From bdf2b24716584ba83a9726ec907bf78552b6ad83 Mon Sep 17 00:00:00 2001
From: Matt Castelaz <mcastelaz@google.com>
Date: Thu, 29 Oct 2026 19:34:30 +0000
Subject: [PATCH] fix(auth): strip -fips suffix from AWS service name in SigV4
 signing

---
 packages/google-auth/google/auth/aws.py |  3 ++-
 packages/google-auth/tests/test_aws.py  | 26 +++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/packages/google-auth/google/auth/aws.py b/packages/google-auth/google/auth/aws.py
index 1b5f2b275393..9baa6612ec42 100644
--- a/packages/google-auth/google/auth/aws.py
+++ b/packages/google-auth/google/auth/aws.py
@@ -258,7 +258,8 @@ def _generate_authentication_header_map(
     """
     # iam.amazonaws.com host => iam service.
     # sts.us-east-2.amazonaws.com host => sts service.
-    service_name = host.split(".")[0]
+    # sts-fips.us-east-2.amazonaws.com host => sts service.
+    service_name = host.split(".")[0].removesuffix("-fips")
 
     current_time = _helpers.utcnow()
     amz_date = current_time.strftime("%Y%m%dT%H%M%SZ")
diff --git a/packages/google-auth/tests/test_aws.py b/packages/google-auth/tests/test_aws.py
index ccfd412f6cc9..04c7b2db7280 100644
--- a/packages/google-auth/tests/test_aws.py
+++ b/packages/google-auth/tests/test_aws.py
@@ -606,6 +606,32 @@
             "data": REQUEST_PARAMS,
         },
     ),
+    # POST request with session token credentials and FIPS STS endpoint.
+    (
+        "us-east-2",
+        "2020-08-11T06:55:22Z",
+        {
+            "access_key_id": ACCESS_KEY_ID,
+            "secret_access_key": SECRET_ACCESS_KEY,
+            "security_token": TOKEN,
+        },
+        {
+            "method": "POST",
+            "url": "https://sts-fips.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",
+        },
+        {
+            "url": "https://sts-fips.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",
+            "method": "POST",
+            "headers": {
+                "Authorization": "AWS4-HMAC-SHA256 Credential="
+                + ACCESS_KEY_ID
+                + "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=9b27e912850bcfdde94f29f05c992022ad6ed0d40b31381a33e0da6cdb4c5a8f",
+                "host": "sts-fips.us-east-2.amazonaws.com",
+                "x-amz-date": "20200811T065522Z",
+                "x-amz-security-token": TOKEN,
+            },
+        },
+    ),
 ]