AWS PHP SDK 3.0 Sts client throwing error of non scoped region when region is provided

Question

Upgraded to the 3.0 PHP sdk, that was probably a mistake since it broke everything.

I'm trying to create an sts client but it keep getting an error

   Error executing "GetFederationToken" on "https://sts.amazonaws.com"; AWS HTTP error: Client error: 403 SignatureDoesNotMatch (client): Credential should be scoped to a valid region, not 'us-west-1'.  - <ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>SignatureDoesNotMatch</Code>
    <Message>Credential should be scoped to a valid region, not 'us-west-1'. </Message>
  </Error>
  <RequestId>604fe518-2381-11e5-8b68-471c4b83f798</RequestId>
</ErrorResponse>

PHP code

    $config = \Config::get('shared_config');

    $sdk = new \Aws\Sdk($config);

    $sts = $sdk->createSts();

    $result = $sts->getFederationToken(array(
        'Name' => 'appuser',
        'DurationSeconds' => 3600,
        'Policy' => json_encode(array(
            'Statement' => array(
                array(
                    'Sid' => 'randomstatementid' . time(),
                    'Action' => array('s3:PutObject'),
                    'Effect' => 'Allow',
                    'Resource' => 'arn:aws:s3:::' . \Config::get('aws_bucket'),
                )
            )
        ))
    ));

where $config is an array of

array(
    'region' => 'us-west-1',
    'version' => 'latest',
    'debug'=>true,
    'credentials'=>array(
        'key'    => 'XXX',
        'secret' => 'XXX',
    )

So the region is obviously set and us-west-1 is valid region https://docs.aws.amazon.com/general/latest/gr/rande.html

The docs are pretty bad but https://docs.aws.amazon.com/aws-sdk-php/v3/guide/getting-started/basic-usage.html#using-the-sdk-class is what im sort of following

and creating a client https://docs.aws.amazon.com/aws-sdk-php/v3/api/class-Aws.Sdk.html see method createSts

also I can successfuly use the s3 client with the same credentials just fine and do commands.

    $config = \Config::get('shared_config');

    $sdk = new \Aws\Sdk($config);

    $s3 = $sdk->createS3();

score 0 · Answer 1 · answered Jul 08 '15 at 18:08

You need to specify an endpoint parameter when using STS in any region other than us-east-1. This is not yet documented on v3 but can be found on the v2 docs.

Note that you will need to enable any endpoints other than us-east-1 manually in the console before using them. This restriction is unique to STS.

AWS PHP SDK 3.0 Sts client throwing error of non scoped region when region is provided

1 Answers1