Skip to content

Commit bd9e3be

Browse files
sbisciglsbiscigl
committed
update to use regionalized STS credentials client
1 parent fd4d27b commit bd9e3be

File tree

7 files changed

+78
-45
lines changed

7 files changed

+78
-45
lines changed

‎generated/src/aws-cpp-sdk-dynamodb/source/DynamoDBClientConfiguration.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,12 @@ void DynamoDBClientConfiguration::LoadDynamoDBSpecificConfig(const Aws::String&
4545
if(!enableEndpointDiscovery) {
4646
enableEndpointDiscovery = IsEndpointDiscoveryEnabled(this->endpointOverride, inputProfileName);
4747
}
48+
this->configFactories.retryStrategyCreateFn = []() -> std::shared_ptr<Client::RetryStrategy> {
49+
// TODO: renable once default retries are evaluated
50+
// Align with other SDKs to default retry to 10 times for dynamodb.
51+
// return Client::InitRetryStrategy(10);
52+
return Client::InitRetryStrategy();
53+
};
4854
}
4955

5056
DynamoDBClientConfiguration::DynamoDBClientConfiguration(const Client::ClientConfigurationInitValues &configuration)

‎src/aws-cpp-sdk-core/include/aws/core/auth/STSCredentialsProvider.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ namespace Aws
2626
{
2727
public:
2828
STSAssumeRoleWebIdentityCredentialsProvider();
29+
STSAssumeRoleWebIdentityCredentialsProvider(Aws::Client::ClientConfiguration::CredentialProviderConfiguration config);
2930

3031
/**
3132
* Retrieves the credentials if found, otherwise returns empty credential set.

‎src/aws-cpp-sdk-core/include/aws/core/client/ClientConfiguration.h‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -492,14 +492,20 @@ namespace Aws
492492
* AWS profile name to use for credentials.
493493
*/
494494
Aws::String profile;
495+
496+
/**
497+
* Region to use for calls
498+
*/
499+
Aws::String region;
495500
}credentialProviderConfig;
496501
};
497502

498503
/**
499504
* A helper function to initialize a retry strategy.
500505
* Default is DefaultRetryStrategy (i.e. exponential backoff)
501506
*/
502-
std::shared_ptr<RetryStrategy> InitRetryStrategy(Aws::String retryMode = "");
507+
AWS_CORE_API std::shared_ptr<RetryStrategy> InitRetryStrategy(Aws::String retryMode = "");
508+
AWS_CORE_API std::shared_ptr<RetryStrategy> InitRetryStrategy(int maxRetries, Aws::String retryMode = "");
503509

504510
/**
505511
* A helper function to compute a user agent

‎src/aws-cpp-sdk-core/source/auth/AWSCredentialsProviderChain.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ DefaultAWSCredentialsProviderChain::DefaultAWSCredentialsProviderChain(const Aws
9090
AddProvider(Aws::MakeShared<EnvironmentAWSCredentialsProvider>(DefaultCredentialsProviderChainTag));
9191
AddProvider(Aws::MakeShared<ProfileConfigFileAWSCredentialsProvider>(DefaultCredentialsProviderChainTag,config.profile.c_str()));
9292
AddProvider(Aws::MakeShared<ProcessCredentialsProvider>(DefaultCredentialsProviderChainTag,config.profile));
93-
AddProvider(Aws::MakeShared<STSAssumeRoleWebIdentityCredentialsProvider>(DefaultCredentialsProviderChainTag));
93+
AddProvider(Aws::MakeShared<STSAssumeRoleWebIdentityCredentialsProvider>(DefaultCredentialsProviderChainTag, config));
9494
AddProvider(Aws::MakeShared<SSOCredentialsProvider>(DefaultCredentialsProviderChainTag,config.profile));
9595

9696
// General HTTP Credentials (prev. known as ECS TaskRole credentials) only available when ENVIRONMENT VARIABLE is set

‎src/aws-cpp-sdk-core/source/auth/STSCredentialsProvider.cpp‎

Lines changed: 17 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -32,24 +32,18 @@ using Aws::Utils::Threading::WriterLockGuard;
3232
static const char STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG[] = "STSAssumeRoleWithWebIdentityCredentialsProvider";
3333
static const int STS_CREDENTIAL_PROVIDER_EXPIRATION_GRACE_PERIOD = 5 * 60 * 1000; // 5 Minutes.
3434

35-
STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentialsProvider() :
35+
STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentialsProvider(Aws::Client::ClientConfiguration::CredentialProviderConfiguration credentialsConfig):
3636
m_initialized(false)
3737
{
38-
// check environment variables
39-
Aws::String tmpRegion = Aws::Environment::GetEnv("AWS_DEFAULT_REGION");
4038
m_roleArn = Aws::Environment::GetEnv("AWS_ROLE_ARN");
4139
m_tokenFile = Aws::Environment::GetEnv("AWS_WEB_IDENTITY_TOKEN_FILE");
4240
m_sessionName = Aws::Environment::GetEnv("AWS_ROLE_SESSION_NAME");
4341

4442
// check profile_config if either m_roleArn or m_tokenFile is not loaded from environment variable
4543
// region source is not enforced, but we need it to construct sts endpoint, if we can't find from environment, we should check if it's set in config file.
46-
if (m_roleArn.empty() || m_tokenFile.empty() || tmpRegion.empty())
44+
if (m_roleArn.empty() || m_tokenFile.empty())
4745
{
48-
auto profile = Aws::Config::GetCachedConfigProfile(Aws::Auth::GetConfigProfileName());
49-
if (tmpRegion.empty())
50-
{
51-
tmpRegion = profile.GetRegion();
52-
}
46+
auto profile = Aws::Config::GetCachedConfigProfile(credentialsConfig.profile);
5347
// If either of these two were not found from environment, use whatever found for all three in config file
5448
if (m_roleArn.empty() || m_tokenFile.empty())
5549
{
@@ -79,15 +73,6 @@ STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentials
7973
AWS_LOGSTREAM_DEBUG(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Resolved role_arn from profile_config or environment variable to be " << m_roleArn);
8074
}
8175

82-
if (tmpRegion.empty())
83-
{
84-
tmpRegion = Aws::Region::US_EAST_1;
85-
}
86-
else
87-
{
88-
AWS_LOGSTREAM_DEBUG(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Resolved region from profile_config or environment variable to be " << tmpRegion);
89-
}
90-
9176
if (m_sessionName.empty())
9277
{
9378
m_sessionName = Aws::Utils::UUID::PseudoRandomUUID();
@@ -99,8 +84,7 @@ STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentials
9984

10085
Aws::Client::ClientConfiguration config;
10186
config.scheme = Aws::Http::Scheme::HTTPS;
102-
config.region = tmpRegion;
103-
87+
config.region = credentialsConfig.region;
10488
Aws::Vector<Aws::String> retryableErrors;
10589
retryableErrors.push_back("IDPCommunicationError");
10690
retryableErrors.push_back("InvalidIdentityToken");
@@ -112,6 +96,19 @@ STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentials
11296
AWS_LOGSTREAM_INFO(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Creating STS AssumeRole with web identity creds provider.");
11397
}
11498

99+
Aws::String LegacyGetRegion() {
100+
auto region = Aws::Environment::GetEnv("AWS_DEFAULT_REGION");
101+
if (region.empty()) {
102+
auto profile = Aws::Config::GetCachedConfigProfile(Aws::Auth::GetConfigProfileName());
103+
region = profile.GetRegion();
104+
}
105+
return region;
106+
}
107+
108+
STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentialsProvider()
109+
: STSAssumeRoleWebIdentityCredentialsProvider(
110+
Aws::Client::ClientConfiguration::CredentialProviderConfiguration{Aws::Auth::GetConfigProfileName(), LegacyGetRegion()}) {}
111+
115112
AWSCredentials STSAssumeRoleWebIdentityCredentialsProvider::GetAWSCredentials()
116113
{
117114
// A valid client means required information like role arn and token file were constructed correctly.

‎src/aws-cpp-sdk-core/source/client/ClientConfiguration.cpp‎

Lines changed: 37 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,7 @@ void setLegacyClientConfigurationParameters(ClientConfiguration& clientConfig)
238238
AWS_LOGSTREAM_DEBUG(CLIENT_CONFIG_TAG, "ClientConfiguration will use SDK Auto Resolved profile: [" << clientConfig.profileName << "] if not specified by users.");
239239

240240
clientConfig.region = calculateRegion();
241+
clientConfig.credentialProviderConfig.region = clientConfig.region;
241242

242243
// Set the endpoint to interact with EC2 instance's metadata service
243244
Aws::String ec2MetadataServiceEndpoint = Aws::Environment::GetEnv("AWS_EC2_METADATA_SERVICE_ENDPOINT");
@@ -305,13 +306,15 @@ ClientConfiguration::ClientConfiguration()
305306
if (client)
306307
{
307308
region = client->GetCurrentRegion();
309+
this->credentialProviderConfig.region = region;
308310
}
309311
}
310312
if (!region.empty())
311313
{
312314
return;
313315
}
314316
region = Aws::String(Aws::Region::US_EAST_1);
317+
this->credentialProviderConfig.region = region;
315318
}
316319

317320
ClientConfiguration::ClientConfiguration(const ClientConfigurationInitValues &configuration)
@@ -329,13 +332,15 @@ ClientConfiguration::ClientConfiguration(const ClientConfigurationInitValues &co
329332
if (client)
330333
{
331334
region = client->GetCurrentRegion();
335+
this->credentialProviderConfig.region = region;
332336
}
333337
}
334338
if (!region.empty())
335339
{
336340
return;
337341
}
338342
region = Aws::String(Aws::Region::US_EAST_1);
343+
this->credentialProviderConfig.region = region;
339344
}
340345

341346
ClientConfiguration::ClientConfiguration(const char* profile, bool shouldDisableIMDS)
@@ -359,12 +364,14 @@ ClientConfiguration::ClientConfiguration(const char* profile, bool shouldDisable
359364
ec2MetadataRegion = client->GetCurrentRegion();
360365
hasEc2MetadataRegion = true;
361366
region = ec2MetadataRegion;
367+
this->credentialProviderConfig.region = region;
362368
}
363369
}
364370

365371
if(region.empty())
366372
{
367373
region = Aws::String(Aws::Region::US_EAST_1);
374+
this->credentialProviderConfig.region = region;
368375
}
369376

370377
if (profile && Aws::Config::HasCachedConfigProfile(profile)) {
@@ -373,6 +380,7 @@ ClientConfiguration::ClientConfiguration(const char* profile, bool shouldDisable
373380
auto tmpRegion = Aws::Config::GetCachedConfigProfile(this->profileName).GetRegion();
374381
if (!tmpRegion.empty()) {
375382
region = tmpRegion;
383+
this->credentialProviderConfig.region = region;
376384
}
377385

378386
Aws::String profileDefaultsMode = Aws::Config::GetCachedConfigProfile(this->profileName).GetDefaultsMode();
@@ -404,39 +412,19 @@ ClientConfiguration::ClientConfiguration(bool /*useSmartDefaults*/, const char*
404412
ec2MetadataRegion = client->GetCurrentRegion();
405413
hasEc2MetadataRegion = true;
406414
region = ec2MetadataRegion;
415+
this->credentialProviderConfig.region = region;
407416
}
408417
}
409418
if (region.empty())
410419
{
411420
region = Aws::String(Aws::Region::US_EAST_1);
421+
this->credentialProviderConfig.region = region;
412422
}
413423

414424
Aws::Config::Defaults::SetSmartDefaultsConfigurationParameters(*this, defaultMode, hasEc2MetadataRegion, ec2MetadataRegion);
415425
}
416426

417-
std::shared_ptr<RetryStrategy> InitRetryStrategy(Aws::String retryMode)
418-
{
419-
int maxAttempts = 0;
420-
Aws::String maxAttemptsString = Aws::Environment::GetEnv("AWS_MAX_ATTEMPTS");
421-
if (maxAttemptsString.empty())
422-
{
423-
maxAttemptsString = Aws::Config::GetCachedConfigValue("max_attempts");
424-
}
425-
// In case users specify 0 explicitly to disable retry.
426-
if (maxAttemptsString == "0")
427-
{
428-
maxAttempts = 0;
429-
}
430-
else
431-
{
432-
maxAttempts = static_cast<int>(Aws::Utils::StringUtils::ConvertToInt32(maxAttemptsString.c_str()));
433-
if (maxAttempts == 0)
434-
{
435-
AWS_LOGSTREAM_INFO(CLIENT_CONFIG_TAG, "Retry Strategy will use the default max attempts.");
436-
maxAttempts = -1;
437-
}
438-
}
439-
427+
std::shared_ptr<RetryStrategy> InitRetryStrategy(int maxAttempts, Aws::String retryMode) {
440428
if (retryMode.empty())
441429
{
442430
retryMode = Aws::Environment::GetEnv("AWS_RETRY_MODE");
@@ -479,6 +467,32 @@ std::shared_ptr<RetryStrategy> InitRetryStrategy(Aws::String retryMode)
479467
return retryStrategy;
480468
}
481469

470+
std::shared_ptr<RetryStrategy> InitRetryStrategy(Aws::String retryMode)
471+
{
472+
int maxAttempts = 0;
473+
Aws::String maxAttemptsString = Aws::Environment::GetEnv("AWS_MAX_ATTEMPTS");
474+
if (maxAttemptsString.empty())
475+
{
476+
maxAttemptsString = Aws::Config::GetCachedConfigValue("max_attempts");
477+
}
478+
// In case users specify 0 explicitly to disable retry.
479+
if (maxAttemptsString == "0")
480+
{
481+
maxAttempts = 0;
482+
}
483+
else
484+
{
485+
maxAttempts = static_cast<int>(Aws::Utils::StringUtils::ConvertToInt32(maxAttemptsString.c_str()));
486+
if (maxAttempts == 0)
487+
{
488+
AWS_LOGSTREAM_INFO(CLIENT_CONFIG_TAG, "Retry Strategy will use the default max attempts.");
489+
maxAttempts = -1;
490+
}
491+
}
492+
493+
return InitRetryStrategy(maxAttempts, retryMode);
494+
}
495+
482496
Aws::String ClientConfiguration::LoadConfigFromEnvOrProfile(const Aws::String& envKey,
483497
const Aws::String& profile,
484498
const Aws::String& profileProperty,

‎tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/common/ServiceClientConfigurationSource.vm‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,15 @@ void ${metadata.classNamePrefix}ClientConfiguration::Load${serviceNamespace}Spec
123123
enableEndpointDiscovery = IsEndpointDiscoveryEnabled(this->endpointOverride, inputProfileName);
124124
}
125125
#end
126+
## DyanmoDB historically requires 10 retries for backwards compatibility
127+
#if($serviceModel.metadata.serviceId == "DynamoDB")
128+
this->configFactories.retryStrategyCreateFn = []() -> std::shared_ptr<Client::RetryStrategy> {
129+
// TODO: renable once default retries are evaluated
130+
// Align with other SDKs to default retry to 10 times for dynamodb.
131+
// return Client::InitRetryStrategy(10);
132+
return Client::InitRetryStrategy();
133+
};
134+
#end
126135
}
127136

128137
${metadata.classNamePrefix}ClientConfiguration::${metadata.classNamePrefix}ClientConfiguration(const Client::ClientConfigurationInitValues &configuration)

0 commit comments

Comments
 (0)