Can not update only the sts_endpoint without blanking out existing access_key and secret_key

[allyunion]

Is there a way to retain the existing access_key and secret_key credentials and still update the sts_endpoint?

vault/builtin/logical/aws/path_config_root.go

Lines 92 to 128 in 2a1753a

	func (b *backend) pathConfigRootWrite(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
	region := data.Get("region").(string)
	iamendpoint := data.Get("iam_endpoint").(string)
	stsendpoint := data.Get("sts_endpoint").(string)
	maxretries := data.Get("max_retries").(int)
	usernameTemplate := data.Get("username_template").(string)
	if usernameTemplate == "" {
	usernameTemplate = defaultUserNameTemplate
	}
	b.clientMutex.Lock()
	defer b.clientMutex.Unlock()
	entry, err := logical.StorageEntryJSON("config/root", rootConfig{
	AccessKey: data.Get("access_key").(string),
	SecretKey: data.Get("secret_key").(string),
	IAMEndpoint: iamendpoint,
	STSEndpoint: stsendpoint,
	Region: region,
	MaxRetries: maxretries,
	UsernameTemplate: usernameTemplate,
	})
	if err != nil {
	return nil, err
	}
	if err := req.Storage.Put(ctx, entry); err != nil {
	return nil, err
	}
	// clear possible cached IAM / STS clients after successfully updating
	// config/root
	b.iamClient = nil
	b.stsClient = nil
	return nil, nil
	}

Thanks!

[maxb]

I don't believe there is, unfortunately. I have found the same misfeature in the AD secrets engine too, though I hadn't got around to opening an issue for that when I saw yours.

Vault is really in need of a systematic separation of config and credentials, especially in every secret engine that implements a rotate-root endpoint. The way it's currently done, it becomes impossible to reconfigure a secret engine once you've used the rotate-root functionality.

[cipherboy]

@maxb @allyunion Would adding a PATCH endpoint similar to the ones in PKI work? Vault 1.13 will have a vault patch CLI option, so with more server endpoints supporting PATCH capabilities, it could make for a nice release if someone wants to propose a PR some new handlers... :-)