Skip to content

Commit 15337bd

Browse files
0marperez0marperez
committed
requiresMinorVersionBump set to true in changelog, StsWebIdentityProvider now public, announcement draft updates
1 parent 6ef7a60 commit 15337bd

File tree

5 files changed

+104
-28
lines changed

5 files changed

+104
-28
lines changed

‎.changes/0b5b53ab-70c0-4c1b-a445-8663ae86d6d1.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{
22
"id": "0b5b53ab-70c0-4c1b-a445-8663ae86d6d1",
33
"type": "misc",
4-
"description": "The order of credentials resolution in config files has been updated to: static credentials, assume role with source profile OR assume role with named provider, web identity token, SSO session, legacy SSO, process"
4+
"description": "The order of credentials resolution in config files has been updated to: static credentials, assume role with source profile OR assume role with named provider, web identity token, SSO session, legacy SSO, process",
5+
"requiresMinorVersionBump": true
56
}

‎.changes/99a099e1-26c1-4ba1-b0d3-435609ea4e94.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{
22
"id": "99a099e1-26c1-4ba1-b0d3-435609ea4e94",
33
"type": "misc",
4-
"description": "The order of credentials resolution in the credentials provider chain has been updated to: system properties, environment variables, web identity tokens, profile, ECS, EC2"
4+
"description": "The order of credentials resolution in the credentials provider chain has been updated to: system properties, environment variables, web identity tokens, profile, ECS, EC2",
5+
"requiresMinorVersionBump": true
56
}

‎.changes/announcement.md‎

Lines changed: 88 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,110 @@
11
An upcoming release of the **AWS SDK for Kotlin** will change the order of
22
credentials resolution for the [default credentials provider chain](https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/credential-providers.html#default-credential-provider-chain)
3-
and the order of credentials resolution for the AWS shared config files.
3+
and the order of credentials resolution for AWS shared config files.
44

55
# Release date
66

7-
This feature will ship with the **v1.4.x** release on xx/xx/xxxx.
7+
This change will be included in the upcoming **v1.4.x** release, expected in the
8+
upcoming months.
89

910
# What's changing
1011

11-
The SDK will be changing the order in which credentials are resolved when
12-
using the default credentials provider chain. The new order will be:
12+
The order of credentials resolution for the default credentials provider chain,
13+
and the order of credentials resolution for AWS shared config files (profile chain).
1314

14-
1. System properties
15-
2. Environment variables
16-
3. Assume role with web identity token
17-
4. Shared credentials and config files (profile)
18-
5. Amazon ECS container credentials
19-
6. Amazon EC2 Instance Metadata Service
15+
## Default credentials provider chain
16+
17+
The table below outlines the current and new order in which the SDK will
18+
resolve credentials from the default credentials provider chain.
19+
20+
| # | Current Order | New Order |
21+
|---|------------------------------------------------------------------------|------------------------------------------------------------------------|
22+
| 1 | System properties | System properties |
23+
| 2 | Environment variables | Environment variables |
24+
| 3 | **Shared credentials and config files (profile credentials provider)** | **Assume role with web identity token** |
25+
| 4 | **Assume role with web identity token** | **Shared credentials and config files (profile credentials provider)** |
26+
| 5 | Amazon ECS container credentials | Amazon ECS container credentials |
27+
| 6 | Amazon EC2 Instance Metadata Service | Amazon EC2 Instance Metadata Service |
2028

2129
The [default credentials provider chain documentation](https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/credential-providers.html#default-credential-provider-chain)
2230
contains more details on each credential source.
2331

24-
The SDK will also be changing the order in which credentials are resolved from
25-
in the shared credentials and config files. The new order will be:
32+
## Profile chain
33+
34+
The table below outlines the current and new order in which the SDK will
35+
resolve credentials from AWS shared config files.
2636

27-
1. Static credentials
28-
2. Assume role with source profile OR assume role with named provider (mutually exclusive)
29-
3. Web identity token
30-
4. SSO session
31-
5. Legacy SSO
32-
6. Process
37+
| # | Current Order | New Order |
38+
|---|----------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------|
39+
| 1 | **Assume role with source profile OR assume role with named provider (mutually exclusive)** | **Static credentials** |
40+
| 2 | Web identity token | **Assume role with source profile OR assume role with named provider (mutually exclusive)** |
41+
| 3 | SSO session | Web identity token |
42+
| 4 | Legacy SSO | SSO session |
43+
| 5 | Process | Legacy SSO |
44+
| 6 | **Static credentials (moves up to #1 when in a source profile, shifting other credential sources down)** | Process |
3345

3446
# How to migrate
3547

3648
1. Upgrade all of your AWS SDK for Kotlin dependencies to **v.1.4.x**.
37-
2. Verify that the changes to the default credentials provider chain and credentials files do not introduce any issues in your program.
38-
3. If issues arise review the new credentials resolution order and adjust your configuration as needed.
49+
2. Verify that the changes to the default credentials provider chain and profile chain do not introduce any issues in your program.
50+
3. If issues arise review the new credentials resolution order, the subsections below, and adjust your configuration as needed.
51+
52+
## Default credentials provider chain
53+
54+
You can preserve the current default credentials provider chain behavior by setting
55+
the credentials provider to a credentials provider chain with the current order, e.g.
56+
57+
```kotlin
58+
S3Client{
59+
region = "..."
60+
credentialsProvider = CredentialsProviderChain(
61+
SystemPropertyCredentialsProvider(),
62+
EnvironmentCredentialsProvider(),
63+
StsWebIdentityProvider(),
64+
ProfileCredentialsProvider(),
65+
EcsCredentialsProvider(),
66+
ImdsCredentialsProvider(),
67+
)
68+
}
69+
```
70+
71+
## Profile credentials provider
72+
73+
The order in which credentials are resolved for shared credentials and config
74+
files cannot be customized. If your AWS config file(s) contain multiple valid
75+
credential sources within a single profile, you may need to update them to align
76+
with the new resolution order. For example, config file `A` should be updated to
77+
match config file `B`. This is necessary because static credentials will now
78+
take precedence and be selected before assume role credentials with a source profile.
79+
Similar adjustments to your configuration may be necessary to maintain current
80+
behavior. Use the new order as a guide for any required changes.
81+
82+
Config file `A`
83+
```ini
84+
[default]
85+
role_arn = arn:aws:iam::123456789:role/Role
86+
source_profile = A
87+
aws_access_key_id = 0
88+
aws_secret_access_key = 0
89+
90+
[profile A]
91+
aws_access_key_id = 1
92+
aws_secret_access_key = 2
93+
```
94+
95+
Config file `B`
96+
```ini
97+
[default]
98+
role_arn = arn:aws:iam::123456789:role/Role
99+
source_profile = A
100+
101+
[profile A]
102+
aws_access_key_id = 1
103+
aws_secret_access_key = 2
104+
```
39105

40106
# Feedback
41107

42108
If you have any questions concerning this change, please feel free to engage
43-
with us in this discussion. If you encounter a bug with these changes, please
44-
[file an issue](https://github.com/awslabs/aws-sdk-kotlin/issues/new/choose).
109+
with us in this discussion. If you encounter a bug with these changes when
110+
released, please [file an issue](https://github.com/awslabs/aws-sdk-kotlin/issues/new/choose).

‎aws-runtime/aws-config/api/aws-config.api‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,14 @@ public final class aws/sdk/kotlin/runtime/auth/credentials/StsWebIdentityCredent
199199
public static synthetic fun fromEnvironment-TUY-ock$default (Laws/sdk/kotlin/runtime/auth/credentials/StsWebIdentityCredentialsProvider$Companion;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;JLaws/smithy/kotlin/runtime/util/PlatformProvider;Laws/smithy/kotlin/runtime/http/engine/HttpClientEngine;ILjava/lang/Object;)Laws/sdk/kotlin/runtime/auth/credentials/StsWebIdentityCredentialsProvider;
200200
}
201201

202+
public final class aws/sdk/kotlin/runtime/auth/credentials/StsWebIdentityProvider : aws/smithy/kotlin/runtime/auth/awscredentials/CloseableCredentialsProvider {
203+
public fun <init> ()V
204+
public fun <init> (Laws/smithy/kotlin/runtime/util/PlatformProvider;Laws/smithy/kotlin/runtime/http/engine/HttpClientEngine;Ljava/lang/String;)V
205+
public synthetic fun <init> (Laws/smithy/kotlin/runtime/util/PlatformProvider;Laws/smithy/kotlin/runtime/http/engine/HttpClientEngine;Ljava/lang/String;ILkotlin/jvm/internal/DefaultConstructorMarker;)V
206+
public fun close ()V
207+
public fun resolve (Laws/smithy/kotlin/runtime/collections/Attributes;Lkotlin/coroutines/Continuation;)Ljava/lang/Object;
208+
}
209+
202210
public final class aws/sdk/kotlin/runtime/auth/credentials/SystemPropertyCredentialsProvider : aws/smithy/kotlin/runtime/auth/awscredentials/CredentialsProvider {
203211
public fun <init> ()V
204212
public fun <init> (Lkotlin/jvm/functions/Function1;)V

‎aws-runtime/aws-config/common/src/aws/sdk/kotlin/runtime/auth/credentials/DefaultChainCredentialsProvider.kt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,10 @@ public class DefaultChainCredentialsProvider constructor(
8686
* Wrapper around [StsWebIdentityCredentialsProvider] that delays any exceptions until [resolve] is invoked.
8787
* This allows it to be part of the default chain and any failures result in the chain to move onto the next provider.
8888
*/
89-
private class StsWebIdentityProvider(
90-
val platformProvider: PlatformProvider = PlatformProvider.System,
91-
val httpClient: HttpClientEngine? = null,
92-
val region: String? = null,
89+
public class StsWebIdentityProvider(
90+
private val platformProvider: PlatformProvider = PlatformProvider.System,
91+
private val httpClient: HttpClientEngine? = null,
92+
private val region: String? = null,
9393
) : CloseableCredentialsProvider {
9494
override suspend fun resolve(attributes: Attributes): Credentials {
9595
val wrapped = StsWebIdentityCredentialsProvider.fromEnvironment(platformProvider = platformProvider, httpClient = httpClient, region = region)

0 commit comments

Comments
 (0)