[macastelaz]

Description

When Workload Identity Federation is configured with a regional AWS STS FIPS endpoint (e.g., https://sts-fips.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15), Google::Auth::ExternalAccount::AwsRequestSigner#request_metadata previously extracted the service name from the first hostname segment as sts-fips.

AWS STS requires the SigV4 credential scope and X-Amz-Credential signing key to use the canonical service name sts even when requests are sent to a sts-fips.<region>.amazonaws.com endpoint. Scoping the signature to sts-fips causes AWS STS to reject the signed GetCallerIdentity request with:

SignatureDoesNotMatch: Credential should be scoped to correct service: 'sts'.

Fix

• Strip any trailing -fips suffix from the extracted hostname label via .delete_suffix("-fips") in lib/googleauth/external_account/aws_credentials.rb.
• Add a unit test in spec/googleauth/external_account/aws_credentials_spec.rb verifying that FIPS STS endpoints produce signatures and credential headers scoped to sts.

Manual Testing

Verified end-to-end against live GCP STS (https://sts.googleapis.com/v1/token) forwarding to live AWS STS (https://sts-fips.us-east-2.amazonaws.com):

• Before fix (sts-fips): Rejected by AWS STS with SignatureDoesNotMatch: Credential should be scoped to correct service: 'sts'.
• After fix (sts): Passed AWS STS service-scope validation and proceeded to token validation (InvalidClientTokenId).
• Verification Script & Full HTTP Wire Logs (GPaste): https://paste.googleplex.com/6755399436519352