Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
//

@_spi(FileBasedConfig) import AWSSDKCommon
import AWSSDKIdentity
@_spi(DefaultAWSCredentialIdentityResolverChain) import AWSSDKIdentity
import SmithyIdentity
import SmithyIdentityAPI
import struct ClientRuntime.DefaultSDKRuntimeConfiguration
Expand All @@ -28,10 +28,13 @@ public class AWSClientConfigDefaultsProvider: ClientConfigDefaultsProvider {
_ awsCredentialIdentityResolver: (any AWSCredentialIdentityResolver)? = nil
) throws -> any AWSCredentialIdentityResolver {
let resolvedAWSCredentialIdentityResolver: any AWSCredentialIdentityResolver
let fileBasedConfig = try CRTFileBasedConfiguration.make()
if let awsCredentialIdentityResolver {
resolvedAWSCredentialIdentityResolver = awsCredentialIdentityResolver
} else {
resolvedAWSCredentialIdentityResolver = DefaultAWSCredentialIdentityResolverChain()
resolvedAWSCredentialIdentityResolver = try DefaultAWSCredentialIdentityResolverChain(
fileBasedConfig: fileBasedConfig
)
}
return resolvedAWSCredentialIdentityResolver
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@ import class AwsCommonRuntimeKit.CredentialsProvider
import ClientRuntime
import protocol SmithyIdentity.AWSCredentialIdentityResolvedByCRT
@_spi(FileBasedConfig) import AWSSDKCommon
import protocol SmithyIdentity.AWSCredentialIdentityResolver
import struct Smithy.Attributes

// swiftlint:disable type_name
// ^ Required to mute swiftlint warning about type name being too long.
Expand All @@ -26,33 +24,21 @@ import struct Smithy.Attributes
/// 5. EC2 Instance Metadata (IMDSv2)
///
/// The credentials retrieved from the chain are cached for 15 minutes.
public struct DefaultAWSCredentialIdentityResolverChain: AWSCredentialIdentityResolver {
/// Creates a credential identity resolver that uses the default AWS credential identity resolver chain used by most AWS SDKs.
public init() {}

public func getIdentity(identityProperties: Attributes?) async throws -> AWSCredentialIdentity {
typealias ResolverFactory = () throws -> any AWSCredentialIdentityResolver

let resolverFactories: [ResolverFactory] = [
{ try EnvironmentAWSCredentialIdentityResolver() },
{ try ProfileAWSCredentialIdentityResolver() },
{ try STSWebIdentityAWSCredentialIdentityResolver() },
{ try ECSAWSCredentialIdentityResolver() },
{ try IMDSAWSCredentialIdentityResolver() }
]
public struct DefaultAWSCredentialIdentityResolverChain: AWSCredentialIdentityResolvedByCRT {
public let crtAWSCredentialIdentityResolver: AwsCommonRuntimeKit.CredentialsProvider

let lastIndex = resolverFactories.count - 1
for index in 0..<lastIndex {
do {
let resolver = try resolverFactories[index]()
return try await resolver.getIdentity(identityProperties: identityProperties)
} catch {
// Continue to the next resolver factory.
}
}
/// Creates a credential identity resolver that uses the default AWS credential identity resolver chain used by most AWS SDKs.
public init() throws {
let fileBasedConfig = try CRTFileBasedConfiguration()
try self.init(fileBasedConfig: fileBasedConfig)
}

// The error thrown from the last resolver is not caught and instead gets thrown to caller.
return try await resolverFactories[lastIndex]().getIdentity(identityProperties: identityProperties)
@_spi(DefaultAWSCredentialIdentityResolverChain)
public init(fileBasedConfig: CRTFileBasedConfiguration) throws {
self.crtAWSCredentialIdentityResolver = try AwsCommonRuntimeKit.CredentialsProvider(source: .defaultChain(
bootstrap: SDKDefaultIO.shared.clientBootstrap,
fileBasedConfiguration: fileBasedConfig
))
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ class DefaultAWSCredentialIdentityResolverChainTests: XCTestCase {
unsetenv("AWS_SECRET_ACCESS_KEY")
}

let subject = DefaultAWSCredentialIdentityResolverChain()
let subject = try DefaultAWSCredentialIdentityResolverChain()
let credentials = try await subject.getIdentity()

XCTAssertEqual(credentials.accessKey, "some_access_key_b")
Expand Down
Loading