Use FIPS STS endpoint (sts-fips) for IAM mounts when fips_mode_enabled = true #384

Summary

When fips_mode_enabled = true, the STS call that IAM-authorized mounts (-o tls,iam) make still goes to the standard sts.<region>.amazonaws.com endpoint, not sts-fips.<region>.amazonaws.com. No configuration option or environment variable changes this.

Where

On master (76bbff3, v3.3.4):

• src/efs_utils_common/constants.py:84

  STS_ENDPOINT_URL_FORMAT = "https://sts.{}.{}/"

• src/efs_utils_common/aws_credentials.py:330, get_sts_endpoint_url(), fills in only the region and the DNS suffix.
• src/watchdog/__init__.py:165 and :558 duplicate the same constant and function.

fips_mode_enabled is already respected elsewhere. get_botocore_client() (metadata.py:557) sets botocore.config.Config(use_fips_endpoint=True), and the stunnel config gets fips = yes. The STS AssumeRoleWithWebIdentity request is built by hand with urllib, so it skips both.

AWS_USE_FIPS_ENDPOINT=true is also ignored for the same reason. That includes the EFS CSI driver's useFIPS: true, which sets this variable and fips_mode_enabled in efs-utils.conf.

Reproduce

1. Set fips_mode_enabled = true in /etc/amazon/efs/efs-utils.conf, or use the EFS CSI driver with useFIPS: true.
2. Mount with -o tls,iam using web identity credentials (e.g. IRSA / EKS Pod Identity).
3. Look at CloudTrail: AssumeRoleWithWebIdentity goes to sts.<region>.amazonaws.com with user agent Python-urllib/*.

Expected

With fips_mode_enabled = true, the STS address should be https://sts-fips.<region>.<suffix>/ in both the mount helper and the watchdog, which refreshes credentials.

Why it matters

In FedRAMP / FIPS-only environments, every AWS API call must use a FIPS endpoint. VPC setups that only expose -fips interface endpoints, or that block non-FIPS endpoints, break IAM mounts today, and the only workaround is anonymous mounts.

Suggested fix

In both get_sts_endpoint_url() implementations, use the sts-fips host when get_fips_config(config) is true. This is similar in scope to the DNS-suffix fix for #232. sts-fips exists in the commercial US and Canada regions and in GovCloud, so regions without it should fall back to sts or fail with a clear error.

Environment

• efs-utils: built from master by aws-efs-csi-driver v3.4.2 (EKS add-on)
• Region: us-east-2
• Mount options: tls,iam