Fix handling of FIPS pseudo regions

.changes/next-release/bugfix-AWSSDKforJavav2-53be3ce.json

@@ -0,0 +1,6 @@
+{
+    "type": "bugfix",
+    "category": "AWS SDK for Java v2",
+    "contributor": "",
+    "description": "Adds support for automatically transforming a FIPS pesudo region (e.g. \"fips-us-west-2\"), into a standard region name + setting the `fips_enabled` flag to `true`."
+}

core/aws-core/src/main/java/software/amazon/awssdk/awscore/client/builder/AwsDefaultClientBuilder.java

@@ -55,6 +55,7 @@
 import software.amazon.awssdk.utils.AttributeMap;
 import software.amazon.awssdk.utils.CollectionUtils;
 import software.amazon.awssdk.utils.Logger;
+import software.amazon.awssdk.utils.StringUtils;
 
 /**
  * An SDK-internal implementation of the methods in {@link AwsClientBuilder}, {@link AwsAsyncClientBuilder} and
@@ -80,6 +81,8 @@ public abstract class AwsDefaultClientBuilder<BuilderT extends AwsClientBuilder<
     implements AwsClientBuilder<BuilderT, ClientT> {
     private static final Logger log = Logger.loggerFor(AwsClientBuilder.class);
     private static final String DEFAULT_ENDPOINT_PROTOCOL = "https";
+    private static final String FIPS_PREFIX = "fips-";
+    private static final String FIPS_SUFFIX = "-fips";
     private final AutoDefaultsModeDiscovery autoDefaultsModeDiscovery;
 
     protected AwsDefaultClientBuilder() {
@@ -374,7 +377,13 @@ private RetryPolicy resolveAwsRetryPolicy(SdkClientConfiguration config) {
 
     @Override
     public final BuilderT region(Region region) {
-        clientConfiguration.option(AwsClientOption.AWS_REGION, region);
+        if (idHasFipsPattern(region)) {
+            clientConfiguration.option(AwsClientOption.AWS_REGION, removeFips(region));
+            clientConfiguration.option(AwsClientOption.FIPS_ENDPOINT_ENABLED, true);
+        } else {
+            clientConfiguration.option(AwsClientOption.AWS_REGION, region);
+            clientConfiguration.option(AwsClientOption.FIPS_ENDPOINT_ENABLED, null);
+        }
         return thisBuilder();
     }
 
@@ -433,4 +442,22 @@ public final BuilderT defaultsMode(DefaultsMode defaultsMode) {
     public final void setDefaultsMode(DefaultsMode defaultsMode) {
         defaultsMode(defaultsMode);
     }
+
+    private boolean idHasFipsPattern(Region region) {
+        return region.id().startsWith(FIPS_PREFIX) || region.id().endsWith(FIPS_SUFFIX);
+    }
+
+    private Region removeFips(Region region) {
+        if (region.id().startsWith(FIPS_PREFIX)) {
+            String prefixRemoved = StringUtils.replaceOnce(region.id(), FIPS_PREFIX, "");
+            return Region.of(prefixRemoved);
+        }
+
+        if (region.id().endsWith(FIPS_SUFFIX)) {
+            String suffixRemoved = StringUtils.replaceOnce(region.id(), FIPS_SUFFIX, "");
+            return Region.of(suffixRemoved);
+        }
+
+        return region;
+    }
 }

core/aws-core/src/test/java/software/amazon/awssdk/awscore/client/builder/DefaultAwsClientBuilderTest.java

@@ -42,6 +42,7 @@
 import org.mockito.junit.MockitoJUnitRunner;
 import software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider;
 import software.amazon.awssdk.auth.signer.Aws4Signer;
+import software.amazon.awssdk.awscore.client.config.AwsClientOption;
 import software.amazon.awssdk.awscore.defaultsmode.DefaultsMode;
 import software.amazon.awssdk.awscore.internal.defaultsmode.AutoDefaultsModeDiscovery;
 import software.amazon.awssdk.core.client.config.ClientOverrideConfiguration;
@@ -104,6 +105,40 @@ public void buildWithRegionShouldHaveCorrectEndpointAndSigningRegion() {
         assertThat(client.clientConfiguration.option(SERVICE_SIGNING_NAME)).isEqualTo(SIGNING_NAME);
     }
 
+    @Test
+    public void buildWithNonFipsRegionFipsEnabledUnset() {
+        TestClient client = testClientBuilder().region(Region.US_WEST_2).build();
+
+        assertThat(client.clientConfiguration.option(AwsClientOption.FIPS_ENDPOINT_ENABLED)).isNull();
+    }
+
+    @Test
+    public void buildWithFipsPrefixRegionShouldHaveFipsEnabledToTrue() {
+        TestClient client = testClientBuilder().region(Region.of("fips-us-west-2")).build();
+
+        assertThat(client.clientConfiguration.option(AwsClientOption.AWS_REGION)).isEqualTo(Region.US_WEST_2);
+        assertThat(client.clientConfiguration.option(AwsClientOption.FIPS_ENDPOINT_ENABLED)).isTrue();
+    }
+
+    @Test
+    public void buildWithFipsSuffixRegionShouldHaveFipsEnabledToTrue() {
+        TestClient client = testClientBuilder().region(Region.of("us-west-2-fips")).build();
+
+        assertThat(client.clientConfiguration.option(AwsClientOption.AWS_REGION)).isEqualTo(Region.US_WEST_2);
+        assertThat(client.clientConfiguration.option(AwsClientOption.FIPS_ENDPOINT_ENABLED)).isTrue();
+    }
+
+    @Test
+    public void buildWithFipsRegionThenNonFipsFipsEnabledFlagUnset() {
+        TestClient client = testClientBuilder()
+            .region(Region.of("us-west-2-fips")) // first call to setter sets the flag
+            .region(Region.of("us-west-2"))// second call should clear
+            .build();
+
+        assertThat(client.clientConfiguration.option(AwsClientOption.AWS_REGION)).isEqualTo(Region.US_WEST_2);
+        assertThat(client.clientConfiguration.option(AwsClientOption.FIPS_ENDPOINT_ENABLED)).isNull();
+    }
+
     @Test
     public void buildWithEndpointShouldHaveCorrectEndpointAndSigningRegion() {
         TestClient client = testClientBuilder().region(Region.US_WEST_1).endpointOverride(ENDPOINT).build();