feat(identity): add STS credential management #1846

liramon1 · 2025-07-08T13:56:31Z

Problem

The identity LSP does not support retrieving IAM role credentials. This forces IDE extensions to implement IAM credentials retrieval, which leads to code duplication and added complexity.

Solution

This is part of #1981 and is built on top of #1869.

This PR adds the option to assume a role and generate STS credentials if the language client requests an IAM credential using a RoleSourceProfile. After the STS credential is generated, the identity LSP caches it into .aws/cli/cache and manages its lifecycle, including expiration, invalidation, and refresh.

Note: This PR currently fails the CI pipeline because it depends on changes from aws/language-server-runtimes#599.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

floralph · 2025-07-19T22:25:35Z

server/aws-lsp-identity/src/iam/iamProvider.ts

+import { IamFlowParams, simulatePermissions } from './utils'
+import { createHash } from 'crypto'
+
+const sourceProfileRecursionMax = 5


Is recursion of source profiles even allowed? How do the CLI and SDK handle this?

Yes, source profile recursion/chaining is allowed according to this assume-role SEP

floralph · 2025-07-19T22:29:15Z

server/aws-lsp-identity/src/iam/iamProvider.ts

+                const key = JSON.stringify({
+                    RoleArn: params.profile.settings?.role_arn,
+                    RoleSessionName: params.profile.settings?.role_session_name,
+                    SerialNumber: params.profile.settings?.mfa_serial,


Minor nit: Keep the name as MfaSerial as it is more descriptive and immediately indicative of what this field contains. Unless the SEP prescribed this name.

The disk-cache SEP prescribed the name SerialNumber

floralph · 2025-07-19T22:44:10Z

server/aws-lsp-identity/src/iam/iamProvider.ts

+        try {
+            const parentCredentials = await this.getParentCredential(params)
+            const stsClient = new STSClient({
+                region: params.profile.settings?.region || 'us-east-1',


Please make 'us-east-1' a const defined at the class level instead of a magic string. Also, since this logic is used in multiple places, consider wrapping getting an STS client in a function and using that throughout the code.

floralph · 2025-07-19T22:53:39Z

server/aws-lsp-identity/src/iam/iamProvider.ts

+    AwsErrorCodes,
+    IamCredential,
+    IamCredentialId,
+    IamCredentials,


Why is there an IamCredential and IamCredentials types? This will be confusing.

There is a similar naming issue with SSOToken and SsoToken I think, which was due to SSOToken being a type imported from a 3rd-party package. Is that the case here as well?

The IamCredential is supposed to be a wrapper object for an id, profile kind, and IamCredentials as suggested in this comment, but I was struggling to come up with a name for this. Any naming suggestions would be appreciated.

I see:

Check failure on line 3 in server/aws-lsp-identity/src/iam/iamProvider.ts GitHub Actions / Test public NPM packages '"@aws/language-server-runtimes/server-interface"' has no exported member named 'IamCredential'. Did you mean 'IamCredentials'?

Maybe this isn't an issue and IamCredential doesn't exist and shouldn't have been imported here? If it does exist, where is it? I couldn't find it in language-server-runtimes.

IamCredential is defined in this PR. It was added after the previous runtimes PR was approved, so it's not on the main runtimes branch yet.

floralph · 2025-07-21T20:58:43Z

server/aws-lsp-identity/src/iam/utils.ts

+    const stsClient = new STSClient({ region: region || 'us-east-1', credentials: credentials })
+    const identity = await stsClient.send(new GetCallerIdentityCommand({}))
+    if (!identity.Arn) {
+        throw new AwsError('Caller identity ARN not found.', AwsErrorCodes.E_INVALID_PROFILE)


This isn't an invalid profile, is there an existing or can you create a new error code specific to this error? Also, the more places an error code is reused in the code base, the less useful it becomes for debugging later. The intent of the error codes is a concrete value that can be kept overtime, even as the error messages may evolve. In the absence of error codes, people would attempt to string match on the error message which is extremely fragile.

floralph · 2025-07-22T02:23:49Z

server/aws-lsp-identity/src/sts/cache/fileSystemStsCache.ts

+        })
+    }
+
+    private ignoreDoesNotExistOrThrow(error: unknown): Promise<undefined> {


I think this is in the SSO variant of this file as well. If so, consider putting in a common utils library in aws-lsp-core.

This uses a different error message and error code.

floralph · 2025-07-22T02:24:39Z

server/aws-lsp-identity/src/sts/cache/fileSystemStsCache.ts

+// Based on:
+// https://github.com/smithy-lang/smithy-typescript/blob/main/packages/shared-ini-file-loader/src/getSSOTokenFilepath.ts
+export function getStsCredentialFilepath(id: string): string {
+    return join(getHomeDir(), '.aws', 'flare', 'cache', `${id}.json`)


Let's be sure "flare" is the correct name here. I'll ping you with further details.

floralph · 2025-07-22T02:27:25Z

server/aws-lsp-identity/src/sts/cache/fileSystemStsCache.ts

+}
+
+// Based on:
+// https://github.com/smithy-lang/smithy-typescript/blob/main/packages/shared-ini-file-loader/src/getSSOTokenFromFile.ts


Speaking of this, did you check the AWS SDK for JS to see if there were already functions for reading/writing STS cache files? Or see what AWS CLI code is using to do this? There might be reusable code already.

I did not see any STS cache functions inside of @aws-sdk and @smithy/shared-ini-file-loader. I'm not sure if this is the primary AWS CLI credentials code, but it only references .aws for the SSO cache.

floralph · 2025-07-22T02:32:57Z

server/aws-lsp-identity/src/sts/cache/refreshingStsCache.ts

+
+        // Check if credential is still valid (not in refresh window)
+        if (nowMillis < expirationMillis) {
+            this.observability.logging.log('STS credential before refresh window.  Returning current STS credential.')


Are these log messages and comments here consistent with what is happening? Is this how they're written in the SSO counterpart to this class? Seems a bit off.

This is how it's written in the SSO counterpart. I could change the message to 'STS credential expiration is before...' and do something similar for SSO.

It looks like it's the refresh window handling for SSO. Is that how the SEP defines handling it (e.g. try 5 minutes before at a rate of no more than every 20 or 30 seconds) for STS as well?

I could not find a SEP for STS/temporary credential refresh, so I'm not sure.

floralph · 2025-07-22T02:33:31Z

server/aws-lsp-identity/src/sts/stsAutoRefresher.ts

+
+            let delayMs: number
+
+            if (nowMillis < expirationMillis - refreshWindowMillis) {


Was there a SEP specifically for STS creds refresh handling or did you just duplicate the SSO handling? If so, there is an opportunity for a base class here as there is some complicated code here that we shouldn't copy/paste reuse or it will likely lead to inconsistency/bugs in the future.

This was duplicated from SSO handling. Sure, I can refactor this.

liramon1 · 2025-07-22T21:27:36Z

server/aws-lsp-identity/src/sts/stsAutoRefresher.ts

+                        stsCredentialDetail.lastRefreshMillis = Date.now()
+
+                        // Passing refresh function into here is easier than refreshing from STS cache
+                        const newCredentials = await refreshCallback()


It's a bit easier to pass refreshCallback into watch instead of the STS cache with the current setup, since generateStsCredential is tightly coupled with iamProvider. Moving refreshCallback to STS cache would make it closer to the SSO implementation, but requires generateStsCredential to be a util function and uncoupled from iamProvider.

floralph

Given the changes being made to the existing SSO flow, be sure this functionality is all evaluated in amazon-q-eclipse as well.

floralph · 2025-07-23T20:37:28Z

server/aws-lsp-identity/src/iam/iamProvider.ts

+    AwsErrorCodes,
+    IamCredential,
+    IamCredentialId,
+    IamCredentials,


I see:

Check failure on line 3 in server/aws-lsp-identity/src/iam/iamProvider.ts GitHub Actions / Test public NPM packages '"@aws/language-server-runtimes/server-interface"' has no exported member named 'IamCredential'. Did you mean 'IamCredentials'?

Maybe this isn't an issue and IamCredential doesn't exist and shouldn't have been imported here? If it does exist, where is it? I couldn't find it in language-server-runtimes.

floralph · 2025-07-23T20:46:36Z

server/aws-lsp-identity/src/sts/cache/refreshingStsCache.ts

+
+        // Check if credential is still valid (not in refresh window)
+        if (nowMillis < expirationMillis) {
+            this.observability.logging.log('STS credential before refresh window.  Returning current STS credential.')


It looks like it's the refresh window handling for SSO. Is that how the SEP defines handling it (e.g. try 5 minutes before at a rate of no more than every 20 or 30 seconds) for STS as well?

floralph · 2025-07-23T20:50:45Z

server/aws-lsp-identity/src/iam/iamProvider.ts

-        } catch (e) {
-            this.sourceProfileRecursionCount = 0
-            throw e
+        // Get the credentials directly from the profile


Just to be sure, the intent here is that if a profile has both creds defined in it and a sourceProfile listed, you would prioritize using the creds provided and ignore the sourceProfile, correct?

Yes, it should prioritize the profile creds over the sourceProfile.

floralph · 2025-07-23T20:53:24Z

server/aws-lsp-identity/src/iam/utils.ts

+    return response.EvaluationResults.every(result => result.EvalDecision === 'allowed')
+}
+
+export async function checkMfaRequired(


Shouldn't permissions be hard-coded as sts:AssumeRole instead of passed in? Shouldn't this call validatePermissions instead of duplicating the code? If the latter, is the function needed or should you just call validatePermissions from iamProvider.ts directly above (passing in sts:AssumeRole)?

This is slightly different because it checks whether the MFA condition is present on any permission instead of whether access is granted. Hardcoding sts:AssumeRole would achieve the same outcome for now, but would not let you check MFA on other permissions if that was needed in the future.

floralph · 2025-07-23T21:02:21Z

server/aws-lsp-identity/src/iam/utils.ts

+    credentials: IamCredentials,
+    permissions: string[],
+    region?: string
+): Promise<SimulatePrincipalPolicyCommandOutput> {


Is there an intended change to the return type here?

floralph · 2025-07-23T21:03:54Z

server/aws-lsp-identity/src/iam/utils.ts

 ): Promise<SimulatePrincipalPolicyCommandOutput> {
    // Convert the credentials into an identity
-    const stsClient = new STSClient({ region: region || 'us-east-1', credentials: credentials })
+    const stsClient = new STSClient({ region: region, credentials: credentials })


Why not keep the region || defaultRegion in place? Did tsc complain since region: string is no longer optional?

I thought it was cleaner to make it a default argument. I can revert this if needed.

floralph · 2025-07-23T21:04:18Z

server/aws-lsp-identity/src/iam/utils.ts

    }

    // Simulate permissions on the identity
-    const iamClient = new IAMClient({ region: region || 'us-east-1', credentials: credentials })
+    const iamClient = new IAMClient({ region: region, credentials: credentials })


Same as above about defaulting to defaultRegion handling.

## Problem The IAM type changes are behind the changes in aws/language-servers#1869 and aws/language-servers#1846. As a result, the language-servers PRs are unable to compile. ## Solution This is part of #572. - Rename validatePermissions to permissionSets and make it accept a list of permissions instead of validating only 1 set of permissions - Wrap credentials from getIamCredentialResult into an intermediate object - Add credentials override and additional error codes to getIamCredentials - Add mfaSerial to GetMfaSerialResult and optionalize it in GetMfaSerialParams  ## License By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…ode in lambda

liramon1 requested a review from a team as a code owner July 8, 2025 13:56

liramon1 mentioned this pull request Jul 8, 2025

feat: add support for IAM/STS credentials management #1685

Closed

liramon1 marked this pull request as draft July 9, 2025 19:52

liramon1 force-pushed the sts-credentials branch from 74ebd75 to 29724b6 Compare July 10, 2025 21:49

liramon1 mentioned this pull request Jul 16, 2025

feat(identity): add STS credential management liramon1/language-servers#2

Open

liramon1 changed the base branch from main to liramon/flare-iam July 16, 2025 18:53

liramon1 deleted the branch aws:liramon/flare-iam-base July 16, 2025 18:57

liramon1 closed this Jul 16, 2025

liramon1 reopened this Jul 16, 2025

liramon1 changed the base branch from liramon/flare-iam to feature/flare-iam-base July 16, 2025 19:01

liramon1 force-pushed the sts-credentials branch from 57cd7e7 to 1d30f5e Compare July 16, 2025 19:12

liramon1 marked this pull request as ready for review July 18, 2025 15:18

liramon1 mentioned this pull request Jul 18, 2025

feat: add IAM credentials authentication #1936

Closed

floralph reviewed Jul 22, 2025

View reviewed changes

liramon1 commented Jul 22, 2025

View reviewed changes

floralph reviewed Jul 23, 2025

View reviewed changes

liramon1 changed the base branch from feature/flare-iam-base to liramon/flare-iam-base July 24, 2025 22:47

liramon1 mentioned this pull request Jul 24, 2025

feat: add IAM credentials authentication #1981

Draft

liramon1 force-pushed the sts-credentials branch from 35d8bd1 to 7a8e61a Compare July 25, 2025 14:07

liramon1 force-pushed the liramon/flare-iam-base branch 4 times, most recently from 4f5fc2d to d093e42 Compare July 25, 2025 18:10

liramon1 mentioned this pull request Jul 28, 2025

refactor: sync types with IAM authentication changes aws/language-server-runtimes#626

Merged

liramon1 force-pushed the liramon/flare-iam-base branch 3 times, most recently from 82eeaf9 to e96e1c1 Compare July 28, 2025 20:07

liramon1 force-pushed the sts-credentials branch from 7a8e61a to 48a1bc5 Compare July 29, 2025 13:38

liramon1 force-pushed the sts-credentials branch from 74e9e70 to 99f379d Compare July 29, 2025 19:10

liramon1 added 25 commits July 30, 2025 14:06

fix: remove dummy settings from unknown profiles and wrap sendGetMfaC…

d9756d0

…ode in lambda

feat(identity): add support for IAM profile kinds

fd14234

feat(identity): add support for assumed role credentials

1c93d34

refactor: prefix IAM-related profiles with 'Iam'

8cc0c7e

refactor: move profile fields into profileTypes object

8e401ec

refactor: move parent credentials logic into generateStsCredentials

21dda33

fix: check source profile instead of original profile

7101c99

feat: allow any IAM profile type to be used as source profile

a8f5a6c

refactor: move MFA code retrieval into separate request

27c78de

fix: add timeout to mfa request

f1e7c48

fix: add parameters to mfa request

c959675

fix: incorporate PR feedback

127fd3b

refactor: move unit tests from identityService to iamProvider

2b76c0d

fix: clear MFA timeout

471c644

fix: make STS changes compliant with disk-cache SEP

55f58f3

fix: remove unnecessary logs

228dbad

fix: remove dummy settings from unknown profiles and wrap sendGetMfaC…

5cb8876

…ode in lambda

fix: use profile session name if it exists

4f2bb03

fix: incorporate STS PR feedback

d977004

refactor: move common auto refresh logic into AutoRefresher class

023dac1

refactor: move recursion count from IAM provider to IAM flow params

2920ee9

fix: revert unnecessary changes

a8c23cd

fix: request MFA serial number from client and revert minor change

2a8afee

fix: update profile after prompting MFA serial

a91c5f3

fix: incorporate STS feedback

9345d1d

liramon1 force-pushed the sts-credentials branch from f06d8a6 to 9345d1d Compare July 30, 2025 18:07

awschristou approved these changes Jul 30, 2025

View reviewed changes

liramon1 merged commit 776a609 into aws:liramon/flare-iam-base Jul 31, 2025

liramon1 added a commit that referenced this pull request Jul 31, 2025

feat(identity): add STS credential management (#1846)

8f1c33a

liramon1 added a commit that referenced this pull request Aug 1, 2025

feat(identity): add STS credential management (#1846)

482dabf


		let delayMs: number

		if (nowMillis < expirationMillis - refreshWindowMillis) {

feat(identity): add STS credential management #1846

feat(identity): add STS credential management #1846

Uh oh!

Conversation

liramon1 commented Jul 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

License

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 22, 2025 • edited by floralph Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 22, 2025 • edited by floralph Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

floralph left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

liramon1 commented Jul 8, 2025 •

edited

Loading

liramon1 Jul 22, 2025 •

edited by floralph

Loading

liramon1 Jul 22, 2025 •

edited by floralph

Loading

liramon1 Jul 22, 2025 •

edited

Loading

liramon1 Jul 22, 2025 •

edited

Loading