack/services/sts/provider.py Outdated

# For permanent access keys (AKIA prefix), extract account from the key
# In LocalStack, we often encode the account ID in the access key
if access_key_id.startswith("AKIA"):

@dfangl dfangl Feb 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was this resolved?

@pinzon pinzon merged commit d87db73 into iam/moto-migration Feb 27, 2026
28 of 33 checks passed
@pinzon pinzon deleted the sts/new-provider branch February 27, 2026 19:22
dfangl pushed a commit that referenced this pull request Mar 4, 2026
@pinzon @dfangl
STS: New internalized STS provider (#13737)
449d4e1
dfangl pushed a commit that referenced this pull request Mar 4, 2026
@pinzon @dfangl
STS: New internalized STS provider (#13737)
2770dfd
dfangl pushed a commit that referenced this pull request Mar 6, 2026
@pinzon @dfangl
STS: New internalized STS provider (#13737)
be341de
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@dominikschubert dominikschubert Awaiting requested review from dominikschubert

@steffyP steffyP Awaiting requested review from steffyP

@alexrashed alexrashed Awaiting requested review from alexrashed

@silv-io silv-io Awaiting requested review from silv-io

@k-a-il k-a-il Awaiting requested review from k-a-il

@aidehn aidehn Awaiting requested review from aidehn

1 more reviewer

@dfangl dfangl dfangl approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

aws:sts AWS Security Token Service docs: skip Pull request does not require documentation changes notes: skip Pull request does not have to be mentioned in the release notes semver: minor Non-breaking changes which can be included in minor releases, but not in patch releases

Projects

None yet

Milestone

2026.03

Development

Successfully merging this pull request may close these issues.

3 participants

@pinzon @anisaoshafi @dfangl