Allow auto-detection of AWS region when using the vault CLI (#14051)

builtin/credential/aws/cli.go

@@ -44,8 +44,14 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, erro
 	}
 
 	region := m["region"]
-	if region == "" {
+	switch region {
+	case "":
+		// The CLI has always defaulted to "us-east-1" if a region is not provided.
 		region = awsutil.DefaultRegion
+	case "auto":
+		// Beginning in 1.10 we also accept the "auto" value, which uses the region detection logic in
+		// awsutil.GetRegion() to determine the region. That behavior is triggered when region = "".
+		region = ""
 	}
 
 	loginData, err := awsutil.GenerateLoginData(creds, headerValue, region, hlogger)
@@ -73,8 +79,8 @@ func (h *CLIHandler) Help() string {
 Usage: vault login -method=aws [CONFIG K=V...]
 
   The AWS auth method allows users to authenticate with AWS IAM
-  credentials. The AWS IAM credentials may be specified in a number of ways,
+  credentials. The AWS IAM credentials, and optionally the AWS region, may be 
-  listed in order of precedence below:
+  specified in a number of ways, listed in order of precedence below:
 
     1. Explicitly via the command line (not recommended)
 
@@ -112,6 +118,11 @@ Configuration:
       here as well. If specified here, it takes precedence over the value for
       -path. The default value is "aws".
 
+  region=<string>
+      Explicit AWS region to reach out to for authentication request signing. A value
+      of "auto" enables auto-detection of region based on the precedence described above.
+      Defaults to "us-east-1" if not specified.
+
   role=<string>
       Name of the role to request a token against
 

changelog/14051.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/aws: Enable region detection in the CLI by specifying the region as `auto`
+```

website/content/docs/auth/aws.mdx

@@ -658,8 +658,9 @@ The region used defaults to `us-east-1`, but you can specify a custom region lik
 $ vault login -method=aws region=us-west-2 role=dev-role-iam
 ```
 
-When using a custom region, be sure the designated region corresponds to that of the
+If the region is specified as `auto`, the Vault CLI will determine the region based
-STS endpoint you're using.
+on standard AWS credentials precedence as described earlier. Whichever method is used,
+be sure the designated region corresponds to that of the STS endpoint you're using.
 
 An example of how to generate the required request values for the `login` method
 can be found found in the [vault cli