resolve comments

Author: smilkuri

packages/credential-providers/src/fromAwsCliV2CompatibleProviderChain.ts

@@ -1,76 +1,133 @@
+import type { FromEnvInit } from "@aws-sdk/credential-provider-env";
+import type { FromIniInit } from "@aws-sdk/credential-provider-ini";
 import { remoteProvider } from "@aws-sdk/credential-provider-node/src/remoteProvider";
+import type { FromProcessInit } from "@aws-sdk/credential-provider-process";
+import type { FromSSOInit } from "@aws-sdk/credential-provider-sso";
+import type { FromTokenFileInit } from "@aws-sdk/credential-provider-web-identity";
 import { createCredentialChain } from "@aws-sdk/credential-providers";
 import type { RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
-import type { AwsCredentialIdentity } from "@aws-sdk/types";
+import type { RemoteProviderInit } from "@smithy/credential-provider-imds";
 import { CredentialsProviderError } from "@smithy/property-provider";
+import type { AwsCredentialIdentity, Logger } from "@smithy/types";
 
-interface AwsCliV2CompatibleProviderOptions extends Partial<AwsCredentialIdentity> {
-  profile?: string;
-  logger?: Console;
-}
+/**
+ * @public
+ */
+
+export type AwsCliV2CompatibleProviderOptions = Partial<AwsCredentialIdentity> &
+  FromEnvInit &
+  FromIniInit &
+  RemoteProviderInit &
+  FromProcessInit &
+  FromSSOInit &
+  FromTokenFileInit & {
+    /**
+     * Setting a client profile is similar to setting a value for the
+     * AWS_PROFILE environment variable. Setting a profile on a client
+     * in code only affects the single client instance, unlike AWS_PROFILE.
+     *
+     * When set, and only for environments where an AWS configuration
+     * file exists, fields configurable by this file will be retrieved
+     * from the specified profile within that file.
+     * Conflicting code configuration and environment variables will
+     * still have higher priority.
+     *
+     * For client credential resolution that involves checking the AWS
+     * configuration file, the client's profile (this value) will be
+     * used unless a different profile is set in the credential
+     * provider options.
+     *
+     */
+    profile?: string;
+
+    /**
+     * Optional logger for logging debug/info/warn/error.
+     */
+    logger?: Logger;
+  };
 
 /**
- * Custom AWS CLI V2 Compatible Credential Provider Chain.
+ * @public
+ *
+ * Creates a credential provider that sources credentials using the same priority
+ * chain as the AWS CLI v2:
+ *
+ * 1. Static credentials from initialization
+ * 2. Profile credentials (if profile specified)
+ * 3. Environment variables
+ * 4. Web Identity Token credentials
+ * 5. SSO credentials
+ * 6. Process credentials
+ * 7. Remote credentials (ECS, EC2 Instance Metadata)
+ *
  * Uses dynamic imports and `createCredentialChain` to mimic AWS CLI V2 behavior.
+ *
+ * @param init - Configuration options for the provider chain
+ * @returns An AWS credential provider function that returns a promise for credentials
  */
+
 export const fromAwsCliV2CompatibleProviderChain =
   (_init: AwsCliV2CompatibleProviderOptions = {}): RuntimeConfigAwsCredentialIdentityProvider =>
   async ({ callerClientConfig } = {}): Promise<AwsCredentialIdentity> => {
     // Merge init with caller's client config (profile/region).
     const init: AwsCliV2CompatibleProviderOptions = {
       ..._init,
       ...callerClientConfig,
-      logger: (_init.logger ?? callerClientConfig?.logger ?? console) as Console,
+      logger: _init.logger ?? callerClientConfig?.logger,
     };
 
-    init.logger?.debug("@aws-sdk/custom-credential-chain - Initializing credential chain");
+    init.logger?.debug(
+      "@aws-sdk/credential-providers - fromAwsCliV2CompatibleProviderChain - Initializing credential chain"
+    );
 
-    const { profile, ...awsCredentials } = init;
+    const { profile, logger, ...awsCredentials } = init;
 
     // 1. If credentials are explicitly provided, return them.
     if (awsCredentials.accessKeyId && awsCredentials.secretAccessKey) {
-      init.logger?.debug("@aws-sdk/custom-credential-chain - Using credentials from constructor");
+      logger?.debug(
+        "@aws-sdk/credential-providers - fromAwsCliV2CompatibleProviderChain - using static credentials from initialization"
+      );
       return awsCredentials as AwsCredentialIdentity;
     }
 
     // 2. If a profile is explicitly passed, use `fromIni`.
     if (profile) {
-      init.logger?.debug("@aws-sdk/custom-credential-chain - Using fromIni with profile:", profile);
+      logger?.debug(
+        "@aws-sdk/credential-providers - fromAwsCliV2CompatibleProviderChain - Using fromIni with profile:",
+        profile
+      );
       const { fromIni } = await import("@aws-sdk/credential-provider-ini");
-      return createCredentialChain(fromIni({ profile }))();
+      return fromIni({ profile, logger })();
     }
 
-    init.logger?.debug("@aws-sdk/cli-compatible-chain - Using from custom credential chain.");
+    logger?.debug(
+      "@aws-sdk/credential-providers - fromAwsCliV2CompatibleProviderChain - Using from custom credential chain."
+    );
     return createCredentialChain(
       async () => {
-        init.logger?.debug("@aws-sdk/cli-compatible-chain - Trying fromEnv");
         const { fromEnv } = await import("@aws-sdk/credential-provider-env");
-        return fromEnv()();
+        return fromEnv(init)();
       },
       async () => {
-        init.logger?.debug("@aws-sdk/cli-compatible-chain - Trying fromTokenFile");
         const { fromTokenFile } = await import("@aws-sdk/credential-provider-web-identity");
-        return fromTokenFile()();
+        return fromTokenFile(init)();
       },
       async () => {
-        init.logger?.debug("@aws-sdk/cli-compatible-chain - Trying fromSSO");
         const { fromSSO } = await import("@aws-sdk/credential-provider-sso");
-        return fromSSO()();
+        return fromSSO(init)();
       },
       async () => {
-        init.logger?.debug("@aws-sdk/cli-compatible-chain- Trying fromProcess");
         const { fromProcess } = await import("@aws-sdk/credential-provider-process");
-        return fromProcess()();
+        return fromProcess(init)();
       },
       async () => {
-        init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::remoteProvider");
+        logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::remoteProvider");
         return (await remoteProvider(init))();
       },
       async () => {
-        init.logger?.debug("@aws-sdk/custom-credential-chain - No valid credentials found. Throwing error.");
         throw new CredentialsProviderError("Could not load credentials from any providers", {
           tryNextLink: false,
-          logger: init.logger,
+          logger,
         });
       }
     )();