Skip to content

Commit b0be9f4

Browse files
kai-ionkai-ion
committed
new configuration support for IMDSConfig
Add ClientConfiguration support for IMDS settings and update related classes Fix: Shared pointer bug in AWSCredentialsProvider allocator mismatch bug fix, change type using c_str() new configuration support for IMDSConfig Add ClientConfiguration support for IMDS settings and update related classes Fix: Shared pointer bug in AWSCredentialsProvider allocator mismatch bug fix, change type using c_str() Fix shared pointer bug and update IMDS config structure - Fix std::stol compilation error with Aws::String by using .c_str() - Update IMDS configuration to use credentialProviderConfig.imdsConfig structure - Add proper environment variable support for AWS_METADATA_SERVICE_TIMEOUT and AWS_METADATA_SERVICE_NUM_ATTEMPTS Update IMDS configuration and credentials provider fix: Remove duplicate IMDS config struct and fix comment syntax feat: Add IMDS configuration support to credential provider chain - Add CredentialProviderConfiguration struct with IMDS timeout and retry settings - Add constructor to DefaultAWSCredentialsProviderChain accepting CredentialProviderConfiguration - Add constructor to InstanceProfileCredentialsProvider accepting CredentialProviderConfiguration - Add constructor to EC2InstanceProfileConfigLoader accepting CredentialProviderConfiguration - Add constructor to EC2MetadataClient accepting CredentialProviderConfiguration with IMDS timeout/retry configuration - Enable IMDS configuration to flow through: CredentialProviderConfiguration → InstanceProfileCredentialsProvider → EC2InstanceProfileConfigLoader → EC2MetadataClient - Reduce object creation redundancy by passing configuration directly through the chain fix disableImdsvV1 member added new include feat: Add IMDS configuration support for AWS_METADATA_SERVICE_TIMEOUT Add support for AWS_METADATA_SERVICE_TIMEOUT and AWS_METADATA_SERVICE_NUM_ATTEMPTS environment variables and config file settings to configure IMDS client behavior. - Add imdsConfig struct to ClientConfiguration.credentialProviderConfig - Support AWS_METADATA_SERVICE_TIMEOUT env var and metadata_service_timeout config - Support AWS_METADATA_SERVICE_NUM_ATTEMPTS env var and metadata_service_num_attempts config - Add InstanceProfileCredentialsProvider constructor accepting ClientConfiguration - Add EC2InstanceProfileConfigLoader constructor accepting CredentialProviderConfiguration - Update EC2MetadataClient to use configured timeout and retry values - Use StringUtils::ConvertToInt32 for parsing instead of std::stol Resolves customer request for configurable IMDS timeout settings. fixed snake case removed m_disableIMDSV1 and comment recreated retry strategy during client configuration updated forward declaration fixed nip New Max Attemp Retry Strategy updated conflicts updated conflicts nit DisableIMDSV1
1 parent bd9e3be commit b0be9f4

File tree

10 files changed

+110
-3
lines changed

10 files changed

+110
-3
lines changed

‎src/aws-cpp-sdk-core/include/aws/core/auth/AWSCredentialsProvider.h‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@
2222

2323
namespace Aws
2424
{
25+
namespace Client
26+
{
27+
struct ClientConfiguration;
28+
}
2529
namespace Auth
2630
{
2731
constexpr int REFRESH_THRESHOLD = 1000 * 60 * 5;
@@ -212,6 +216,11 @@ namespace Aws
212216
*/
213217
InstanceProfileCredentialsProvider(const std::shared_ptr<Aws::Config::EC2InstanceProfileConfigLoader>&, long refreshRateMs = REFRESH_THRESHOLD);
214218

219+
/**
220+
* Initializes the provider using ClientConfiguration for IMDS settings.
221+
*/
222+
InstanceProfileCredentialsProvider(const Aws::Client::ClientConfiguration::CredentialProviderConfiguration& credentialProviderConfig, long refreshRateMs = REFRESH_THRESHOLD);
223+
215224
/**
216225
* Retrieves the credentials if found, otherwise returns empty credential set.
217226
*/

‎src/aws-cpp-sdk-core/include/aws/core/client/ClientConfiguration.h‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -497,6 +497,28 @@ namespace Aws
497497
* Region to use for calls
498498
*/
499499
Aws::String region;
500+
501+
/**
502+
* IMDS configuration settings
503+
*/
504+
struct {
505+
/**
506+
* Number of total attempts to make when retrieving data from IMDS. Default 1.
507+
*/
508+
long metadataServiceNumAttempts = 1;
509+
510+
/**
511+
* Timeout in seconds when retrieving data from IMDS. Default 1.
512+
*/
513+
long metadataServiceTimeout = 1;
514+
515+
/**
516+
* Retry Strategy for IMDS
517+
*/
518+
std::shared_ptr<RetryStrategy> imdsRetryStrategy;
519+
bool disableImdsV1;
520+
bool disableImds;
521+
} imdsConfig;
500522
}credentialProviderConfig;
501523
};
502524

‎src/aws-cpp-sdk-core/include/aws/core/config/EC2InstanceProfileConfigLoader.h‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
#pragma once
77

88
#include <aws/core/config/AWSProfileConfigLoaderBase.h>
9-
9+
#include <aws/core/client/ClientConfiguration.h>
1010
#include <aws/core/utils/memory/stl/AWSString.h>
1111
#include <aws/core/utils/memory/stl/AWSMap.h>
1212
#include <aws/core/utils/DateTime.h>
@@ -34,6 +34,11 @@ namespace Aws
3434
*/
3535
EC2InstanceProfileConfigLoader(const std::shared_ptr<Aws::Internal::EC2MetadataClient>& = nullptr);
3636

37+
/**
38+
* Creates EC2MetadataClient using the provided CredentialProviderConfiguration.
39+
*/
40+
EC2InstanceProfileConfigLoader(const Aws::Client::ClientConfiguration::CredentialProviderConfiguration& credentialConfig);
41+
3742
virtual ~EC2InstanceProfileConfigLoader() = default;
3843

3944
protected:

‎src/aws-cpp-sdk-core/include/aws/core/internal/AWSHttpResourceClient.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ namespace Aws
103103
*/
104104
EC2MetadataClient(const char* endpoint = "http://169.254.169.254");
105105
EC2MetadataClient(const Client::ClientConfiguration& clientConfiguration, const char* endpoint = "http://169.254.169.254");
106+
EC2MetadataClient(const Client::ClientConfiguration::CredentialProviderConfiguration& credentialConfig, const char* endpoint = "http://169.254.169.254");
106107

107108
EC2MetadataClient& operator =(const EC2MetadataClient& rhs) = delete;
108109
EC2MetadataClient(const EC2MetadataClient& rhs) = delete;

‎src/aws-cpp-sdk-core/source/auth/AWSCredentialsProvider.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
#include <aws/core/auth/AWSCredentialsProvider.h>
88

99
#include <aws/core/config/AWSProfileConfigLoader.h>
10+
#include <aws/core/client/ClientConfiguration.h>
1011
#include <aws/core/platform/Environment.h>
1112
#include <aws/core/platform/FileSystem.h>
1213
#include <aws/core/platform/OSVersionInfo.h>
@@ -242,6 +243,12 @@ InstanceProfileCredentialsProvider::InstanceProfileCredentialsProvider(const std
242243
AWS_LOGSTREAM_INFO(INSTANCE_LOG_TAG, "Creating Instance with injected EC2MetadataClient and refresh rate " << refreshRateMs);
243244
}
244245

246+
InstanceProfileCredentialsProvider::InstanceProfileCredentialsProvider(const Aws::Client::ClientConfiguration::CredentialProviderConfiguration& credentialConfig, long refreshRateMs) :
247+
m_ec2MetadataConfigLoader(Aws::MakeShared<Aws::Config::EC2InstanceProfileConfigLoader>(INSTANCE_LOG_TAG, credentialConfig)),
248+
m_loadFrequencyMs(refreshRateMs)
249+
{
250+
AWS_LOGSTREAM_INFO(INSTANCE_LOG_TAG, "Creating Instance with IMDS timeout: " << credentialConfig.imdsConfig.metadataServiceTimeout << "s, attempts: " << credentialConfig.imdsConfig.metadataServiceNumAttempts);
251+
}
245252

246253
AWSCredentials InstanceProfileCredentialsProvider::GetAWSCredentials()
247254
{

‎src/aws-cpp-sdk-core/source/auth/AWSCredentialsProviderChain.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
#include <aws/core/auth/AWSCredentialsProviderChain.h>
77
#include <aws/core/auth/STSCredentialsProvider.h>
88
#include <aws/core/auth/SSOCredentialsProvider.h>
9+
#include <aws/core/client/ClientConfiguration.h>
910
#include <aws/core/platform/Environment.h>
1011
#include <aws/core/utils/memory/AWSMemory.h>
1112
#include <aws/core/utils/StringUtils.h>
@@ -125,7 +126,7 @@ DefaultAWSCredentialsProviderChain::DefaultAWSCredentialsProviderChain(const Aws
125126
}
126127
else if (Aws::Utils::StringUtils::ToLower(ec2MetadataDisabled.c_str()) != "true")
127128
{
128-
AddProvider(Aws::MakeShared<InstanceProfileCredentialsProvider>(DefaultCredentialsProviderChainTag));
129+
AddProvider(Aws::MakeShared<InstanceProfileCredentialsProvider>(DefaultCredentialsProviderChainTag, config));
129130
AWS_LOGSTREAM_INFO(DefaultCredentialsProviderChainTag, "Added EC2 metadata service credentials provider to the provider chain.");
130131
}
131132
}

‎src/aws-cpp-sdk-core/source/auth/STSCredentialsProvider.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ Aws::String LegacyGetRegion() {
107107

108108
STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentialsProvider()
109109
: STSAssumeRoleWebIdentityCredentialsProvider(
110-
Aws::Client::ClientConfiguration::CredentialProviderConfiguration{Aws::Auth::GetConfigProfileName(), LegacyGetRegion()}) {}
110+
Aws::Client::ClientConfiguration::CredentialProviderConfiguration{Aws::Auth::GetConfigProfileName(), LegacyGetRegion(), {}}) {}
111111

112112
AWSCredentials STSAssumeRoleWebIdentityCredentialsProvider::GetAWSCredentials()
113113
{

‎src/aws-cpp-sdk-core/source/client/ClientConfiguration.cpp‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ static const char* DISABLE_IMDSV1_CONFIG_VAR = "AWS_EC2_METADATA_V1_DISABLED";
4141
static const char* DISABLE_IMDSV1_ENV_VAR = "ec2_metadata_v1_disabled";
4242
static const char* AWS_ACCOUNT_ID_ENDPOINT_MODE_ENVIRONMENT_VARIABLE = "AWS_ACCOUNT_ID_ENDPOINT_MODE";
4343
static const char* AWS_ACCOUNT_ID_ENDPOINT_MODE_CONFIG_FILE_OPTION = "account_id_endpoint_mode";
44+
static const char* AWS_METADATA_SERVICE_TIMEOUT_ENV_VAR = "AWS_METADATA_SERVICE_TIMEOUT";
45+
static const char* AWS_METADATA_SERVICE_TIMEOUT_CONFIG_VAR = "metadata_service_timeout";
46+
static const char* AWS_METADATA_SERVICE_NUM_ATTEMPTS_ENV_VAR = "AWS_METADATA_SERVICE_NUM_ATTEMPTS";
47+
static const char* AWS_METADATA_SERVICE_NUM_ATTEMPTS_CONFIG_VAR = "metadata_service_num_attempts";
4448

4549
using RequestChecksumConfigurationEnumMapping = std::pair<const char*, RequestChecksumCalculation>;
4650
static const std::array<RequestChecksumConfigurationEnumMapping, 2> REQUEST_CHECKSUM_CONFIG_MAPPING = {{
@@ -280,6 +284,7 @@ void setConfigFromEnvOrProfile(ClientConfiguration &config)
280284
"false");
281285
if (disableIMDSv1 == "true") {
282286
config.disableImdsV1 = true;
287+
config.credentialProviderConfig.imdsConfig.disableImdsV1 = true;
283288
}
284289

285290
// accountId is intentionally not set here: AWS_ACCOUNT_ID env variable may not match the provided credentials.
@@ -289,11 +294,38 @@ void setConfigFromEnvOrProfile(ClientConfiguration &config)
289294
AWS_ACCOUNT_ID_ENDPOINT_MODE_CONFIG_FILE_OPTION,
290295
{"required", "disabled", "preferred"}, /* allowed values */
291296
"preferred" /* default value */);
297+
298+
// Load IMDS configuration from environment variables and config file
299+
Aws::String timeoutStr = ClientConfiguration::LoadConfigFromEnvOrProfile(AWS_METADATA_SERVICE_TIMEOUT_ENV_VAR,
300+
config.profileName,
301+
AWS_METADATA_SERVICE_TIMEOUT_CONFIG_VAR,
302+
{}, /* allowed values */
303+
"1" /* default value */);
304+
305+
// Load IMDS configuration from environment variables and config file
306+
Aws::String numAttemptsStr = ClientConfiguration::LoadConfigFromEnvOrProfile(AWS_METADATA_SERVICE_NUM_ATTEMPTS_ENV_VAR,
307+
config.profileName,
308+
AWS_METADATA_SERVICE_NUM_ATTEMPTS_CONFIG_VAR,
309+
{}, /* allowed values */
310+
"1" /* default value */);
311+
312+
// Parse and set IMDS timeout
313+
long timeout = static_cast<long>(Aws::Utils::StringUtils::ConvertToInt32(timeoutStr.c_str()));
314+
config.credentialProviderConfig.imdsConfig.metadataServiceTimeout = timeout;
315+
316+
// Parse and set IMDS num attempts
317+
long attempts = static_cast<long>(Aws::Utils::StringUtils::ConvertToInt32(numAttemptsStr.c_str()));
318+
config.credentialProviderConfig.imdsConfig.metadataServiceNumAttempts = attempts;
319+
320+
// Initialize IMDS-specific retry strategy with configured number of attempts
321+
// Uses default retry mode with the specified max attempts from metadata_service_num_attempts
322+
config.credentialProviderConfig.imdsConfig.imdsRetryStrategy = InitRetryStrategy(attempts, "");
292323
}
293324

294325
ClientConfiguration::ClientConfiguration()
295326
{
296327
this->disableIMDS = false;
328+
this->credentialProviderConfig.imdsConfig.disableImds = false;
297329
setLegacyClientConfigurationParameters(*this);
298330
setConfigFromEnvOrProfile(*this);
299331
this->credentialProviderConfig.profile = this->profileName;
@@ -320,6 +352,7 @@ ClientConfiguration::ClientConfiguration()
320352
ClientConfiguration::ClientConfiguration(const ClientConfigurationInitValues &configuration)
321353
{
322354
this->disableIMDS = configuration.shouldDisableIMDS;
355+
this->credentialProviderConfig.imdsConfig.disableImds = configuration.shouldDisableIMDS;
323356
setLegacyClientConfigurationParameters(*this);
324357
setConfigFromEnvOrProfile(*this);
325358
this->credentialProviderConfig.profile = this->profileName;
@@ -346,6 +379,7 @@ ClientConfiguration::ClientConfiguration(const ClientConfigurationInitValues &co
346379
ClientConfiguration::ClientConfiguration(const char* profile, bool shouldDisableIMDS)
347380
{
348381
this->disableIMDS = shouldDisableIMDS;
382+
this->credentialProviderConfig.imdsConfig.disableImds = shouldDisableIMDS;
349383
if (profile && Aws::Config::HasCachedConfigProfile(profile)) {
350384
this->profileName = Aws::String(profile);
351385
}
@@ -395,6 +429,7 @@ ClientConfiguration::ClientConfiguration(const char* profile, bool shouldDisable
395429
ClientConfiguration::ClientConfiguration(bool /*useSmartDefaults*/, const char* defaultMode, bool shouldDisableIMDS)
396430
{
397431
this->disableIMDS = shouldDisableIMDS;
432+
this->credentialProviderConfig.imdsConfig.disableImds = shouldDisableIMDS;
398433
setLegacyClientConfigurationParameters(*this);
399434
setConfigFromEnvOrProfile(*this);
400435
this->credentialProviderConfig.profile = this->profileName;

‎src/aws-cpp-sdk-core/source/config/EC2InstanceProfileConfigLoader.cpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
#include <aws/core/config/AWSProfileConfigLoader.h>
77
#include <aws/core/internal/AWSHttpResourceClient.h>
88
#include <aws/core/auth/AWSCredentialsProvider.h>
9+
#include <aws/core/client/ClientConfiguration.h>
910
#include <aws/core/utils/memory/stl/AWSList.h>
1011
#include <aws/core/utils/logging/LogMacros.h>
1112
#include <aws/core/utils/json/JsonSerializer.h>
@@ -37,6 +38,10 @@ namespace Aws
3738
m_ec2metadataClient = client;
3839
}
3940
}
41+
42+
EC2InstanceProfileConfigLoader::EC2InstanceProfileConfigLoader(const Aws::Client::ClientConfiguration::CredentialProviderConfiguration& credentialConfig)
43+
: m_ec2metadataClient(Aws::MakeShared<Aws::Internal::EC2MetadataClient>(EC2_INSTANCE_PROFILE_LOG_TAG, credentialConfig))
44+
{}
4045

4146
bool EC2InstanceProfileConfigLoader::LoadInternal()
4247
{

‎src/aws-cpp-sdk-core/source/internal/AWSHttpResourceClient.cpp‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,28 @@ namespace Aws
208208
#endif
209209
}
210210

211+
EC2MetadataClient::EC2MetadataClient(const Aws::Client::ClientConfiguration::CredentialProviderConfiguration& credentialConfig,
212+
const char* endpoint)
213+
: AWSHttpResourceClient(
214+
[&credentialConfig]() -> ClientConfiguration{
215+
Aws::Client::ClientConfiguration clientConfig{credentialConfig.profile.c_str()};
216+
clientConfig.region = credentialConfig.region;
217+
clientConfig.credentialProviderConfig = credentialConfig;
218+
clientConfig.requestTimeoutMs = credentialConfig.imdsConfig.metadataServiceTimeout * 1000;
219+
clientConfig.retryStrategy = credentialConfig.imdsConfig.imdsRetryStrategy;
220+
return clientConfig;
221+
}(),
222+
EC2_METADATA_CLIENT_LOG_TAG),
223+
m_endpoint(endpoint),
224+
m_disableIMDS(credentialConfig.imdsConfig.disableImds),
225+
m_tokenRequired(true),
226+
m_disableIMDSV1(credentialConfig.imdsConfig.disableImdsV1) {
227+
#if defined(DISABLE_IMDSV1)
228+
m_disableIMDSV1 = true;
229+
AWS_LOGSTREAM_TRACE(m_logtag.c_str(), "IMDSv1 had been disabled at the SDK build time");
230+
#endif
231+
}
232+
211233
EC2MetadataClient::~EC2MetadataClient()
212234
{
213235

0 commit comments

Comments
 (0)