Don't use globals

cfg/aws/credentials.go

@@ -210,11 +210,6 @@ const (
 	SourceAccountHeaderKey = "x-amz-source-account"
 )
 
-var (
-	sourceAccount = os.Getenv(envconfig.AmzSourceAccount) // populates the "x-amz-source-account" header
-	sourceArn     = os.Getenv(envconfig.AmzSourceArn)     // populates the "x-amz-source-arn" header
-)
-
 // newStsClient creates a new STS client with the provided config and options.
 // Additionally, if specific environment variables are set, it also appends the confused deputy headers to requests
 // made by the client. These headers allow resource-based policies to limit the permissions that a service has to
@@ -223,6 +218,10 @@ var (
 //
 // See https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html#cross-service-confused-deputy-prevention
 func newStsClient(p client.ConfigProvider, cfgs ...*aws.Config) *sts.STS {
+
+	sourceAccount := os.Getenv(envconfig.AmzSourceAccount)
+	sourceArn := os.Getenv(envconfig.AmzSourceArn)
+
 	client := sts.New(p, cfgs...)
 	if sourceAccount != "" && sourceArn != "" {
 		client.Handlers.Sign.PushFront(func(r *request.Request) {

cfg/aws/credentials_test.go

@@ -12,6 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/sts"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/aws/amazon-cloudwatch-agent/cfg/envconfig"
 )
 
 func TestConfusedDeputyHeaders(t *testing.T) {
@@ -53,9 +55,9 @@ func TestConfusedDeputyHeaders(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Set global variables which will get picked up by newStsClient
-			sourceArn = tt.envSourceArn
-			sourceAccount = tt.envSourceAccount
+
+			t.Setenv(envconfig.AmzSourceAccount, tt.envSourceAccount)
+			t.Setenv(envconfig.AmzSourceArn, tt.envSourceArn)
 
 			client := newStsClient(mock.Session, &aws.Config{
 				// These are examples credentials pulled from:
@@ -76,14 +78,12 @@ func TestConfusedDeputyHeaders(t *testing.T) {
 			err := request.Sign()
 			require.NoError(t, err)
 
-			headerSourceArn := request.HTTPRequest.Header.Get("x-amz-source-arn")
+			headerSourceArn := request.HTTPRequest.Header.Get(SourceArnHeaderKey)
 			assert.Equal(t, tt.expectedHeaderArn, headerSourceArn)
 
-			headerSourceAccount := request.HTTPRequest.Header.Get("x-amz-source-account")
+			headerSourceAccount := request.HTTPRequest.Header.Get(SourceAccountHeaderKey)
 			assert.Equal(t, tt.expectedHeaderAccount, headerSourceAccount)
 		})
 	}
 
-	sourceArn = ""
-	sourceAccount = ""
 }