-
Notifications
You must be signed in to change notification settings - Fork 49
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
misc: credentials search precedence change #1434
Merged
Merged
Changes from all commits
Commits
Show all changes
9 commits
Select commit
Hold shift + click to select a range
b426037
fix: credentials search precedence
0marperez 23e25d7
Changelogs
0marperez 6ef7a60
Breaking announcement temp
0marperez 15337bd
requiresMinorVersionBump set to true in changelog, StsWebIdentityProv…
0marperez a78d614
Self review
0marperez 0e77b6a
misc: add lazily initialized creds provider and use it in default cre…
0marperez ec792a5
Make providerName LazilyInitializedCredentialsProvider specific
0marperez 75e9644
Override toString() on every implementation of CredentialsProvider
0marperez de5dc7f
misc: credentials business metrics (#1442)
0marperez File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| { | ||
| "id": "0b5b53ab-70c0-4c1b-a445-8663ae86d6d1", | ||
| "type": "misc", | ||
| "description": "The order of credentials resolution in config files has been updated to: static credentials, assume role with source profile OR assume role with named provider, web identity token, SSO session, legacy SSO, process", | ||
| "requiresMinorVersionBump": true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| { | ||
| "id": "99a099e1-26c1-4ba1-b0d3-435609ea4e94", | ||
| "type": "misc", | ||
| "description": "The order of credentials resolution in the credentials provider chain has been updated to: system properties, environment variables, web identity tokens, profile, ECS, EC2", | ||
| "requiresMinorVersionBump": true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| An upcoming release of the **AWS SDK for Kotlin** will change the order of | ||
| credentials resolution for the [default credentials provider chain](https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/credential-providers.html#default-credential-provider-chain) | ||
| and the order of credentials resolution for AWS shared config files. | ||
|
|
||
| # Release date | ||
|
|
||
| This change will be included in the upcoming **v1.4.x** release, expected in the | ||
| upcoming months. | ||
|
|
||
| # What's changing | ||
|
|
||
| The order of credentials resolution for the default credentials provider chain, | ||
| and the order of credentials resolution for AWS shared config files (profile chain). | ||
|
|
||
| ## Default credentials provider chain | ||
|
|
||
| The table below outlines the current and new order in which the SDK will | ||
| resolve credentials from the default credentials provider chain. | ||
|
|
||
| | # | Current Order | New Order | | ||
| |---|------------------------------------------------------------------------|------------------------------------------------------------------------| | ||
| | 1 | System properties | System properties | | ||
| | 2 | Environment variables | Environment variables | | ||
| | 3 | **Shared credentials and config files (profile credentials provider)** | **Assume role with web identity token** | | ||
| | 4 | **Assume role with web identity token** | **Shared credentials and config files (profile credentials provider)** | | ||
| | 5 | Amazon ECS container credentials | Amazon ECS container credentials | | ||
| | 6 | Amazon EC2 Instance Metadata Service | Amazon EC2 Instance Metadata Service | | ||
|
|
||
| The [default credentials provider chain documentation](https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/credential-providers.html#default-credential-provider-chain) | ||
| contains more details on each credential source. | ||
|
|
||
| ## Profile chain | ||
|
|
||
| The table below outlines the current and new order in which the SDK will | ||
| resolve credentials from AWS shared config files. | ||
|
|
||
| | # | Current Order | New Order | | ||
| |---|----------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------| | ||
| | 1 | **Assume role with source profile OR assume role with named provider (mutually exclusive)** | **Static credentials** | | ||
| | 2 | Web identity token | **Assume role with source profile OR assume role with named provider (mutually exclusive)** | | ||
| | 3 | SSO session | Web identity token | | ||
| | 4 | Legacy SSO | SSO session | | ||
| | 5 | Process | Legacy SSO | | ||
| | 6 | **Static credentials (moves up to #1 when in a source profile, shifting other credential sources down)** | Process | | ||
|
|
||
| # How to migrate | ||
|
|
||
| 1. Upgrade all of your AWS SDK for Kotlin dependencies to **v.1.4.x**. | ||
| 2. Verify that the changes to the default credentials provider chain and profile chain do not introduce any issues in your program. | ||
| 3. If issues arise review the new credentials resolution order, the subsections below, and adjust your configuration as needed. | ||
|
|
||
| ## Default credentials provider chain | ||
|
|
||
| You can preserve the current default credentials provider chain behavior by setting | ||
| the credentials provider to a credentials provider chain with the current order, e.g. | ||
|
|
||
| ```kotlin | ||
| S3Client{ | ||
| credentialsProvider = CredentialsProviderChain( | ||
| SystemPropertyCredentialsProvider(), | ||
| EnvironmentCredentialsProvider(), | ||
| LazilyInitializedCredentialsProvider("EnvironmentStsWebIdentityCredentialsProvider") { | ||
| StsWebIdentityCredentialsProvider.fromEnvironment() | ||
| }, | ||
| ProfileCredentialsProvider(), | ||
| EcsCredentialsProvider(), | ||
| ImdsCredentialsProvider(), | ||
| ) | ||
| } | ||
| ``` | ||
|
|
||
| ## Profile credentials provider | ||
|
|
||
| The order in which credentials are resolved for shared credentials and config | ||
| files cannot be customized. If your AWS config file(s) contain multiple valid | ||
| credential sources within a single profile, you may need to update them to align | ||
| with the new resolution order. For example, config file `A` should be updated to | ||
| match config file `B`. This is necessary because static credentials will now | ||
| take precedence and be selected before assume role credentials with a source profile. | ||
| Similar adjustments to your configuration may be necessary to maintain current | ||
| behavior. Use the new order as a guide for any required changes. | ||
|
|
||
| Config file `A` | ||
| ```ini | ||
| [default] | ||
| role_arn = arn:aws:iam::123456789:role/Role | ||
| source_profile = A | ||
| aws_access_key_id = 0 | ||
| aws_secret_access_key = 0 | ||
|
|
||
| [profile A] | ||
| aws_access_key_id = 1 | ||
| aws_secret_access_key = 2 | ||
| ``` | ||
|
|
||
| Config file `B` | ||
| ```ini | ||
| [default] | ||
| role_arn = arn:aws:iam::123456789:role/Role | ||
| source_profile = A | ||
|
|
||
| [profile A] | ||
| aws_access_key_id = 1 | ||
| aws_secret_access_key = 2 | ||
| ``` | ||
|
|
||
| # Feedback | ||
|
|
||
| If you have any questions concerning this change, please feel free to engage | ||
| with us in this discussion. If you encounter a bug with these changes when | ||
| released, please [file an issue](https://github.com/awslabs/aws-sdk-kotlin/issues/new/choose). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
StsWebIdentityCredentialsProvideris already public, why do we need to make the wrapper class public too?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The wrapper delays any exceptions until
resolve()is called so it can be part of a credentials provider chain. Without the wrapper some exceptions are thrown outside of theresolve()call and not caught by the credentials provider chain.For example using the client below, if there's no valid env config for
StsWebIdentityCredentialsProvideran exception is thrown early.Instead of what we want:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tbh I think the name doesn't help, maybe we could call it
CredentialsChainStsWebIdentityProvideror something similarThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it's fine for the chain to fail early when users are manually configuring a custom chain. We just don't want it to fail early in the default chain because not every user will have a valid environment config
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we should avoid failing early in any credentials provider chain not just the default one. IMO a credentials provider chain is supposed to keep looking for credentials and only fail once the options are exhausted. If we fail early it could be seen as a bug.