fog-aws 1.4.1 → 3.27.0

data/lib/fog/aws/credential_fetcher.rb

@@ -1,8 +1,13 @@
+# frozen_string_literal: true
+
+require 'securerandom'
+
 module Fog
   module AWS
     module CredentialFetcher
 
       INSTANCE_METADATA_HOST = "http://169.254.169.254"
+      INSTANCE_METADATA_TOKEN = "/latest/api/token"
       INSTANCE_METADATA_PATH = "/latest/meta-data/iam/security-credentials/"
       INSTANCE_METADATA_AZ = "/latest/meta-data/placement/availability-zone/"
 
@@ -11,28 +16,79 @@ module Fog
       module ServiceMethods
         def fetch_credentials(options)
           if options[:use_iam_profile] && Fog.mocking?
-            return Fog::Compute::AWS::Mock.data[:iam_role_based_creds]
+            return Fog::AWS::Compute::Mock.data[:iam_role_based_creds]
           end
           if options[:use_iam_profile]
             begin
               role_data = nil
-              region = options[:region]
+              region = options[:region] || ENV["AWS_REGION"] || ENV["AWS_DEFAULT_REGION"]
 
               if ENV["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"]
                 connection = options[:connection] || Excon.new(CONTAINER_CREDENTIALS_HOST)
                 credential_path = options[:credential_path] || ENV["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"]
                 role_data = connection.get(:path => credential_path, :idempotent => true, :expects => 200).body
+                session = Fog::JSON.decode(role_data)
+
+                if region.nil?
+                  connection = options[:metadata_connection] || Excon.new(INSTANCE_METADATA_HOST)
+                  token_header = fetch_credentials_token_header(connection, options[:disable_imds_v2])
+                  region = connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200, :headers => token_header).body[0..-2]
+                end
+              elsif ENV["AWS_CONTAINER_CREDENTIALS_FULL_URI"]
+                connection = options[:connection] || Excon.new(ENV['AWS_CONTAINER_CREDENTIALS_FULL_URI'])
+                container_authorization_token = File.read(options[:aws_container_authorization_token_file] || ENV['AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE'])
+                role_data = connection.get(:idempotent => true, :expects => 200, :headers => {'Authorization' => container_authorization_token}).body
+                session = Fog::JSON.decode(role_data)
+
+                if region.nil?
+                  connection = options[:metadata_connection] || Excon.new(INSTANCE_METADATA_HOST)
+                  token_header = fetch_credentials_token_header(connection, options[:disable_imds_v2])
+                  region = connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200, :headers => token_header).body[0..-2]
+                end
+              elsif ENV["AWS_WEB_IDENTITY_TOKEN_FILE"]
+                params = {
+                  :Action => "AssumeRoleWithWebIdentity",
+                  :RoleArn => options[:role_arn] || ENV.fetch("AWS_ROLE_ARN"),
+                  :RoleSessionName => options[:role_session_name] || ENV["AWS_ROLE_SESSION_NAME"] || "fog-aws-#{SecureRandom.hex}",
+                  :WebIdentityToken => File.read(options[:aws_web_identity_token_file] || ENV.fetch("AWS_WEB_IDENTITY_TOKEN_FILE")),
+                  :DurationSeconds => options[:duration] || 3600,
+                  :Version => "2011-06-15",
+                }
+
+                sts_endpoint =
+                  if ENV["AWS_ENDPOINT_URL_STS"]
+                    ENV["AWS_ENDPOINT_URL_STS"]
+                  elsif ENV["AWS_STS_REGIONAL_ENDPOINTS"] == "regional" && region
+                    "https://sts.#{region}.amazonaws.com"
+                  else
+                    "https://sts.amazonaws.com"
+                  end
+
+                connection = options[:connection] || Excon.new(sts_endpoint, :query => params)
+                document = Nokogiri::XML(connection.get(:idempotent => true, :expects => 200).body)
+
+                session = {
+                  "AccessKeyId" => document.css("AccessKeyId").children.text,
+                  "SecretAccessKey" => document.css("SecretAccessKey").children.text,
+                  "Token" => document.css("SessionToken").children.text,
+                  "Expiration" => document.css("Expiration").children.text,
+                }
 
-                connection = options[:metadata_connection] || Excon.new(INSTANCE_METADATA_HOST)
-                region ||= connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200).body[0..-2]
+                if region.nil?
+                  connection = options[:metadata_connection] || Excon.new(INSTANCE_METADATA_HOST)
+                  token_header = fetch_credentials_token_header(connection, options[:disable_imds_v2])
+                  region = connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200, :headers => token_header).body[0..-2]
+                end
               else
                 connection = options[:connection] || Excon.new(INSTANCE_METADATA_HOST)
-                role_name = connection.get(:path => INSTANCE_METADATA_PATH, :idempotent => true, :expects => 200).body
-                role_data = connection.get(:path => INSTANCE_METADATA_PATH+role_name, :idempotent => true, :expects => 200).body
-                region ||= connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200).body[0..-2]
+                token_header = fetch_credentials_token_header(connection, options[:disable_imds_v2])
+                role_name = connection.get(:path => INSTANCE_METADATA_PATH, :idempotent => true, :expects => 200, :headers => token_header).body
+                role_data = connection.get(:path => INSTANCE_METADATA_PATH+role_name, :idempotent => true, :expects => 200, :headers => token_header).body
+                session = Fog::JSON.decode(role_data)
+
+                region ||= connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200, :headers => token_header).body[0..-2]
               end
 
-              session = Fog::JSON.decode(role_data)
               credentials = {}
               credentials[:aws_access_key_id] = session['AccessKeyId']
               credentials[:aws_secret_access_key] = session['SecretAccessKey']
@@ -41,6 +97,7 @@ module Fog
 
               # set region by default to the one the instance is in.
               credentials[:region] = region
+              credentials[:sts_endpoint] = sts_endpoint if sts_endpoint
               #these indicate the metadata service is unavailable or has no profile setup
               credentials
             rescue Excon::Error => e
@@ -51,6 +108,26 @@ module Fog
             super
           end
         end
+
+        def fetch_credentials_token_header(connection, disable_imds_v2)
+          return nil if disable_imds_v2
+
+          token = connection.put(
+            :path => INSTANCE_METADATA_TOKEN,
+            :idempotent => true,
+            :expects => 200,
+            :retry_interval => 1,
+            :retry_limit => 3,
+            :read_timeout => 1,
+            :write_timeout => 1,
+            :connect_timeout => 1,
+            :headers => { "X-aws-ec2-metadata-token-ttl-seconds" => "300" }
+          ).body
+
+          { "X-aws-ec2-metadata-token" => token }
+        rescue Excon::Error
+          nil
+        end
       end
 
       module ConnectionMethods
@@ -60,10 +137,17 @@ module Fog
 
         private
 
+        # When defined, 'aws_credentials_refresh_threshold_seconds' controls
+        # when the credential needs to be refreshed, expressed in seconds before
+        # the current credential's expiration time
+        def credentials_refresh_threshold
+          @aws_credentials_refresh_threshold_seconds || 15
+        end
+
         def credentials_expired?
           @use_iam_profile &&
             (!@aws_credentials_expire_at ||
-             (@aws_credentials_expire_at && Fog::Time.now > @aws_credentials_expire_at - 15)) #new credentials become available from around 5 minutes before expiration time
+             (@aws_credentials_expire_at && Fog::Time.now > @aws_credentials_expire_at - credentials_refresh_threshold)) #new credentials become available from around 5 minutes before expiration time
         end
 
         def refresh_credentials

data/lib/fog/aws/data_pipeline.rb

@@ -4,7 +4,7 @@ module Fog
       extend Fog::AWS::CredentialFetcher::ServiceMethods
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name
+      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name, :sts_endpoint
 
       request_path 'fog/aws/requests/data_pipeline'
       request :activate_pipeline

data/lib/fog/aws/dns.rb

@@ -1,10 +1,10 @@
 module Fog
-  module DNS
-    class AWS < Fog::Service
+  module AWS
+    class DNS < Fog::Service
       extend Fog::AWS::CredentialFetcher::ServiceMethods
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :host, :path, :port, :scheme, :version, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name
+      recognizes :host, :path, :port, :scheme, :version, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name, :region, :sts_endpoint
 
       model_path 'fog/aws/models/dns'
       model       :record
@@ -25,7 +25,10 @@ module Fog
       request :list_resource_record_sets
       request :get_change
 
+
       class Mock
+        include Fog::AWS::CredentialFetcher::ConnectionMethods
+
         def self.data
           @data ||= Hash.new do |hash, region|
             hash[region] = Hash.new do |region_hash, key|
@@ -70,6 +73,7 @@ module Fog
 
       class Real
         include Fog::AWS::CredentialFetcher::ConnectionMethods
+
         # Initialize connection to Route 53 DNS service
         #
         # ==== Notes
@@ -77,7 +81,7 @@ module Fog
         # :aws_secret_access_key in order to create a connection
         #
         # ==== Examples
-        #   dns = Fog::DNS::AWS.new(
+        #   dns = Fog::AWS::DNS.new(
         #     :aws_access_key_id => your_aws_access_key_id,
         #     :aws_secret_access_key => your_aws_secret_access_key
         #   )
@@ -147,9 +151,9 @@ module Fog
           else
             raise case match[:code]
             when 'NoSuchHostedZone', 'NoSuchChange' then
-              Fog::DNS::AWS::NotFound.slurp(error, match[:message])
+              Fog::AWS::DNS::NotFound.slurp(error, match[:message])
             else
-              Fog::DNS::AWS::Error.slurp(error, "#{match[:code]} => #{match[:message]}")
+              Fog::AWS::DNS::Error.slurp(error, "#{match[:code]} => #{match[:message]}")
             end
           end
         end
@@ -160,6 +164,151 @@ module Fog
           Base64.encode64(signed_string).chomp!
         end
       end
+
+      def self.hosted_zone_for_alias_target(dns_name)
+        hosted_zones = if dns_name.match(/^dualstack\./)
+          elb_dualstack_hosted_zone_mapping
+        else
+          elb_hosted_zone_mapping
+        end
+
+        Hash[hosted_zones.select { |k, _|
+          dns_name =~ /\A.+\.#{k}\.elb\.amazonaws\.com\.?\z/
+        }].values.last
+      end
+
+      def self.elb_hosted_zone_mapping
+        @elb_hosted_zone_mapping ||= {
+          "ap-northeast-1" => "Z2YN17T5R711GT",
+          "ap-southeast-1" => "Z1WI8VXHPB1R38",
+          "ap-southeast-2" => "Z2999QAZ9SRTIC",
+          "eu-west-1"      => "Z3NF1Z3NOM5OY2",
+          "eu-central-1"   => "Z215JYRZR1TBD5",
+          "sa-east-1"      => "Z2ES78Y61JGQKS",
+          "us-east-1"      => "Z3DZXE0Q79N41H",
+          "us-west-1"      => "Z1M58G0W56PQJA",
+          "us-west-2"      => "Z33MTJ483KN6FU",
+        }
+      end
+
+      # See https://docs.aws.amazon.com/general/latest/gr/rande.html#elb_region
+      # This needs to be kept in sync manually sadly for now as seemingly this data is not available via an API
+      def self.elb_dualstack_hosted_zone_mapping
+        @elb_dualstack_hosted_zone_mapping ||= {
+          "ap-northeast-1" => "Z14GRHDCWA56QT",
+          "ap-northeast-2" => "ZWKZPGTI48KDX",
+          "ap-northeast-3" => "Z5LXEXXYW11ES",
+          "ap-south-1" => "ZP97RAFLXTNZK",
+          "ap-southeast-1" => "Z1LMS91P8CMLE5",
+          "ap-southeast-2" => "Z1GM3OXH4ZPM65",
+          "ca-central-1" => "ZQSVJUPU6J1EY",
+          "eu-central-1" => "Z215JYRZR1TBD5",
+          "eu-west-1" => "Z32O12XQLNTSW2",
+          "eu-west-2" => "ZHURV8PSTC4K8",
+          "eu-west-3" => "Z3Q77PNBQS71R4",
+          "us-east-1" => "Z35SXDOTRQ7X7K",
+          "us-east-2" => "Z3AADJGX6KTTL2",
+          "us-west-1" => "Z368ELLRRE2KJ0",
+          "us-west-2" => "Z1H1FL5HABSF5",
+          "sa-east-1" => "Z2P70J7HTTTPLU",
+        }
+      end
+
+      # Returns the xml request for a given changeset
+      def self.change_resource_record_sets_data(zone_id, change_batch, version, options = {})
+        # AWS methods return zone_ids that looks like '/hostedzone/id'.  Let the caller either use
+        # that form or just the actual id (which is what this request needs)
+        zone_id = zone_id.sub('/hostedzone/', '')
+
+        optional_tags = ''
+        options.each do |option, value|
+          case option
+          when :comment
+            optional_tags += "<Comment>#{value}</Comment>"
+          end
+        end
+
+        #build XML
+        if change_batch.count > 0
+
+          changes = "<ChangeBatch>#{optional_tags}<Changes>"
+
+          change_batch.each do |change_item|
+            action_tag = %Q{<Action>#{change_item[:action]}</Action>}
+            name_tag   = %Q{<Name>#{change_item[:name]}</Name>}
+            type_tag   = %Q{<Type>#{change_item[:type]}</Type>}
+
+            # TTL must be omitted if using an alias record
+            ttl_tag = ''
+            ttl_tag += %Q{<TTL>#{change_item[:ttl]}</TTL>} unless change_item[:alias_target]
+
+            weight_tag = ''
+            set_identifier_tag = ''
+            region_tag = ''
+            if change_item[:set_identifier]
+              set_identifier_tag += %Q{<SetIdentifier>#{change_item[:set_identifier]}</SetIdentifier>}
+              if change_item[:weight] # Weighted Record
+                weight_tag += %Q{<Weight>#{change_item[:weight]}</Weight>}
+              elsif change_item[:region] # Latency record
+                region_tag += %Q{<Region>#{change_item[:region]}</Region>}
+              end
+            end
+
+            failover_tag = if change_item[:failover]
+                             %Q{<Failover>#{change_item[:failover]}</Failover>}
+                           end
+
+            geolocation_tag = if change_item[:geo_location]
+                                xml_geo = change_item[:geo_location].map { |k,v| "<#{k}>#{v}</#{k}>" }.join
+                                %Q{<GeoLocation>#{xml_geo}</GeoLocation>}
+                              end
+
+            resource_records = change_item[:resource_records] || []
+            resource_record_tags = ''
+            resource_records.each do |record|
+              resource_record_tags += %Q{<ResourceRecord><Value>#{record}</Value></ResourceRecord>}
+            end
+
+            # ResourceRecords must be omitted if using an alias record
+            resource_tag = ''
+            resource_tag += %Q{<ResourceRecords>#{resource_record_tags}</ResourceRecords>} if resource_records.any?
+
+            alias_target_tag = ''
+            if change_item[:alias_target]
+              # Accept either underscore or camel case for hash keys.
+              dns_name = change_item[:alias_target][:dns_name] || change_item[:alias_target][:DNSName]
+              hosted_zone_id = change_item[:alias_target][:hosted_zone_id] || change_item[:alias_target][:HostedZoneId] || AWS.hosted_zone_for_alias_target(dns_name)
+              evaluate_target_health = change_item[:alias_target][:evaluate_target_health] || change_item[:alias_target][:EvaluateTargetHealth] || false
+              evaluate_target_health_xml = !evaluate_target_health.nil? ? %Q{<EvaluateTargetHealth>#{evaluate_target_health}</EvaluateTargetHealth>} : ''
+              alias_target_tag += %Q{<AliasTarget><HostedZoneId>#{hosted_zone_id}</HostedZoneId><DNSName>#{dns_name}</DNSName>#{evaluate_target_health_xml}</AliasTarget>}
+            end
+
+            health_check_id_tag = if change_item[:health_check_id]
+                                    %Q{<HealthCheckId>#{change_item[:health_check_id]}</HealthCheckId>}
+                                  end
+
+            change_tags = %Q{<Change>#{action_tag}<ResourceRecordSet>#{name_tag}#{type_tag}#{set_identifier_tag}#{weight_tag}#{region_tag}#{failover_tag}#{geolocation_tag}#{ttl_tag}#{resource_tag}#{alias_target_tag}#{health_check_id_tag}</ResourceRecordSet></Change>}
+            changes += change_tags
+          end
+
+          changes += '</Changes></ChangeBatch>'
+        end
+
+        %Q{<?xml version="1.0" encoding="UTF-8"?><ChangeResourceRecordSetsRequest xmlns="https://route53.amazonaws.com/doc/#{version}/">#{changes}</ChangeResourceRecordSetsRequest>}
+      end
+    end
+  end
+
+  # @deprecated
+  module DNS
+    # @deprecated
+    class AWS < Fog::AWS::DNS
+      # @deprecated
+      # @overrides Fog::Service.new (from the fog-core gem)
+      def self.new(*)
+        Fog::Logger.deprecation 'Fog::DNS::AWS is deprecated, please use Fog::AWS::DNS.'
+        super
+      end
     end
   end
 end

data/lib/fog/aws/dynamodb.rb

@@ -4,7 +4,7 @@ module Fog
       extend Fog::AWS::CredentialFetcher::ServiceMethods
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :aws_session_token, :host, :path, :port, :scheme, :persistent, :region, :use_iam_profile, :aws_credentials_expire_at, :instrumentor, :instrumentor_name
+      recognizes :aws_session_token, :host, :path, :port, :scheme, :persistent, :region, :use_iam_profile, :aws_credentials_expire_at, :instrumentor, :instrumentor_name, :sts_endpoint
 
       request_path 'fog/aws/requests/dynamodb'
       request :batch_get_item

data/lib/fog/aws/ecs.rb

@@ -3,7 +3,7 @@ module Fog
     class ECS < Fog::Service
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :version, :instrumentor, :instrumentor_name
+      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :version, :instrumentor, :instrumentor_name,:sts_endpoint
 
       request_path 'fog/aws/requests/ecs'
       request :list_clusters

data/lib/fog/aws/efs.rb

@@ -64,7 +64,7 @@ module Fog
         end
 
         def mock_compute
-          @mock_compute ||= Fog::Compute::AWS.new(:aws_access_key_id => @aws_access_key_id, :aws_secret_access_key => @aws_secret_access_key, :region => @region)
+          @mock_compute ||= Fog::AWS::Compute.new(:aws_access_key_id => @aws_access_key_id, :aws_secret_access_key => @aws_secret_access_key, :region => @region)
         end
       end
 

data/lib/fog/aws/elasticache.rb

@@ -8,7 +8,7 @@ module Fog
       class AuthorizationAlreadyExists < Fog::Errors::Error; end
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name
+      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name, :sts_endpoint
 
       request_path 'fog/aws/requests/elasticache'
 
@@ -171,8 +171,10 @@ module Fog
           @aws_credentials_expire_at = Time::now + 20
           setup_credentials(options)
           @region = options[:region] || 'us-east-1'
-          unless ['ap-northeast-1', 'ap-southeast-1', 'eu-west-1', 'us-east-1',
-                  'us-west-1', 'us-west-2', 'sa-east-1'].include?(@region)
+          unless ['ap-south-1', 'ap-northeast-1', 'ap-northeast-2', 'ap-northeast-3', 'ap-southeast-1', 'ap-southeast-2', 
+                  'eu-west-1', 'eu-west-2', 'eu-west-3', 'eu-central-1',
+                  'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2', 'ca-central-1',
+                  'sa-east-1', 'cn-north-1', 'cn-northwest-1', 'ap-east-1', 'us-gov-west-1'].include?(@region)
             raise ArgumentError, "Unknown region: #{@region.inspect}"
           end
         end
@@ -193,7 +195,7 @@ module Fog
           @aws_access_key_id = options[:aws_access_key_id]
         end
 
-        # returns an Array of (Mock) elasticache nodes, representated as Hashes
+        # returns an Array of (Mock) elasticache nodes, represented as Hashes
         def create_cache_nodes(cluster_id, num_nodes = 1, port = '11211')
           (1..num_nodes).map do |node_number|
             node_id = "%04d" % node_number

data/lib/fog/aws/elb.rb

@@ -14,7 +14,7 @@ module Fog
       class ValidationError             < Fog::Errors::Error; end
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name
+      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :version, :instrumentor, :instrumentor_name,:sts_endpoint
 
       request_path 'fog/aws/requests/elb'
       request :configure_health_check
@@ -142,6 +142,7 @@ module Fog
           @port       = options[:port]        || 443
           @scheme     = options[:scheme]      || 'https'
           @connection = Fog::XML::Connection.new("#{@scheme}://#{@host}:#{@port}#{@path}", @persistent, @connection_options)
+          @version ||= options[:version] || '2012-06-01'
 
           setup_credentials(options)
         end
@@ -178,7 +179,7 @@ module Fog
               :host               => @host,
               :path               => @path,
               :port               => @port,
-              :version            => '2012-06-01',
+              :version            => @version,
               :method             => 'POST'
           }
           )

data/lib/fog/aws/elbv2.rb

@@ -0,0 +1,72 @@
+module Fog
+  module AWS
+    class ELBV2 < ELB
+      requires :aws_access_key_id, :aws_secret_access_key
+      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :version, :instrumentor, :instrumentor_name,:sts_endpoint
+
+      request_path 'fog/aws/requests/elbv2'
+      request :add_tags
+      request :create_load_balancer
+      request :describe_tags
+      request :remove_tags
+      request :describe_load_balancers
+      request :describe_listeners
+
+      class Real < ELB::Real
+        def initialize(options={})
+          @version = '2015-12-01'
+
+          super(options)
+        end
+      end
+
+      class Mock
+        def self.data
+          @data ||= Hash.new do |hash, region|
+            owner_id = Fog::AWS::Mock.owner_id
+            hash[region] = Hash.new do |region_hash, key|
+              region_hash[key] = {
+                :owner_id => owner_id,
+                :load_balancers_v2 => {}
+              }
+            end
+          end
+        end
+
+        def self.dns_name(name, region)
+          "#{name}-#{Fog::Mock.random_hex(8)}.#{region}.elb.amazonaws.com"
+        end
+
+        def self.reset
+          @data = nil
+        end
+
+        attr_reader :region
+
+        def initialize(options={})
+          @use_iam_profile = options[:use_iam_profile]
+
+          @region = options[:region] || 'us-east-1'
+          setup_credentials(options)
+
+          Fog::AWS.validate_region!(@region)
+        end
+
+        def setup_credentials(options)
+          @aws_access_key_id     = options[:aws_access_key_id]
+          @aws_secret_access_key = options[:aws_secret_access_key]
+
+          @signer = Fog::AWS::SignatureV4.new(@aws_access_key_id, @aws_secret_access_key,@region,'elasticloadbalancing')
+        end
+
+        def data
+          self.class.data[@region][@aws_access_key_id]
+        end
+
+        def reset_data
+          self.class.data[@region].delete(@aws_access_key_id)
+        end
+      end
+    end
+  end
+end

data/lib/fog/aws/emr.rb

@@ -6,7 +6,7 @@ module Fog
       class IdentifierTaken < Fog::Errors::Error; end
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name
+      recognizes :region, :host, :path, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :instrumentor, :instrumentor_name, :sts_endpoint
 
       request_path 'fog/aws/requests/emr'