Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: default credentials provider chain order #1324

Closed
wants to merge 5 commits into from
+47 −3
Closed

fix: default credentials provider chain order #1324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
17bef20
fix: default credentials provider chain order
0marperez Jun 6, 2024
f973850
merge from main
0marperez Jun 28, 2024
519e26a
breaking change announcement
0marperez Jun 28, 2024
3303e53
rename announcement file to not break CI
0marperez Jun 28, 2024
bfcda86
misc: keep discussion draft up to date
0marperez Jul 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changes/2f25d21b-dda1-4189-ade3-d26de91899fb.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"id": "2f25d21b-dda1-4189-ade3-d26de91899fb",
"type": "bugfix",
"description": "Change order of profile and STS web identity credentials providers in default credentials provider chain"
}
6 changes: 3 additions & 3 deletions ...fig/common/src/aws/sdk/kotlin/runtime/auth/credentials/DefaultChainCredentialsProvider.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ import aws.smithy.kotlin.runtime.util.PlatformProvider
* Resolution order:
*
* 1. Environment variables ([EnvironmentCredentialsProvider])
* 2. Profile ([ProfileCredentialsProvider])
* 3. Web Identity Tokens ([StsWebIdentityCredentialsProvider]]
* 2. Web Identity Tokens ([StsWebIdentityCredentialsProvider]]
* 3. Profile ([ProfileCredentialsProvider])
* 4. ECS (IAM roles for tasks) ([EcsCredentialsProvider])
* 5. EC2 Instance Metadata (IMDSv2) ([ImdsCredentialsProvider])
*
Expand Down Expand Up @@ -54,9 +54,9 @@ public class DefaultChainCredentialsProvider constructor(
private val chain = CredentialsProviderChain(
SystemPropertyCredentialsProvider(platformProvider::getProperty),
EnvironmentCredentialsProvider(platformProvider::getenv),
ProfileCredentialsProvider(profileName = profileName, platformProvider = platformProvider, httpClient = engine, region = region),
// STS web identity provider can be constructed from either the profile OR 100% from the environment
StsWebIdentityProvider(platformProvider = platformProvider, httpClient = engine, region = region),
ProfileCredentialsProvider(profileName = profileName, platformProvider = platformProvider, httpClient = engine, region = region),
EcsCredentialsProvider(platformProvider, engine),
ImdsCredentialsProvider(
client = lazy {
Expand Down
39 changes: 39 additions & 0 deletions ...e/aws-config/common/src/aws/sdk/kotlin/runtime/auth/credentials/announcement.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
An upcoming release of the **AWS SDK for Kotlin** will change the order of credentials resolution for the [default credentials provider chain](https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/credential-providers.html#default-credential-provider-chain).

# Release date

This feature will ship with the **v1.3.x** release planned for **xx/xx/2024**.

# What's changing

The Kotlin SDK will be changing the order in which credentials are resolved when using the default credentials provider chain. If you don't use the default credentials provider chain, this change should not affect you.

If you _do_ use the default credentials provider chain, you will need to setup your credentials considering the new order of resolution along with your upgrade to AWS SDK for Kotlin **v1.3.x**.

The current resolution order is the following:

1. Environment variables
2. **_Shared credentials and config files_**
3. **_AWS STS web identity (including Amazon Elastic Kubernetes Service (Amazon EKS))_**
4. Amazon ECS container credentials
5. Amazon EC2 Instance Metadata Service

The new order will be:

1. Environment variables
2. **_AWS STS web identity (including Amazon Elastic Kubernetes Service (Amazon EKS))_**
3. **_Shared credentials and config files_**
4. Amazon ECS container credentials
5. Amazon EC2 Instance Metadata Service

The [default credentials provider chain documentation](https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/credential-providers.html#default-credential-provider-chain) contains more details on each credential source

# How to migrate

1. Upgrade all of your AWS SDK for Kotlin dependencies to **v.1.3.x**.
7. Verify that the changes to the default credentials provider chain didn't cause any issues for your program.
8. If there are issues make sure to look at the new order in which credentials are resolved and make changes as necessary.

# Feedback

If you have any questions concerning this change, please feel free to engage with us in this discussion. If you encounter a bug with these changes, please [file an issue](https://github.com/awslabs/aws-sdk-kotlin/issues/new/choose).
Loading