|
| 1 | +import { Credentials, Provider } from "@aws-sdk/types"; |
| 2 | + |
| 3 | +import { AssumeRoleCommand, AssumeRoleCommandInput } from "./commands/AssumeRoleCommand"; |
| 4 | +import { |
| 5 | + AssumeRoleWithWebIdentityCommand, |
| 6 | + AssumeRoleWithWebIdentityCommandInput, |
| 7 | +} from "./commands/AssumeRoleWithWebIdentityCommand"; |
| 8 | +import type { STSClient, STSClientConfig, STSClientResolvedConfig } from "./STSClient"; |
| 9 | + |
| 10 | +/** |
| 11 | + * @internal |
| 12 | + */ |
| 13 | +export type RoleAssumer = (sourceCreds: Credentials, params: AssumeRoleCommandInput) => Promise<Credentials>; |
| 14 | + |
| 15 | +const ASSUME_ROLE_DEFAULT_REGION = "us-east-1"; |
| 16 | + |
| 17 | +/** |
| 18 | + * Inject the fallback STS region of us-east-1. |
| 19 | + */ |
| 20 | +const decorateDefaultRegion = (region: string | Provider<string> | undefined): string | Provider<string> => { |
| 21 | + if (typeof region !== "function") { |
| 22 | + return region === undefined ? ASSUME_ROLE_DEFAULT_REGION : region; |
| 23 | + } |
| 24 | + return async () => { |
| 25 | + try { |
| 26 | + return await region(); |
| 27 | + } catch (e) { |
| 28 | + return ASSUME_ROLE_DEFAULT_REGION; |
| 29 | + } |
| 30 | + }; |
| 31 | +}; |
| 32 | + |
| 33 | +/** |
| 34 | + * The default role assumer that used by credential providers when sts:AssumeRole API is needed. |
| 35 | + * @internal |
| 36 | + */ |
| 37 | +export const getDefaultRoleAssumer = ( |
| 38 | + stsOptions: Pick<STSClientConfig, "logger" | "region">, |
| 39 | + stsClientCtor: new (options: STSClientConfig) => STSClient |
| 40 | +): RoleAssumer => { |
| 41 | + let stsClient: STSClient; |
| 42 | + return async (sourceCreds, params) => { |
| 43 | + if (!stsClient) { |
| 44 | + const { logger, region } = stsOptions; |
| 45 | + stsClient = new stsClientCtor({ |
| 46 | + logger, |
| 47 | + credentials: sourceCreds, |
| 48 | + region: decorateDefaultRegion(region), |
| 49 | + }); |
| 50 | + } |
| 51 | + const { Credentials } = await stsClient.send(new AssumeRoleCommand(params)); |
| 52 | + if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) { |
| 53 | + throw new Error(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`); |
| 54 | + } |
| 55 | + return { |
| 56 | + accessKeyId: Credentials.AccessKeyId, |
| 57 | + secretAccessKey: Credentials.SecretAccessKey, |
| 58 | + sessionToken: Credentials.SessionToken, |
| 59 | + expiration: Credentials.Expiration, |
| 60 | + }; |
| 61 | + }; |
| 62 | +}; |
| 63 | + |
| 64 | +/** |
| 65 | + * @internal |
| 66 | + */ |
| 67 | +export type RoleAssumerWithWebIdentity = (params: AssumeRoleWithWebIdentityCommandInput) => Promise<Credentials>; |
| 68 | + |
| 69 | +/** |
| 70 | + * The default role assumer that used by credential providers when sts:AssumeRoleWithWebIdentity API is needed. |
| 71 | + * @internal |
| 72 | + */ |
| 73 | +export const getDefaultRoleAssumerWithWebIdentity = ( |
| 74 | + stsOptions: Pick<STSClientConfig, "logger" | "region">, |
| 75 | + stsClientCtor: new (options: STSClientConfig) => STSClient |
| 76 | +): RoleAssumerWithWebIdentity => { |
| 77 | + let stsClient: STSClient; |
| 78 | + return async (params) => { |
| 79 | + if (!stsClient) { |
| 80 | + const { logger, region } = stsOptions; |
| 81 | + stsClient = new stsClientCtor({ |
| 82 | + logger, |
| 83 | + region: decorateDefaultRegion(region), |
| 84 | + }); |
| 85 | + } |
| 86 | + const { Credentials } = await stsClient.send(new AssumeRoleWithWebIdentityCommand(params)); |
| 87 | + if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) { |
| 88 | + throw new Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${params.RoleArn}`); |
| 89 | + } |
| 90 | + return { |
| 91 | + accessKeyId: Credentials.AccessKeyId, |
| 92 | + secretAccessKey: Credentials.SecretAccessKey, |
| 93 | + sessionToken: Credentials.SessionToken, |
| 94 | + expiration: Credentials.Expiration, |
| 95 | + }; |
| 96 | + }; |
| 97 | +}; |
| 98 | + |
| 99 | +/** |
| 100 | + * @internal |
| 101 | + */ |
| 102 | +export type DefaultCredentialProvider = (input: any) => Provider<Credentials>; |
| 103 | + |
| 104 | +/** |
| 105 | + * The default credential providers depend STS client to assume role with desired API: sts:assumeRole, |
| 106 | + * sts:assumeRoleWithWebIdentity, etc. This function decorates the default credential provider with role assumers which |
| 107 | + * encapsulates the process of calling STS commands. This can only be imported by AWS client packages to avoid circular |
| 108 | + * dependencies. |
| 109 | + * |
| 110 | + * @internal |
| 111 | + */ |
| 112 | +export const decorateDefaultCredentialProvider = (provider: DefaultCredentialProvider): DefaultCredentialProvider => ( |
| 113 | + input: STSClientResolvedConfig |
| 114 | +) => |
| 115 | + provider({ |
| 116 | + roleAssumer: getDefaultRoleAssumer(input, input.stsClientCtor), |
| 117 | + roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity(input, input.stsClientCtor), |
| 118 | + ...input, |
| 119 | + }); |
0 commit comments