Skip to content

Refreshable credentials are not updated atomically #443

@keithduncan

Description

@keithduncan

The refreshable credential providers do not guarantee atomic reads of all three credential fields (access key, secret access key, and session token).

Using InstanceProfileV2 as an example, though the issue is present in all of the refreshable providers. Each credential field accessor performs _refresh before returning the field value. Though rare, it would be possible for a caller to retrieve some fields from one refresh, trigger a refresh, and then retrieve the other fields from that second refresh.

I think the three accessors should be replaced with a single accessor which performs a refresh and then materialises the components into a single return value.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions