33"""Workload‑identity attestation helpers.
44
55This module builds the attestation token that the Snowflake Python connector
6- sends when Authenticating with * Workload Identity Federation* (WIF).
7- It supports AWS, Azure, GCP and generic OIDC environments ** without** pulling
8- in heavy SDKs such as * botocore* – we only need a small presigned STS request
6+ sends when Authenticating with Workload Identity Federation (WIF).
7+ It supports AWS, Azure, GCP and generic OIDC environments without pulling
8+ in heavy SDKs such as botocore – we only need a small presigned STS request
99for AWS and a couple of metadata‑server calls for Azure / GCP.
1010"""
1111
@@ -66,7 +66,7 @@ def from_string(provider: str) -> AttestationProvider:
6666@dataclass
6767class WorkloadIdentityAttestation :
6868 provider : AttestationProvider
69- credential : str # ** base64** JSON blob – provider‑specific
69+ credential : str # base64 JSON blob – provider‑specific
7070 user_identifier_components : dict [str , Any ]
7171
7272
@@ -136,7 +136,7 @@ def _partition_from_region(region: str) -> AWSPartition:
136136
137137def _sts_host_from_region (region : str ) -> str | None :
138138 """
139- Construct the STS endpoint hostname for * region* according to the
139+ Construct the STS endpoint hostname for region according to the
140140 regionalised-STS rules published by AWS.:contentReference[oaicite:2]{index=2}
141141
142142 References:
@@ -173,8 +173,8 @@ def _try_get_arn_from_env_vars() -> str | None:
173173def try_compose_aws_user_identifier (region : str | None = None ) -> dict [str , str ]:
174174 """Return an identifier for the running AWS workload.
175175
176- Always includes the AWS * region* ; adds an *arn* key only if one is already
177- discoverable via common environment variables. Returns **{}** only if
176+ Always includes the AWS region; adds an *arn* key only if one is already
177+ discoverable via common environment variables. Returns {} only if
178178 the region cannot be determined."""
179179 region = region or get_region ()
180180 if not region :
@@ -189,7 +189,7 @@ def try_compose_aws_user_identifier(region: str | None = None) -> dict[str, str]
189189
190190
191191def create_aws_attestation () -> WorkloadIdentityAttestation | None :
192- """Return AWS attestation or * None* if we're not on AWS / creds missing."""
192+ """Return AWS attestation or None if we're not on AWS / creds missing."""
193193
194194 creds = load_default_credentials ()
195195 if not creds :
0 commit comments