Fix STS Signature does not match non us-east-1

[bcsamrudh]

Jira: https://hashicorp.atlassian.net/browse/VAULT-46705

Description:
Lambda function using vault-lambda-extension with AWS SDK V2 crashes when vault and lambda function are in a region other than us-east-1 and also if vault and lambda function are in different regions.

Testing Evidence:

Note : use_sts_region_from_client=false i.eVAULT_STS_ENDPOINT_REGIONis not used

Case 1 : Vault and lambda in different region :

Vault is running in ap-southeast-1 and Lambda Function is in ap-southeast-2

Creating Vault server in ap-southeast-1 and lambda function in ap-southeast-2 via terraform:

Result of lambda invoke:

This case was also tested using HCP where Vault cluster was in us-west-2 and lambda function in ap-south-1

Case 2: Both vault and lambda in same region other than us-east-1:

Both the Vault and Lambda Function are in eu-central-1

Creating Vault server and Lambda in eu-central-1 via terraform

Result of Lambda invoke

[Copilot]

Pull request overview

This PR addresses AWS STS SignatureDoesNotMatch failures when Vault and the Lambda function are in different regions by changing the IAM auth payload signing behavior to default to the global STS endpoint (sts.amazonaws.com) and us-east-1 signing region.

Changes:

• Default IAM auth payload signing to the global STS endpoint and us-east-1 signing region unless a custom STS endpoint is configured.
• Remove prior behavior that adjusted the assumed-role AWS config region based on STSEndpointRegion.
• Add/adjust unit tests to assert the new default signing behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
internal/vault/client.go	Updates IAM auth payload signing to prefer global STS endpoint/us-east-1, and adjusts endpoint/region selection logic.
internal/vault/client_test.go	Adds a new test for the global endpoint default path and updates an existing assertion to expect us-east-1 signing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[stuti-sr]

LGTM!

[stuti-sr]

provided comments. Can you please add jira story in description?

[hashicorp-cla-app]

All committers have signed the CLA.

[arjunkshashicorp]

LGTM!

[stuti-sr]

LGTM!!

[santoshhashicorp]

LGTM

[Balaji2198]

Thanks for working on this. Provided few comments.