Fix aws connector automatic endpoint discovery

CHANGELOG.md

@@ -14,6 +14,14 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Support for OpenShift 3.9 and 3.10 is removed in this release.
   [conjurdemos/kubernetes-conjur-demo#122](https://github.com/conjurdemos/kubernetes-conjur-demo/issues/122)
 
+### Fixed
+- Automatic endpoint discovery for the aws connector was updated. This
+  functionality modifies the request endpoint. There were 2 bugs where (1) the
+  request host header was not being updated to the discovered endpoint, and (2)
+  the request modification was being done after signing the request which would
+  result in a failing integrity check.
+  [cyberark/secretless-broker#1369](https://github.com/cyberark/secretless-broker/issues/1369)
+
 ## [1.7.1] - 2020-10-20
 
 ### Added

internal/plugin/connectors/http/aws/aws.go

@@ -216,6 +216,7 @@ func setAmzEndpoint(req *gohttp.Request, reqMeta *requestMetadata) error {
 
 	req.URL.Scheme = endpointURL.Scheme
 	req.URL.Host = endpointURL.Host
+	req.Host = endpointURL.Hostname()
 
 	return nil
 }

internal/plugin/connectors/http/aws/connector.go

@@ -37,17 +37,19 @@ func (c *Connector) Connect(
 		return nil
 	}
 
+	// Set AWS endpoint
+	// NOTE: this must be done before signing the request, otherwise the modified request
+	// will fail the integrity check.
+	err = setAmzEndpoint(req, reqMeta)
+	if err != nil {
+		return err
+	}
+
 	// Use metadata and credentials to sign request
 	c.logger.Debugf(
 		"Signing for service=%s region=%s",
 		reqMeta.serviceName,
 		reqMeta.region,
 	)
-	err = signRequest(req, reqMeta, credentialsByID)
-	if err != nil {
-		return err
-	}
-
-	// Set AWS endpoint
-	return setAmzEndpoint(req, reqMeta)
+	return signRequest(req, reqMeta, credentialsByID)
 }