Skip to content

Commit 094c95c

Browse files
zoewanggzoewangg
committed
Merge branch 'master' into s3-tranfermaster
2 parents 332d8ea + 70eb379 commit 094c95c

File tree

16 files changed

+621
-8
lines changed

16 files changed

+621
-8
lines changed

‎.changes/next-release/bugfix-AWSSDKforJavav2-bbc8ecb.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"category": "AWS SDK for Java v2",
3+
"type": "bugfix",
4+
"description": "Fix the issue where the `content-length` set on the request is not honored for streaming operations."
5+
}

‎core/auth/src/main/java/software/amazon/awssdk/auth/credentials/WebIdentityTokenCredentialsProviderFactory.java

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/*
2+
* Copyright 2010-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.auth.credentials;
17+
18+
import software.amazon.awssdk.annotations.SdkProtectedApi;
19+
import software.amazon.awssdk.auth.credentials.internal.WebIdentityTokenCredentialProperties;
20+
import software.amazon.awssdk.profiles.Profile;
21+
22+
/**
23+
* A factory for {@link AwsCredentialsProvider}s that are derived from web identity tokens.
24+
*
25+
* Currently this is used to allow a {@link Profile} or environment variable configured with a role that should be assumed with
26+
* a web identity token to create a credentials provider via the
27+
* 'software.amazon.awssdk.services.sts.internal.StsWebIdentityCredentialsProviderFactory', assuming STS is on the classpath.
28+
*/
29+
@FunctionalInterface
30+
@SdkProtectedApi
31+
public interface WebIdentityTokenCredentialsProviderFactory {
32+
AwsCredentialsProvider create(WebIdentityTokenCredentialProperties credentialProperties);
33+
}

‎core/auth/src/main/java/software/amazon/awssdk/auth/credentials/WebIdentityTokenFileCredentialsProvider.java

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
/*
2+
* Copyright 2010-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.auth.credentials;
17+
18+
import static software.amazon.awssdk.utils.StringUtils.trim;
19+
20+
import java.nio.file.Path;
21+
import java.nio.file.Paths;
22+
import java.util.Optional;
23+
import software.amazon.awssdk.annotations.SdkPublicApi;
24+
import software.amazon.awssdk.auth.credentials.internal.WebIdentityCredentialsUtils;
25+
import software.amazon.awssdk.auth.credentials.internal.WebIdentityTokenCredentialProperties;
26+
import software.amazon.awssdk.core.SdkSystemSetting;
27+
import software.amazon.awssdk.utils.ToString;
28+
29+
/**
30+
* A credential provider that will read web identity token file path, aws role arn
31+
* and aws session name from system properties or environment variables for using
32+
* web identity token credentials with STS. Use of this credentials provider requires
33+
* the 'sts' module to be on the classpath.
34+
*/
35+
@SdkPublicApi
36+
public class WebIdentityTokenFileCredentialsProvider implements AwsCredentialsProvider {
37+
38+
private final AwsCredentialsProvider credentialsProvider;
39+
private final RuntimeException loadException;
40+
41+
private WebIdentityTokenFileCredentialsProvider(BuilderImpl builder) {
42+
AwsCredentialsProvider credentialsProvider = null;
43+
RuntimeException loadException = null;
44+
45+
try {
46+
Path webIdentityTokenFile =
47+
builder.webIdentityTokenFile != null ? builder.webIdentityTokenFile
48+
: Paths.get(trim(SdkSystemSetting.AWS_WEB_IDENTITY_TOKEN_FILE
49+
.getStringValueOrThrow()));
50+
51+
String roleArn = builder.roleArn != null ? builder.roleArn
52+
: trim(SdkSystemSetting.AWS_ROLE_ARN.getStringValueOrThrow());
53+
54+
Optional<String> roleSessionName =
55+
builder.roleSessionName != null ? Optional.of(builder.roleSessionName)
56+
: SdkSystemSetting.AWS_ROLE_SESSION_NAME.getStringValue();
57+
58+
WebIdentityTokenCredentialProperties credentialProperties =
59+
WebIdentityTokenCredentialProperties.builder()
60+
.roleArn(roleArn)
61+
.roleSessionName(roleSessionName.orElse(null))
62+
.webIdentityTokenFile(webIdentityTokenFile)
63+
.build();
64+
65+
credentialsProvider = WebIdentityCredentialsUtils.factory().create(credentialProperties);
66+
} catch (RuntimeException e) {
67+
// If we couldn't load the credentials provider for some reason, save an exception describing why. This exception
68+
// will only be raised on calls to getCredentials. We don't want to raise an exception here because it may be
69+
// expected (eg. in the default credential chain).
70+
loadException = e;
71+
}
72+
73+
this.loadException = loadException;
74+
this.credentialsProvider = credentialsProvider;
75+
}
76+
77+
public static WebIdentityTokenFileCredentialsProvider create() {
78+
79+
return WebIdentityTokenFileCredentialsProvider.builder().build();
80+
}
81+
82+
@Override
83+
public AwsCredentials resolveCredentials() {
84+
if (loadException != null) {
85+
throw loadException;
86+
}
87+
return credentialsProvider.resolveCredentials();
88+
}
89+
90+
public static Builder builder() {
91+
return new BuilderImpl();
92+
}
93+
94+
@Override
95+
public String toString() {
96+
return ToString.create("WebIdentityTokenCredentialsProvider");
97+
}
98+
99+
/**
100+
* A builder for creating a custom {@link WebIdentityTokenFileCredentialsProvider}.
101+
*/
102+
public interface Builder {
103+
104+
/**
105+
* Define the role arn that should be used by this credentials provider.
106+
*/
107+
Builder roleArn(String roleArn);
108+
109+
/**
110+
* Define the role session name that should be used by this credentials provider.
111+
*/
112+
Builder roleSessionName(String roleSessionName);
113+
114+
/**
115+
* Define the absolute path to the web identity token file that should be used by this credentials provider.
116+
*/
117+
Builder webIdentityTokenFile(Path webIdentityTokenFile);
118+
119+
/**
120+
* Create a {@link WebIdentityTokenFileCredentialsProvider} using the configuration applied to this builder.
121+
*/
122+
WebIdentityTokenFileCredentialsProvider build();
123+
}
124+
125+
static final class BuilderImpl implements Builder {
126+
private String roleArn;
127+
private String roleSessionName;
128+
private Path webIdentityTokenFile;
129+
130+
BuilderImpl() {
131+
}
132+
133+
@Override
134+
public Builder roleArn(String roleArn) {
135+
this.roleArn = roleArn;
136+
return this;
137+
}
138+
139+
public void setRoleArn(String roleArn) {
140+
roleArn(roleArn);
141+
}
142+
143+
@Override
144+
public Builder roleSessionName(String roleSessionName) {
145+
this.roleSessionName = roleSessionName;
146+
return this;
147+
}
148+
149+
public void setRoleSessionName(String roleSessionName) {
150+
roleSessionName(roleSessionName);
151+
}
152+
153+
@Override
154+
public Builder webIdentityTokenFile(Path webIdentityTokenFile) {
155+
this.webIdentityTokenFile = webIdentityTokenFile;
156+
return this;
157+
}
158+
159+
public void setwebIdentityTokenFile(Path webIdentityTokenFile) {
160+
webIdentityTokenFile(webIdentityTokenFile);
161+
}
162+
163+
@Override
164+
public WebIdentityTokenFileCredentialsProvider build() {
165+
return new WebIdentityTokenFileCredentialsProvider(this);
166+
}
167+
}
168+
}

‎core/auth/src/main/java/software/amazon/awssdk/auth/credentials/internal/ProfileCredentialsUtils.java

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
package software.amazon.awssdk.auth.credentials.internal;
1717

1818
import java.lang.reflect.InvocationTargetException;
19+
import java.nio.file.Path;
20+
import java.nio.file.Paths;
1921
import java.util.Arrays;
2022
import java.util.HashSet;
2123
import java.util.Map;
@@ -95,10 +97,16 @@ private Optional<AwsCredentialsProvider> credentialsProvider(Set<String> childre
9597
if (properties.containsKey(ProfileProperty.ROLE_ARN)) {
9698
boolean hasSourceProfile = properties.containsKey(ProfileProperty.SOURCE_PROFILE);
9799
boolean hasCredentialSource = properties.containsKey(ProfileProperty.CREDENTIAL_SOURCE);
100+
boolean hasWebIdentityTokenFile = properties.containsKey(ProfileProperty.WEB_IDENTITY_TOKEN_FILE);
101+
boolean hasRoleArn = properties.containsKey(ProfileProperty.ROLE_ARN);
98102
Validate.validState(!(hasSourceProfile && hasCredentialSource),
99103
"Invalid profile file: profile has both %s and %s.",
100104
ProfileProperty.SOURCE_PROFILE, ProfileProperty.CREDENTIAL_SOURCE);
101105

106+
if (hasWebIdentityTokenFile && hasRoleArn) {
107+
return Optional.ofNullable(roleAndWebIdentityTokenProfileCredentialsProvider());
108+
}
109+
102110
if (hasSourceProfile) {
103111
return Optional.ofNullable(roleAndSourceProfileBasedProfileCredentialsProvider(children));
104112
}
@@ -155,6 +163,23 @@ private AwsCredentialsProvider credentialProcessCredentialsProvider() {
155163
.build();
156164
}
157165

166+
private AwsCredentialsProvider roleAndWebIdentityTokenProfileCredentialsProvider() {
167+
requireProperties(ProfileProperty.ROLE_ARN, ProfileProperty.WEB_IDENTITY_TOKEN_FILE);
168+
169+
String roleArn = properties.get(ProfileProperty.ROLE_ARN);
170+
String roleSessionName = properties.get(ProfileProperty.ROLE_SESSION_NAME);
171+
Path webIdentityTokenFile = Paths.get(properties.get(ProfileProperty.WEB_IDENTITY_TOKEN_FILE));
172+
173+
WebIdentityTokenCredentialProperties credentialProperties =
174+
WebIdentityTokenCredentialProperties.builder()
175+
.roleArn(roleArn)
176+
.roleSessionName(roleSessionName)
177+
.webIdentityTokenFile(webIdentityTokenFile)
178+
.build();
179+
180+
return WebIdentityCredentialsUtils.factory().create(credentialProperties);
181+
}
182+
158183
/**
159184
* Load an assumed-role credentials provider that has been configured in this profile. This will attempt to locate the STS
160185
* module in order to generate the credentials provider. If it's not available, an illegal state exception will be raised.

‎core/auth/src/main/java/software/amazon/awssdk/auth/credentials/internal/WebIdentityCredentialsUtils.java

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*
2+
* Copyright 2010-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.auth.credentials.internal;
17+
18+
import java.lang.reflect.InvocationTargetException;
19+
import software.amazon.awssdk.annotations.SdkInternalApi;
20+
import software.amazon.awssdk.auth.credentials.WebIdentityTokenCredentialsProviderFactory;
21+
22+
/**
23+
* Utility class used to configure credential providers based on JWT web identity tokens.
24+
*/
25+
@SdkInternalApi
26+
public final class WebIdentityCredentialsUtils {
27+
28+
private static final String STS_WEB_IDENTITY_CREDENTIALS_PROVIDER_FACTORY =
29+
"software.amazon.awssdk.services.sts.internal.StsWebIdentityCredentialsProviderFactory";
30+
31+
private WebIdentityCredentialsUtils() {}
32+
33+
/**
34+
* Resolves the StsWebIdentityCredentialsProviderFactory from the Sts module if on the classpath to allow
35+
* JWT web identity tokens to be used as credentials.
36+
*
37+
* @return WebIdentityTokenCredentialsProviderFactory
38+
*/
39+
public static WebIdentityTokenCredentialsProviderFactory factory() {
40+
try {
41+
Class<?> stsCredentialsProviderFactory = Class.forName(STS_WEB_IDENTITY_CREDENTIALS_PROVIDER_FACTORY, true,
42+
Thread.currentThread().getContextClassLoader());
43+
return (WebIdentityTokenCredentialsProviderFactory) stsCredentialsProviderFactory.getConstructor().newInstance();
44+
} catch (ClassNotFoundException e) {
45+
throw new IllegalStateException("To use web identity tokens, the 'sts' service module must be on the class path.", e);
46+
} catch (NoSuchMethodException | InvocationTargetException | InstantiationException | IllegalAccessException e) {
47+
throw new IllegalStateException("Failed to create a web identity token credentials provider.", e);
48+
}
49+
}
50+
}

‎core/auth/src/main/java/software/amazon/awssdk/auth/credentials/internal/WebIdentityTokenCredentialProperties.java

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
/*
2+
* Copyright 2010-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.auth.credentials.internal;
17+
18+
import java.nio.file.Path;
19+
import software.amazon.awssdk.annotations.SdkProtectedApi;
20+
21+
/**
22+
* A container for credential properties.
23+
*/
24+
@SdkProtectedApi
25+
public class WebIdentityTokenCredentialProperties {
26+
27+
private final String roleArn;
28+
private final String roleSessionName;
29+
private final Path webIdentityTokenFile;
30+
31+
private WebIdentityTokenCredentialProperties(Builder builder) {
32+
this.roleArn = builder.roleArn;
33+
this.roleSessionName = builder.roleSessionName;
34+
this.webIdentityTokenFile = builder.webIdentityTokenFile;
35+
}
36+
37+
public String roleArn() {
38+
return roleArn;
39+
}
40+
41+
public String roleSessionName() {
42+
return roleSessionName;
43+
}
44+
45+
public Path webIdentityTokenFile() {
46+
return webIdentityTokenFile;
47+
}
48+
49+
public static Builder builder() {
50+
return new Builder();
51+
}
52+
53+
public static final class Builder {
54+
private String roleArn;
55+
private String roleSessionName;
56+
private Path webIdentityTokenFile;
57+
58+
public Builder roleArn(String roleArn) {
59+
this.roleArn = roleArn;
60+
return this;
61+
}
62+
63+
public Builder roleSessionName(String roleSessionName) {
64+
this.roleSessionName = roleSessionName;
65+
return this;
66+
}
67+
68+
public Builder webIdentityTokenFile(Path webIdentityTokenFile) {
69+
this.webIdentityTokenFile = webIdentityTokenFile;
70+
return this;
71+
}
72+
73+
public WebIdentityTokenCredentialProperties build() {
74+
return new WebIdentityTokenCredentialProperties(this);
75+
}
76+
}
77+
}

0 commit comments

Comments
 (0)