-
Notifications
You must be signed in to change notification settings - Fork 95
Open
Description
The refreshable credential providers do not guarantee atomic reads of all three credential fields (access key, secret access key, and session token).
Using InstanceProfileV2 as an example, though the issue is present in all of the refreshable providers. Each credential field accessor performs _refresh before returning the field value. Though rare, it would be possible for a caller to retrieve some fields from one refresh, trigger a refresh, and then retrieve the other fields from that second refresh.
I think the three accessors should be replaced with a single accessor which performs a refresh and then materialises the components into a single return value.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels