Use RemoteCredProvider instead of EC2RoleProvider

builtin/logical/aws/client.go

@@ -2,6 +2,7 @@ package aws
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/session"
@@ -31,7 +32,10 @@ func getRootConfig(s logical.Storage) (*aws.Config, error) {
 	}
 
 	if credsConfig.Region == "" {
-		credsConfig.Region = "us-east-1"
+		credsConfig.Region = os.Getenv("AWS_REGION")
+		if credsConfig.Region == "" {
+			credsConfig.Region = "us-east-1"
+		}
 	}
 
 	credsConfig.HTTPClient = cleanhttp.DefaultClient()

helper/awsutil/generate_credentials.go

@@ -6,9 +6,7 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
-	"github.com/aws/aws-sdk-go/aws/ec2metadata"
-	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/aws/defaults"
 )
 
 type CredentialsConfig struct {
@@ -65,14 +63,14 @@ func (c *CredentialsConfig) GenerateCredentialChain() (*credentials.Credentials,
 		Profile:  c.Profile,
 	})
 
-	// Add the instance metadata role provider
-	providers = append(providers, &ec2rolecreds.EC2RoleProvider{
-		Client: ec2metadata.New(session.New(&aws.Config{
-			Region:     aws.String(c.Region),
-			HTTPClient: c.HTTPClient,
-		})),
-		ExpiryWindow: 15,
-	})
+	// Add the remote provider
+	def := defaults.Get()
+	if c.Region != "" {
+		def.Config.Region = aws.String(c.Region)
+	}
+	def.Config.HTTPClient = c.HTTPClient
+
+	providers = append(providers, defaults.RemoteCredProvider(*def.Config, def.Handlers))
 
 	// Create the credentials required to access the API.
 	creds := credentials.NewChainCredentials(providers)

physical/dynamodb.go

@@ -3,6 +3,7 @@ package physical
 import (
 	"fmt"
 	"math"
+	"net/http"
 	"os"
 	pkgPath "path"
 	"sort"
@@ -16,14 +17,14 @@ import (
 	"github.com/armon/go-metrics"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
-	"github.com/aws/aws-sdk-go/aws/ec2metadata"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	"github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute"
 	"github.com/hashicorp/errwrap"
+	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/helper/awsutil"
+	"github.com/hashicorp/vault/helper/consts"
 )
 
 const (
@@ -166,29 +167,37 @@ func newDynamoDBBackend(conf map[string]string, logger log.Logger) (Backend, err
 	if endpoint == "" {
 		endpoint = conf["endpoint"]
 	}
-	region := os.Getenv("AWS_DEFAULT_REGION")
+	region := os.Getenv("AWS_REGION")
 	if region == "" {
-		region = conf["region"]
+		region = os.Getenv("AWS_DEFAULT_REGION")
 		if region == "" {
-			region = DefaultDynamoDBRegion
+			region = conf["region"]
+			if region == "" {
+				region = DefaultDynamoDBRegion
+			}
 		}
 	}
 
-	creds := credentials.NewChainCredentials([]credentials.Provider{
-		&credentials.StaticProvider{Value: credentials.Value{
-			AccessKeyID:     accessKey,
-			SecretAccessKey: secretKey,
-			SessionToken:    sessionToken,
-		}},
-		&credentials.EnvProvider{},
-		&credentials.SharedCredentialsProvider{Filename: "", Profile: ""},
-		&ec2rolecreds.EC2RoleProvider{Client: ec2metadata.New(session.New())},
-	})
+	credsConfig := &awsutil.CredentialsConfig{
+		AccessKey:    accessKey,
+		SecretKey:    secretKey,
+		SessionToken: sessionToken,
+	}
+	creds, err := credsConfig.GenerateCredentialChain()
+	if err != nil {
+		return nil, err
+	}
+
+	pooledTransport := cleanhttp.DefaultPooledTransport()
+	pooledTransport.MaxIdleConnsPerHost = consts.ExpirationRestoreWorkerCount
 
 	awsConf := aws.NewConfig().
 		WithCredentials(creds).
 		WithRegion(region).
-		WithEndpoint(endpoint)
+		WithEndpoint(endpoint).
+		WithHTTPClient(&http.Client{
+			Transport: pooledTransport,
+		})
 	client := dynamodb.New(session.New(awsConf))
 
 	if err := ensureTableExists(client, table, readCapacity, writeCapacity); err != nil {

physical/s3.go

@@ -62,11 +62,14 @@ func newS3Backend(conf map[string]string, logger log.Logger) (Backend, error) {
 	if endpoint == "" {
 		endpoint = conf["endpoint"]
 	}
-	region := os.Getenv("AWS_DEFAULT_REGION")
+	region := os.Getenv("AWS_REGION")
 	if region == "" {
-		region = conf["region"]
+		region = os.Getenv("AWS_DEFAULT_REGION")
 		if region == "" {
-			region = "us-east-1"
+			region = conf["region"]
+			if region == "" {
+				region = "us-east-1"
+			}
 		}
 	}