[macastelaz]

Summary

When Workload Identity Federation (BYOID) with AWS is configured with a regional AWS STS FIPS endpoint (sts-fips.{region}.amazonaws.com), AwsRequestSigner extracts the service name from the first hostname segment (hostSplit[0]), resulting in sts-fips.

AWS SigV4 requires the credential scope and signing key derivation to use the canonical service name (sts) even when calling a -fips endpoint. Scoping to sts-fips causes AWS STS to reject the signed GetCallerIdentity subject token with:

SignatureDoesNotMatch: Credential should be scoped to correct service: 'sts'.

This change strips the trailing -fips suffix from the extracted hostname label (.replaceAll("-fips$", "")) while preserving the full sts-fips.{region}.amazonaws.com hostname in the Host header and request URL.

Testing

• Added unit test sign_postGetCallerIdentityFips in google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/AwsRequestSignerTest.java.

Manual Testing

• End-to-end manual verification program and observed output before/after fix against live GCP STS + AWS STS (sts-fips.us-east-2.amazonaws.com): https://paste.googleplex.com/6755399436500064

[gemini-code-assist]

Code Review

This pull request adds support for AWS FIPS endpoints in 'AwsRequestSigner' by stripping the '-fips' suffix from the host's first segment to correctly identify the service name, and includes a new unit test to verify this behavior. The review feedback suggests optimizing this change by replacing the regex-based 'replaceAll' method with a more efficient 'endsWith' and 'substring' check to avoid unnecessary regex compilation overhead on every request signing operation.

[gemini-code-assist]

Using String.replaceAll with a regular expression compiles the regex pattern on every invocation. Since AwsRequestSigner.sign() is called for every request signing operation, this introduces unnecessary overhead.

Using a simple endsWith and substring check is much more efficient and avoids regex compilation entirely.

Suggested change

	String serviceName =
	Splitter.on(".").split(uri.getHost()).iterator().next().replaceAll("-fips$", "");
	String firstSegment = Splitter.on(".").split(uri.getHost()).iterator().next();
	String serviceName =
	firstSegment.endsWith("-fips")
	? firstSegment.substring(0, firstSegment.length() - 5)
	: firstSegment;