Skip to content

Commit 32fd0ed

Browse files
kuhekuhe
committed
fix(credential-providers): supply backup credentials to fromTemporaryCredentials
1 parent d35e4ad commit 32fd0ed

File tree

5 files changed

+176
-71
lines changed

5 files changed

+176
-71
lines changed

‎packages/credential-providers/src/fromTemporaryCredentials.browser.ts‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
import type { AssumeRoleCommandInput, STSClient, STSClientConfig } from "@aws-sdk/nested-clients/sts";
2+
import type {
3+
AwsIdentityProperties,
4+
CredentialProviderOptions,
5+
RuntimeConfigAwsCredentialIdentityProvider,
6+
} from "@aws-sdk/types";
7+
import { CredentialsProviderError } from "@smithy/property-provider";
8+
import { AwsCredentialIdentity, AwsCredentialIdentityProvider, Pluggable } from "@smithy/types";
9+
10+
export interface FromTemporaryCredentialsOptions extends CredentialProviderOptions {
11+
params: Omit<AssumeRoleCommandInput, "RoleSessionName"> & { RoleSessionName?: string };
12+
masterCredentials?: AwsCredentialIdentity | AwsCredentialIdentityProvider;
13+
clientConfig?: STSClientConfig;
14+
clientPlugins?: Pluggable<any, any>[];
15+
mfaCodeProvider?: (mfaSerial: string) => Promise<string>;
16+
}
17+
18+
export const fromTemporaryCredentials = (
19+
options: FromTemporaryCredentialsOptions,
20+
credentialDefaultProvider?: () => AwsCredentialIdentityProvider
21+
): RuntimeConfigAwsCredentialIdentityProvider => {
22+
let stsClient: STSClient;
23+
return async (awsIdentityProperties: AwsIdentityProperties = {}): Promise<AwsCredentialIdentity> => {
24+
options.logger?.debug("@aws-sdk/credential-providers - fromTemporaryCredentials (STS)");
25+
const params = { ...options.params, RoleSessionName: options.params.RoleSessionName ?? "aws-sdk-js-" + Date.now() };
26+
if (params?.SerialNumber) {
27+
if (!options.mfaCodeProvider) {
28+
throw new CredentialsProviderError(
29+
`Temporary credential requires multi-factor authentication,` + ` but no MFA code callback was provided.`,
30+
{
31+
tryNextLink: false,
32+
logger: options.logger,
33+
}
34+
);
35+
}
36+
params.TokenCode = await options.mfaCodeProvider(params?.SerialNumber);
37+
}
38+
39+
const { AssumeRoleCommand, STSClient } = await import("./loadSts");
40+
41+
if (!stsClient) {
42+
const defaultCredentialsOrError =
43+
typeof credentialDefaultProvider === "function" ? credentialDefaultProvider() : undefined;
44+
45+
const { callerClientConfig } = awsIdentityProperties;
46+
stsClient = new STSClient({
47+
...options.clientConfig,
48+
credentials:
49+
options.masterCredentials ??
50+
options.clientConfig?.credentials ??
51+
callerClientConfig?.credentialDefaultProvider?.() ??
52+
defaultCredentialsOrError,
53+
});
54+
}
55+
if (options.clientPlugins) {
56+
for (const plugin of options.clientPlugins) {
57+
stsClient.middlewareStack.use(plugin);
58+
}
59+
}
60+
const { Credentials } = await stsClient.send(new AssumeRoleCommand(params));
61+
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
62+
throw new CredentialsProviderError(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`, {
63+
logger: options.logger,
64+
});
65+
}
66+
return {
67+
accessKeyId: Credentials.AccessKeyId,
68+
secretAccessKey: Credentials.SecretAccessKey,
69+
sessionToken: Credentials.SessionToken,
70+
expiration: Credentials.Expiration,
71+
// TODO(credentialScope): access normally when shape is updated.
72+
credentialScope: (Credentials as any).CredentialScope,
73+
};
74+
};
75+
};

‎packages/credential-providers/src/fromTemporaryCredentials.spec.ts‎

Lines changed: 81 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
import { AssumeRoleCommand, STSClient } from "@aws-sdk/nested-clients/sts";
22
import { beforeEach, describe, expect, test as it, vi } from "vitest";
33

4-
import { fromTemporaryCredentials } from "./fromTemporaryCredentials";
4+
import { fromTemporaryCredentials as fromTemporaryCredentialsNode } from "./fromTemporaryCredentials";
5+
import { fromTemporaryCredentials } from "./fromTemporaryCredentials.browser";
56

67
const mockSend = vi.fn();
78
const mockUsePlugin = vi.fn();
@@ -55,7 +56,7 @@ describe("fromTemporaryCredentials", () => {
5556
clientConfig: { region },
5657
clientPlugins: [plugin],
5758
};
58-
const provider = fromTemporaryCredentials(options);
59+
const provider = fromTemporaryCredentialsNode(options);
5960
const credential = await provider();
6061
expect(credential).toEqual({
6162
accessKeyId: "ACCESS_KEY_ID",
@@ -77,7 +78,7 @@ describe("fromTemporaryCredentials", () => {
7778

7879
it("should create STS client if not supplied", async () => {
7980
const plugin = { applyToStack: () => {} };
80-
const provider = fromTemporaryCredentials({
81+
const provider = fromTemporaryCredentialsNode({
8182
params: {
8283
RoleArn,
8384
RoleSessionName,
@@ -93,19 +94,8 @@ describe("fromTemporaryCredentials", () => {
9394
expect(mockUsePlugin).toHaveBeenNthCalledWith(1, plugin);
9495
});
9596

96-
it("should resolve default credentials if master credential is not supplied", async () => {
97-
const provider = fromTemporaryCredentials({
98-
params: {
99-
RoleArn,
100-
RoleSessionName,
101-
},
102-
});
103-
await provider();
104-
expect(vi.mocked(STSClient as any)).toHaveBeenCalledWith({});
105-
});
106-
10797
it("should create a role session name if none provided", async () => {
108-
const provider = fromTemporaryCredentials({
98+
const provider = fromTemporaryCredentialsNode({
10999
params: { RoleArn },
110100
});
111101
await provider();
@@ -115,6 +105,80 @@ describe("fromTemporaryCredentials", () => {
115105
});
116106
});
117107

108+
describe("nested sts credential resolution order", () => {
109+
const masterCredentials = vi.fn();
110+
const clientConfigCredentials = vi.fn();
111+
const callerClientCredentials = vi.fn();
112+
const chainCredentials = vi.fn();
113+
114+
it("should use with 1st priority masterCredentials from the provider", async () => {
115+
const provider = fromTemporaryCredentials(
116+
{
117+
params: { RoleArn },
118+
masterCredentials: masterCredentials,
119+
clientConfig: {
120+
credentials: clientConfigCredentials,
121+
},
122+
},
123+
chainCredentials
124+
);
125+
await provider({
126+
callerClientConfig: {
127+
region: async () => "us-west-2",
128+
credentialDefaultProvider: callerClientCredentials,
129+
},
130+
});
131+
expect(masterCredentials).toHaveBeenCalled();
132+
});
133+
it("should use with 2nd priority options.clientConfig.credentials", async () => {
134+
const provider = fromTemporaryCredentials(
135+
{
136+
params: { RoleArn },
137+
clientConfig: {
138+
credentials: clientConfigCredentials,
139+
},
140+
},
141+
chainCredentials
142+
);
143+
await provider({
144+
callerClientConfig: {
145+
region: async () => "us-west-2",
146+
credentialDefaultProvider: callerClientCredentials,
147+
},
148+
});
149+
expect(clientConfigCredentials).toHaveBeenCalled();
150+
});
151+
it("should use with 3rd priority caller client's credentialDefaultProvider", async () => {
152+
const provider = fromTemporaryCredentials(
153+
{
154+
params: { RoleArn },
155+
},
156+
chainCredentials
157+
);
158+
await provider({
159+
callerClientConfig: {
160+
region: async () => "us-west-2",
161+
credentialDefaultProvider: callerClientCredentials,
162+
},
163+
});
164+
expect(callerClientCredentials).toHaveBeenCalled();
165+
});
166+
it("should use with 4th priority the node default provider chain (if in Node.js)", async () => {
167+
const provider = fromTemporaryCredentials(
168+
{
169+
params: { RoleArn },
170+
},
171+
chainCredentials
172+
);
173+
await provider({
174+
callerClientConfig: {
175+
region: async () => "us-west-2",
176+
},
177+
});
178+
expect(chainCredentials).toHaveBeenCalled();
179+
});
180+
});
181+
118182
it("should allow assume roles assuming roles assuming roles ad infinitum", async () => {
119183
const roleArnOf = (id: string) => `arn:aws:iam::123456789:role/${id}`;
120184
const idOf = (roleArn: string) => roleArn.split("/")?.[1] ?? "UNKNOWN";
@@ -176,7 +240,7 @@ describe("fromTemporaryCredentials", () => {
176240
const SerialNumber = "SERIAL_NUMBER";
177241
const mfaCode = "MFA_CODE";
178242
const mfaCodeProvider = vi.fn().mockResolvedValue(mfaCode);
179-
const provider = fromTemporaryCredentials({
243+
const provider = fromTemporaryCredentialsNode({
180244
params: { RoleArn, SerialNumber, RoleSessionName },
181245
mfaCodeProvider,
182246
});
@@ -197,7 +261,7 @@ describe("fromTemporaryCredentials", () => {
197261
it("should reject the promise with a terminal error if a MFA serial presents but mfaCodeProvider is missing", async () => {
198262
const SerialNumber = "SERIAL_NUMBER";
199263
try {
200-
await fromTemporaryCredentials({
264+
await fromTemporaryCredentialsNode({
201265
params: { RoleArn, SerialNumber, RoleSessionName },
202266
})();
203267
fail("this test must fail");

‎packages/credential-providers/src/fromTemporaryCredentials.ts‎

Lines changed: 13 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
1-
import type { AssumeRoleCommandInput, STSClient, STSClientConfig } from "@aws-sdk/nested-clients/sts";
2-
import type { CredentialProviderOptions } from "@aws-sdk/types";
3-
import { CredentialsProviderError } from "@smithy/property-provider";
4-
import { AwsCredentialIdentity, AwsCredentialIdentityProvider, Pluggable } from "@smithy/types";
1+
import type { RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
52

6-
export interface FromTemporaryCredentialsOptions extends CredentialProviderOptions {
7-
params: Omit<AssumeRoleCommandInput, "RoleSessionName"> & { RoleSessionName?: string };
8-
masterCredentials?: AwsCredentialIdentity | AwsCredentialIdentityProvider;
9-
clientConfig?: STSClientConfig;
10-
clientPlugins?: Pluggable<any, any>[];
11-
mfaCodeProvider?: (mfaSerial: string) => Promise<string>;
12-
}
3+
import { fromNodeProviderChain } from "./fromNodeProviderChain";
4+
import type { FromTemporaryCredentialsOptions } from "./fromTemporaryCredentials.browser";
5+
import { fromTemporaryCredentials as fromTemporaryCredentialsBase } from "./fromTemporaryCredentials.browser";
6+
7+
/**
8+
* @public
9+
*/
10+
export { FromTemporaryCredentialsOptions };
1311

1412
/**
1513
* Creates a credential provider function that retrieves temporary credentials from STS AssumeRole API.
@@ -53,45 +51,8 @@ export interface FromTemporaryCredentialsOptions extends CredentialProviderOptio
5351
*
5452
* @public
5553
*/
56-
export const fromTemporaryCredentials = (options: FromTemporaryCredentialsOptions): AwsCredentialIdentityProvider => {
57-
let stsClient: STSClient;
58-
return async (): Promise<AwsCredentialIdentity> => {
59-
options.logger?.debug("@aws-sdk/credential-providers - fromTemporaryCredentials (STS)");
60-
const params = { ...options.params, RoleSessionName: options.params.RoleSessionName ?? "aws-sdk-js-" + Date.now() };
61-
if (params?.SerialNumber) {
62-
if (!options.mfaCodeProvider) {
63-
throw new CredentialsProviderError(
64-
`Temporary credential requires multi-factor authentication,` + ` but no MFA code callback was provided.`,
65-
{
66-
tryNextLink: false,
67-
logger: options.logger,
68-
}
69-
);
70-
}
71-
params.TokenCode = await options.mfaCodeProvider(params?.SerialNumber);
72-
}
73-
74-
const { AssumeRoleCommand, STSClient } = await import("./loadSts");
75-
76-
if (!stsClient) stsClient = new STSClient({ ...options.clientConfig, credentials: options.masterCredentials });
77-
if (options.clientPlugins) {
78-
for (const plugin of options.clientPlugins) {
79-
stsClient.middlewareStack.use(plugin);
80-
}
81-
}
82-
const { Credentials } = await stsClient.send(new AssumeRoleCommand(params));
83-
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
84-
throw new CredentialsProviderError(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`, {
85-
logger: options.logger,
86-
});
87-
}
88-
return {
89-
accessKeyId: Credentials.AccessKeyId,
90-
secretAccessKey: Credentials.SecretAccessKey,
91-
sessionToken: Credentials.SessionToken,
92-
expiration: Credentials.Expiration,
93-
// TODO(credentialScope): access normally when shape is updated.
94-
credentialScope: (Credentials as any).CredentialScope,
95-
};
96-
};
54+
export const fromTemporaryCredentials = (
55+
options: FromTemporaryCredentialsOptions
56+
): RuntimeConfigAwsCredentialIdentityProvider => {
57+
return fromTemporaryCredentialsBase(options, fromNodeProviderChain);
9758
};

‎packages/credential-providers/src/index.browser.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@ export * from "./fromCognitoIdentity";
22
export * from "./fromCognitoIdentityPool";
33
export { fromHttp } from "@aws-sdk/credential-provider-http";
44
export type { FromHttpOptions, HttpProviderCredentials } from "@aws-sdk/credential-provider-http";
5-
export * from "./fromTemporaryCredentials";
5+
export * from "./fromTemporaryCredentials.browser";
66
export * from "./fromWebToken";

‎packages/types/src/identity/AwsCredentialIdentity.ts‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import type { AwsCredentialIdentity } from "@smithy/types";
1+
import type { AwsCredentialIdentity, AwsCredentialIdentityProvider } from "@smithy/types";
22

33
import type { AwsSdkCredentialsFeatures } from "../feature-ids";
44

@@ -11,6 +11,11 @@ export interface AwsIdentityProperties {
1111
callerClientConfig?: {
1212
region(): Promise<string>;
1313
profile?: string;
14+
/**
15+
* @internal
16+
* @deprecated
17+
*/
18+
credentialDefaultProvider?: (input?: any) => AwsCredentialIdentityProvider;
1419
};
1520
}
1621

0 commit comments

Comments
 (0)