feat: add support for account ID in IMDS credentials #1570
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| { | ||
| "id": "525a1637-f0f1-4cbd-97dd-5e9c6bcd182e", | ||
| "type": "feature", | ||
| "description": "Add support for fetching account ID from IMDS credentials on EC2" | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -41,7 +41,7 @@ import aws.smithy.kotlin.runtime.util.PlatformProvider | |
| * @param region the region to make credentials requests to. | ||
| * @return the newly-constructed credentials provider | ||
| */ | ||
| public class DefaultChainCredentialsProvider( | ||
| public val profileName: String? = null, | ||
| public val platformProvider: PlatformProvider = PlatformProvider.System, | ||
| httpClient: HttpClientEngine? = null, | ||
|
|
@@ -59,11 +59,9 @@ public class DefaultChainCredentialsProvider constructor( | |
| ProfileCredentialsProvider(profileName = profileName, platformProvider = platformProvider, httpClient = engine, region = region), | ||
| EcsCredentialsProvider(platformProvider, engine), | ||
| ImdsCredentialsProvider( | ||
| client = ImdsClient { | ||
| platformProvider = [email protected] | ||
| engine = [email protected] | ||
| }, | ||
| platformProvider = platformProvider, | ||
| ), | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,6 +5,7 @@ | |
|
|
||
| package aws.sdk.kotlin.runtime.auth.credentials | ||
|
|
||
| import aws.sdk.kotlin.runtime.auth.credentials.internal.credentials | ||
| import aws.sdk.kotlin.runtime.config.AwsSdkSetting | ||
| import aws.sdk.kotlin.runtime.config.imds.EC2MetadataError | ||
| import aws.sdk.kotlin.runtime.config.imds.ImdsClient | ||
|
|
@@ -18,137 +19,208 @@ import aws.smithy.kotlin.runtime.http.HttpStatusCode | |
| import aws.smithy.kotlin.runtime.io.IOException | ||
| import aws.smithy.kotlin.runtime.serde.json.JsonDeserializer | ||
| import aws.smithy.kotlin.runtime.telemetry.logging.info | ||
| import aws.smithy.kotlin.runtime.time.Clock | ||
| import aws.smithy.kotlin.runtime.util.PlatformEnvironProvider | ||
| import aws.smithy.kotlin.runtime.util.PlatformProvider | ||
| import aws.smithy.kotlin.runtime.util.SingleFlightGroup | ||
| import kotlin.coroutines.coroutineContext | ||
|
|
||
| private const val CODE_ASSUME_ROLE_UNAUTHORIZED_ACCESS: String = "AssumeRoleUnauthorizedAccess" | ||
| private const val PROVIDER_NAME = "IMDSv2" | ||
|
|
||
| /** | ||
| * [CredentialsProvider] that uses EC2 instance metadata service (IMDS) to provide credentials information. | ||
| * This provider requires that the EC2 instance has an | ||
| * [instance profile](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#ec2-instance-profile) | ||
| * configured. | ||
| * @param instanceProfileName overrides the instance profile name. When set, this provider skips querying IMDS for the | ||
| * name of the active profile. | ||
| * @param client a preconfigured IMDS client with which to retrieve instance metadata. If an instance is passed, the | ||
| * caller is responsible for closing it. If no instance is passed, a default instance is created and will be closed when | ||
| * this credentials provider is closed. | ||
| * @param platformProvider a platform provider used for env vars and system properties | ||
| */ | ||
| public class ImdsCredentialsProvider( | ||
| instanceProfileName: String? = null, | ||
| client: InstanceMetadataProvider? = null, | ||
| private val platformProvider: PlatformProvider = PlatformProvider.System, | ||
| ) : CloseableCredentialsProvider { | ||
|
|
||
| @Deprecated("This constructor supports parameters which are no longer used in the implementation. It will be removed in version 1.5.") | ||
| public constructor( | ||
| profileOverride: String? = null, | ||
| client: Lazy<InstanceMetadataProvider> = lazy { ImdsClient() }, | ||
| platformProvider: PlatformEnvironProvider = PlatformProvider.System, | ||
| @Suppress("UNUSED_PARAMETER") clock: Clock = Clock.System, | ||
| ) : this(profileOverride, client.value, platformProvider = platformProvider as? PlatformProvider ?: PlatformProvider.System) | ||
|
||
|
|
||
| private val manageClient: Boolean = client == null | ||
|
|
||
| private val client: InstanceMetadataProvider = client ?: ImdsClient { | ||
| this.platformProvider = [email protected] | ||
| } | ||
|
|
||
| // FIXME This only resolves from env vars and sys props but we need to resolve from profiles too | ||
|
||
| private val instanceProfileName = instanceProfileName | ||
| ?: AwsSdkSetting.AwsEc2InstanceProfileName.resolve(platformProvider) | ||
|
|
||
| // FIXME This only resolves from env vars and sys props but we need to resolve from profiles too | ||
| private val providerDisabled = AwsSdkSetting.AwsEc2MetadataDisabled.resolve(platformProvider) == true | ||
|
|
||
| /** | ||
| * Tracks the known-good version of IMDS APIs available in the local environment. This starts as `null` and will be | ||
| * updated after the first successful API call. | ||
| */ | ||
| private var apiVersion: ApiVersion? = null | ||
|
|
||
| private val urlBase: String | ||
| get() = (apiVersion ?: ApiVersion.EXTENDED).urlBase | ||
|
|
||
| private var previousCredentials: Credentials? = null | ||
|
|
||
| /** | ||
| * Tracks the instance profile name resolved from IMDS. This starts as `null` and will be updated after a | ||
| * successful API call. Note that if [instanceProfileName] is set, profile name resolution will be skipped. | ||
| */ | ||
| private var resolvedProfileName: String? = null | ||
|
|
||
| /** | ||
| * A deduplicator for resolving credentials and tracking mutable state about IMDS | ||
| */ | ||
| private val sfg = SingleFlightGroup<Credentials>() | ||
|
|
||
| override suspend fun resolve(attributes: Attributes): Credentials = sfg.singleFlight { resolveUnderLock() } | ||
|
|
||
| private suspend fun resolveUnderLock(): Credentials { | ||
|
||
| println("**** Resolving creds (instanceProfileName=$instanceProfileName; apiVersion=$apiVersion; urlBase=$urlBase)") | ||
|
||
|
|
||
| if (providerDisabled) { | ||
| println("**** Explicitly disabled") | ||
| throw CredentialsNotLoadedException("AWS EC2 metadata is explicitly disabled; credentials not loaded") | ||
| } | ||
|
|
||
| val profileName = instanceProfileName ?: resolvedProfileName ?: try { | ||
| println("**** Resolving profile") | ||
| client.get(urlBase).also { | ||
| if (apiVersion == null) { | ||
| // Tried EXTENDED and it worked; remember that for the future | ||
| apiVersion = ApiVersion.EXTENDED | ||
| } | ||
| } | ||
| } catch (ex: EC2MetadataError) { | ||
| when { | ||
| apiVersion == null && ex.statusCode == HttpStatusCode.NotFound -> { | ||
| // Tried EXTENDED and that didn't work; fallback to LEGACY | ||
| apiVersion = ApiVersion.LEGACY | ||
| return resolveUnderLock() | ||
| } | ||
|
|
||
| ex.statusCode == HttpStatusCode.NotFound -> { | ||
| coroutineContext.info<ImdsCredentialsProvider> { | ||
| "Received 404 when loading profile name. This instance may not have an associated profile." | ||
| } | ||
| throw ex | ||
| } | ||
|
|
||
| else -> return usePreviousCredentials() | ||
| ?: throw ImdsProfileException(ex).wrapAsCredentialsProviderException() | ||
| } | ||
| } catch (ex: IOException) { | ||
| return usePreviousCredentials() ?: throw ImdsProfileException(ex).wrapAsCredentialsProviderException() | ||
| } catch (ex: Exception) { | ||
| throw ImdsProfileException(ex).wrapAsCredentialsProviderException() | ||
| } | ||
|
|
||
| val credsPayload = try { | ||
| client.get("$urlBase$profileName") | ||
| } catch (ex: EC2MetadataError) { | ||
| when { | ||
| apiVersion == null && ex.statusCode == HttpStatusCode.NotFound -> { | ||
| // Tried EXTENDED and that didn't work; fallback to LEGACY | ||
| apiVersion = ApiVersion.LEGACY | ||
| return resolveUnderLock() | ||
| } | ||
|
|
||
| instanceProfileName == null && ex.statusCode == HttpStatusCode.NotFound -> { | ||
| // A previously-resolved profile is now invalid; forget the resolved name and re-resolve | ||
| resolvedProfileName = null | ||
| return resolveUnderLock() | ||
| } | ||
|
|
||
| else -> return usePreviousCredentials() | ||
| ?: throw ImdsCredentialsException(profileName, ex).wrapAsCredentialsProviderException() | ||
| } | ||
| } catch (ex: IOException) { | ||
| return usePreviousCredentials() | ||
| ?: throw ImdsCredentialsException(profileName, ex).wrapAsCredentialsProviderException() | ||
| } catch (ex: Exception) { | ||
| throw ImdsCredentialsException(profileName, ex).wrapAsCredentialsProviderException() | ||
| } | ||
|
|
||
| if (instanceProfileName == null) { | ||
| // No profile name was provided at construction time; cache the resolved name | ||
| resolvedProfileName = profileName | ||
| } | ||
|
|
||
| val deserializer = JsonDeserializer(credsPayload.encodeToByteArray()) | ||
|
|
||
| return when (val resp = deserializeJsonCredentials(deserializer)) { | ||
| is JsonCredentialsResponse.SessionCredentials -> { | ||
|
Comment on lines
-94
to
-100
Member
There was a problem hiding this comment. Are we intentionally dropping this HOSM / static stability behavior?
Contributor
Author
There was a problem hiding this comment. No, we still mostly support the requirements of the static stability spec. This change removes some of the messaging around expiry but we'll still attempt to use expired credentials as required. We should update the
Member
There was a problem hiding this comment. The static stability SEP says we MUST log a message when using expired credentials |
||
| val creds = credentials( | ||
| resp.accessKeyId, | ||
| resp.secretAccessKey, | ||
| resp.sessionToken, | ||
| resp.expiration, | ||
| PROVIDER_NAME, | ||
| resp.accountId, | ||
| ).withBusinessMetric(AwsBusinessMetric.Credentials.CREDENTIALS_IMDS) | ||
|
|
||
| creds.also { previousCredentials = it } | ||
| } | ||
| is JsonCredentialsResponse.Error -> when (resp.code) { | ||
| CODE_ASSUME_ROLE_UNAUTHORIZED_ACCESS -> throw ProviderConfigurationException("Incorrect IMDS/IAM configuration: [${resp.code}] ${resp.message}. Hint: Does this role have a trust relationship with EC2?") | ||
| else -> throw CredentialsProviderException("Error retrieving credentials from IMDS: code=${resp.code}; ${resp.message}") | ||
| } | ||
| } | ||
| } | ||
|
|
||
| override fun close() { | ||
| if (manageClient) { | ||
| client.close() | ||
| } | ||
| } | ||
|
|
||
| private suspend fun usePreviousCredentials(): Credentials? = | ||
| previousCredentials?.apply { | ||
| coroutineContext.info<ImdsCredentialsProvider> { | ||
| "Attempting to reuse previously-fetched credentials (expiration = $expiration)" | ||
| } | ||
| } | ||
|
|
||
| override fun toString(): String = this.simpleClassName | ||
|
|
||
| /** | ||
| * Identifies different versions of IMDS APIs for fetching credentials | ||
| */ | ||
| private enum class ApiVersion(val urlBase: String) { | ||
| /** | ||
| * The original, now-deprecated API | ||
| */ | ||
| LEGACY("/latest/meta-data/iam/security-credentials/"), | ||
|
|
||
| /** | ||
| * The new API which provides `AccountId` and potentially other fields in the future | ||
| */ | ||
| EXTENDED("/latest/meta-data/iam/security-credentials-extended/"), | ||
| } | ||
| } | ||
|
|
||
| internal class ImdsCredentialsException( | ||
| profileName: String, | ||
| cause: Throwable, | ||
| ) : RuntimeException("Failed to load credentials for EC2 instance profile \"$profileName\"", cause) | ||
|
|
||
| internal class ImdsProfileException(cause: Throwable) : RuntimeException("Failed to load instance profile name", cause) | ||
|
|
||
| private fun Throwable.wrapAsCredentialsProviderException() = | ||
| CredentialsProviderException(message.orEmpty(), this) | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we be closing this
ImdsClientthat the default chain creates?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, we should be! Will fix.