def aws_iam(role, credentials_provider, iam_auth_header_value = nil, sts_endpoint = 'https://sts.amazonaws.com', route = nil)
      require "aws-sigv4"
      require "base64"

      request_body   = 'Action=GetCallerIdentity&Version=2011-06-15'
      request_method = 'POST'

      route ||= '/v1/auth/aws/login'

      vault_headers = {
        'User-Agent' => Vault::Client::USER_AGENT,
        'Content-Type' => 'application/x-www-form-urlencoded; charset=utf-8'
      }

      vault_headers['X-Vault-AWS-IAM-Server-ID'] = iam_auth_header_value if iam_auth_header_value

      sig4_headers = Aws::Sigv4::Signer.new(
        service: 'sts',
        region: region_from_sts_endpoint(sts_endpoint),
        credentials_provider: credentials_provider
      ).sign_request(
        http_method: request_method,
        url: sts_endpoint,
        headers: vault_headers,
        body: request_body
      ).headers

      payload = {
        role: role,
        iam_http_request_method: request_method,
        iam_request_url: Base64.strict_encode64(sts_endpoint),
        iam_request_headers: Base64.strict_encode64(vault_headers.merge(sig4_headers).to_json),
        iam_request_body: Base64.strict_encode64(request_body)
      }

      json = client.post(route, JSON.fast_generate(payload))
      secret = Secret.decode(json)
      client.token = secret.auth.client_token
      return secret
    end
def aws_iam(role, credentials_provider, iam_auth_header_value = nil, sts_endpoint = 'https://sts.amazonaws.com', route = nil)
      require "aws-sigv4"
      require "base64"

      request_body   = 'Action=GetCallerIdentity&Version=2011-06-15'
      request_method = 'POST'

      route ||= '/v1/auth/aws/login'

      vault_headers = {
        'User-Agent' => Vault::Client::USER_AGENT,
        'Content-Type' => 'application/x-www-form-urlencoded; charset=utf-8'
      }

      vault_headers['X-Vault-AWS-IAM-Server-ID'] = iam_auth_header_value if iam_auth_header_value

      sig4_headers = Aws::Sigv4::Signer.new(
        service: 'sts',
        region: region_from_sts_endpoint(sts_endpoint),
        credentials_provider: credentials_provider
      ).sign_request(
        http_method: request_method,
        url: sts_endpoint,
        headers: vault_headers,
        body: request_body
      ).headers

      payload = {
        role: role,
        iam_http_request_method: request_method,
        iam_request_url: Base64.strict_encode64(sts_endpoint),
        iam_request_headers: Base64.strict_encode64(vault_headers.merge(sig4_headers).to_json),
        iam_request_body: Base64.strict_encode64(request_body)
      }

      json = client.post(route, JSON.fast_generate(payload))
      secret = Secret.decode(json)
      client.token = secret.auth.client_token
      return secret
    end
Authenticate via AWS IAM auth method by providing a AWS CredentialProvider (either ECS, AssumeRole, etc.)
 If authentication is successful, the resulting token will be stored on the client and used
 for future requests.

 @example
   Vault.auth.aws_iam("dev-role-iam", Aws::InstanceProfileCredentials.new, "vault.example.com", "https://sts.us-east-2.amazonaws.com") #=> #<Vault::Secret lease_id="">

 @param [String] role
 @param [CredentialProvider] credentials_provider
   https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CredentialProvider.html
 @param [String] iam_auth_header_value optional
   As of Jan 2018, Vault will accept ANY or NO header if none is configured by the Vault server admin
 @param [String] sts_endpoint optional
   https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html
 @param [String] route optional
 @return [Secret]