Using SQS client with FIPS endpoints

[dhwaneetbhatt]

Hello, I want to use SQS with FIPS endpoints. The AWS documentation says setting the AWS_USE_FIPS_ENDPOINT to true in the environment variables should be enough, but I am curious if that would work because almost all of the method calls in the SQS client take in the SQS URL.

So, would the program pass in a FIPS endpoint URL manually when making the request, in addition to setting the environment variable?

import os
import botocore.session

# Set the AWS_USE_FIPS_ENDPOINT environment variable
os.environ['AWS_USE_FIPS_ENDPOINT'] = 'true'

# Initialize a Botocore session
session = botocore.session.get_session()

# Create an SQS client
sqs_client = session.create_client('sqs', region_name='us-west-2')

# The URL of the SQS queue
# Should this be manually changed to
# "https://sqs-fips.us-west-2.amazonaws.com/123456789012/my queue"
# or does the library take care of it?
queue_url = 'https://sqs.us-west-2.amazonaws.com/123456789012/my-queue'

# Making a request to the SQS queue
# Comment: If the AWS_USE_FIPS_ENDPOINT variable is set to 'true',
# is there a need to manually specify the FIPS endpoint in the URL?
# I believe the SDK should automatically convert it into a FIPS-compliant endpoint.
response = sqs_client.send_message(
    QueueUrl=queue_url,
    MessageBody='Hello, this is a test message!'
)

# Print the response
print(response)

[dhwaneetbhatt]

I dug deeper into botocore while debugging, and it uses a POST request to https://queue.amazonaws.com for all requests, passing all the required parameters in the body. This behaviour does not change by passing the AWS_USE_FIPS_ENDPOINT environment variable, so it seems like we need to construct the URL manually.

Please correct me if my conclusion is incorrect.