aws-crt 0.1.9 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b529fd4fb2ec90269db3772a4f367f7484775a3fda180143a545c493c847815c
-  data.tar.gz: d6268d7de9cbb390515a8a1560e312f549e679acce53096de31f0424f6ffb90a
+  metadata.gz: 44902427f5ce75db6b6414579414b05c514914588d021710ba3b5ce0c844811e
+  data.tar.gz: 4157116893d5a8e0e3bec90f8322291922f75b23c88544b44205f5d47a627de0
 SHA512:
-  metadata.gz: d22f683451e7d44d25c0e9fae5913a158e506ef9dd04889c6673cc6151b166f6943441b158b954975a1356090c45e91bd5ad18c5cc142744b626f87c231df6ca
-  data.tar.gz: 8b9b9c1c6ab27fb1b6347f0d9742f5949e5154c209158e95d357472b4a98623d0b960aed81c3bf3b713a358d4c321bb0840984e359e263e2f509d8cdbe6b7fcf
+  metadata.gz: 778d81486f2e248d7deaa06dda65c6cfe5a26876948b06cd5b457dd473cf82d2ff98478de7287474bd03a7fbc7abcd1b7d879e088c7b81c6f5c2b3cdcff47922
+  data.tar.gz: c1a985a56a022896dcafab5fa4bb499da64a77e736dd8d58e340d32c4c004e3c5508ca4d813f930ccc924b9a728cf8a68c3250aac2c7fe22523a3b3b5fe4cc79

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+0.2.0 (2023-11-28)
+------------------
+
+* Feature - support sigv4-s3express signing.
+
 0.1.9 (2023-10-16)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-0.1.9
+0.2.0

data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/auth.h

@@ -49,6 +49,7 @@ enum aws_auth_errors {
     AWS_AUTH_SSO_TOKEN_INVALID,
     AWS_AUTH_SSO_TOKEN_EXPIRED,
     AWS_AUTH_CREDENTIALS_PROVIDER_SSO_SOURCE_FAILURE,
+    AWS_AUTH_IMDS_CLIENT_SOURCE_FAILURE,
 
     AWS_AUTH_ERROR_END_RANGE = AWS_ERROR_ENUM_END_RANGE(AWS_C_AUTH_PACKAGE_ID)
 };

data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/aws_imds_client.h

@@ -50,6 +50,11 @@ struct aws_imds_client_options {
      */
     enum aws_imds_protocol_version imds_version;
 
+    /*
+     * If true, fallback from v2 to v1 will be disabled for all cases
+     */
+    bool ec2_metadata_v1_disabled;
+
     /*
      * Table holding all cross-system functional dependencies for an imds client.
      *

data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/credentials.h

@@ -216,6 +216,11 @@ struct aws_credentials_provider_imds_options {
      */
     enum aws_imds_protocol_version imds_version;
 
+    /*
+     * If true, fallback from v2 to v1 will be disabled for all cases
+     */
+    bool ec2_metadata_v1_disabled;
+
     /* For mocking the http layer in tests, leave NULL otherwise */
     struct aws_auth_http_system_vtable *function_table;
 };

data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/private/aws_signing.h

@@ -109,6 +109,7 @@ AWS_AUTH_API extern const struct aws_string *g_aws_signing_credential_query_para
 AWS_AUTH_API extern const struct aws_string *g_aws_signing_date_name;
 AWS_AUTH_API extern const struct aws_string *g_aws_signing_signed_headers_query_param_name;
 AWS_AUTH_API extern const struct aws_string *g_aws_signing_security_token_name;
+AWS_AUTH_API extern const struct aws_string *g_aws_signing_s3session_token_name;
 AWS_AUTH_API extern const struct aws_string *g_signature_type_sigv4a_http_request;
 
 /**

data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/private/credentials_utils.h

@@ -68,6 +68,8 @@ struct aws_auth_http_system_vtable {
     aws_http_stream_release_fn *aws_http_stream_release;
 
     aws_http_connection_close_fn *aws_http_connection_close;
+
+    int (*aws_high_res_clock_get_ticks)(uint64_t *timestamp);
 };
 
 enum aws_parse_credentials_expiration_format {

data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/signing_config.h

@@ -39,6 +39,7 @@ struct aws_signing_config_base {
 enum aws_signing_algorithm {
     AWS_SIGNING_ALGORITHM_V4,
     AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC,
+    AWS_SIGNING_ALGORITHM_V4_S3EXPRESS,
 };
 
 /**

data/aws-crt-ffi/crt/aws-c-auth/source/auth.c

@@ -103,7 +103,9 @@ static struct aws_error_info s_errors[] = {
     AWS_DEFINE_ERROR_INFO_AUTH(
         AWS_AUTH_CREDENTIALS_PROVIDER_SSO_SOURCE_FAILURE,
         "Valid credentials could not be sourced by the sso credentials provider"),
-
+    AWS_DEFINE_ERROR_INFO_AUTH(
+        AWS_AUTH_IMDS_CLIENT_SOURCE_FAILURE,
+        "Failed to source the IMDS resource")
 };
 /* clang-format on */
 

data/aws-crt-ffi/crt/aws-c-auth/source/aws_imds_client.c

@@ -58,13 +58,16 @@ struct aws_imds_client {
     struct aws_retry_strategy *retry_strategy;
     const struct aws_auth_http_system_vtable *function_table;
     struct aws_imds_client_shutdown_options shutdown_options;
+
     /* will be set to true by default, means using IMDS V2 */
     bool token_required;
     struct aws_byte_buf cached_token;
+    uint64_t cached_token_expiration_timestamp;
     enum imds_token_state token_state;
     struct aws_linked_list pending_queries;
     struct aws_mutex token_lock;
     struct aws_condition_variable token_signal;
+    bool ec2_metadata_v1_disabled;
 
     struct aws_atomic_var ref_count;
 };
@@ -144,6 +147,7 @@ struct aws_imds_client *aws_imds_client_new(
     client->function_table =
         options->function_table ? options->function_table : g_aws_credentials_provider_http_function_table;
     client->token_required = options->imds_version == IMDS_PROTOCOL_V1 ? false : true;
+    client->ec2_metadata_v1_disabled = options->ec2_metadata_v1_disabled;
     client->shutdown_options = options->shutdown_options;
 
     struct aws_socket_options socket_options;
@@ -165,12 +169,6 @@ struct aws_imds_client *aws_imds_client_new(
     manager_options.shutdown_complete_callback = s_on_connection_manager_shutdown;
     manager_options.shutdown_complete_user_data = client;
 
-    struct aws_http_connection_monitoring_options monitor_options;
-    AWS_ZERO_STRUCT(monitor_options);
-    monitor_options.allowable_throughput_failure_interval_seconds = 1;
-    monitor_options.minimum_throughput_bytes_per_second = 1;
-    manager_options.monitoring_options = &monitor_options;
-
     client->connection_manager = client->function_table->aws_http_connection_manager_new(allocator, &manager_options);
     if (!client->connection_manager) {
         goto on_error;
@@ -221,7 +219,10 @@ struct imds_user_data {
      * will be adapted according to response.
      */
     bool imds_token_required;
+    /* Indicate the request is a fallback from a failure call. */
+    bool is_fallback_request;
     bool is_imds_token_request;
+    bool ec2_metadata_v1_disabled;
     int status_code;
     int error_code;
 
@@ -283,6 +284,7 @@ static struct imds_user_data *s_user_data_new(
     }
 
     wrapped_user_data->imds_token_required = client->token_required;
+    wrapped_user_data->ec2_metadata_v1_disabled = client->ec2_metadata_v1_disabled;
     aws_atomic_store_int(&wrapped_user_data->ref_count, 1);
     return wrapped_user_data;
 
@@ -319,8 +321,11 @@ static void s_reset_scratch_user_data(struct imds_user_data *user_data) {
 }
 
 static enum imds_token_copy_result s_copy_token_safely(struct imds_user_data *user_data);
-static void s_invalidate_cached_token_safely(struct imds_user_data *user_data);
-static bool s_update_token_safely(struct aws_imds_client *client, struct aws_byte_buf *token, bool token_required);
+static void s_update_token_safely(
+    struct aws_imds_client *client,
+    struct aws_byte_buf *token,
+    bool token_required,
+    uint64_t expire_timestamp);
 static void s_query_complete(struct imds_user_data *user_data);
 static void s_on_acquire_connection(struct aws_http_connection *connection, int error_code, void *user_data);
 static void s_on_retry_token_acquired(struct aws_retry_strategy *, int, struct aws_retry_token *, void *);
@@ -397,6 +402,8 @@ AWS_STATIC_STRING_FROM_LITERAL(s_imds_token_resource_path, "/latest/api/token");
 AWS_STATIC_STRING_FROM_LITERAL(s_imds_token_ttl_header, "x-aws-ec2-metadata-token-ttl-seconds");
 AWS_STATIC_STRING_FROM_LITERAL(s_imds_token_header, "x-aws-ec2-metadata-token");
 AWS_STATIC_STRING_FROM_LITERAL(s_imds_token_ttl_default_value, "21600");
+/* s_imds_token_ttl_default_value - 5secs for refreshing the cached token */
+static const uint64_t s_imds_token_ttl_secs = 21595;
 
 static void s_on_stream_complete_fn(struct aws_http_stream *stream, int error_code, void *user_data);
 
@@ -468,6 +475,7 @@ static int s_make_imds_http_query(
         .on_response_header_block_done = NULL,
         .on_response_body = s_on_incoming_body_fn,
         .on_complete = s_on_stream_complete_fn,
+        .response_first_byte_timeout_ms = 1000,
         .user_data = user_data,
         .request = request,
     };
@@ -497,25 +505,51 @@ on_error:
 static void s_client_on_token_response(struct imds_user_data *user_data) {
     /* Gets 400 means token is required but the request itself failed. */
     if (user_data->status_code == AWS_HTTP_STATUS_CODE_400_BAD_REQUEST) {
-        s_update_token_safely(user_data->client, NULL, true);
+        s_update_token_safely(user_data->client, NULL, true, 0 /*expire_timestamp*/);
         return;
     }
-    /*
-     * Other than that, if meets any error, then token is not required,
-     * we should fall back to insecure request. Otherwise, we should use
-     * token in following requests.
-     */
-    if (user_data->status_code != AWS_HTTP_STATUS_CODE_200_OK || user_data->current_result.len == 0) {
-        s_update_token_safely(user_data->client, NULL, false);
-    } else {
+
+    if (user_data->status_code == AWS_HTTP_STATUS_CODE_200_OK && user_data->current_result.len != 0) {
+        AWS_LOGF_DEBUG(AWS_LS_IMDS_CLIENT, "(id=%p) IMDS client has fetched the token", (void *)user_data->client);
+
         struct aws_byte_cursor cursor = aws_byte_cursor_from_buf(&(user_data->current_result));
         aws_byte_cursor_trim_pred(&cursor, aws_char_is_space);
         aws_byte_buf_reset(&user_data->imds_token, true /*zero contents*/);
         if (aws_byte_buf_append_and_update(&user_data->imds_token, &cursor)) {
-            s_update_token_safely(user_data->client, NULL, true);
+            s_update_token_safely(user_data->client, NULL /*token*/, true /*token_required*/, 0 /*expire_timestamp*/);
             return;
         }
-        s_update_token_safely(user_data->client, cursor.len == 0 ? NULL : &user_data->imds_token, cursor.len != 0);
+        /* The token was ALWAYS last for 6 hours, 21600 secs. Use current timestamp plus 21595 secs as the expiration
+         * timestamp for current token */
+        uint64_t current = 0;
+        user_data->client->function_table->aws_high_res_clock_get_ticks(&current);
+        uint64_t expire_timestamp = aws_add_u64_saturating(
+            current, aws_timestamp_convert(s_imds_token_ttl_secs, AWS_TIMESTAMP_SECS, AWS_TIMESTAMP_NANOS, NULL));
+
+        AWS_ASSERT(cursor.len != 0);
+        s_update_token_safely(user_data->client, &user_data->imds_token, true /*token_required*/, expire_timestamp);
+    } else if (user_data->ec2_metadata_v1_disabled) {
+        AWS_LOGF_DEBUG(
+            AWS_LS_IMDS_CLIENT,
+            "(id=%p) IMDS client failed to fetch token for requester %p, and fall back to v1 is disabled."
+            "Received response status code: %d",
+            (void *)user_data->client,
+            (void *)user_data,
+            user_data->status_code);
+        s_update_token_safely(user_data->client, NULL /*token*/, true /*token_required*/, 0 /*expire_timestamp*/);
+    } else {
+        /* Request failed; falling back to insecure request.
+         * TODO: The retryable error (503 throttle) will also fall back to v1. Instead, we should just resend the token
+         * request.
+         */
+        AWS_LOGF_DEBUG(
+            AWS_LS_IMDS_CLIENT,
+            "(id=%p) IMDS client failed to fetch token for requester %p, fall back to v1 for the same "
+            "requester. Received response status code: %d",
+            (void *)user_data->client,
+            (void *)user_data,
+            user_data->status_code);
+        s_update_token_safely(user_data->client, NULL /*token*/, false /* token_required*/, 0 /*expire_timestamp*/);
     }
 }
 
@@ -544,6 +578,7 @@ static void s_client_do_query_token(struct imds_user_data *user_data) {
     /* start query token for imds client */
     struct aws_byte_cursor uri = aws_byte_cursor_from_string(s_imds_token_resource_path);
 
+    /* Hard-coded 6 hour TTL for the token. */
     struct aws_http_header token_ttl_header = {
         .name = aws_byte_cursor_from_string(s_imds_token_ttl_header),
         .value = aws_byte_cursor_from_string(s_imds_token_ttl_default_value),
@@ -607,17 +642,50 @@ static void s_query_complete(struct imds_user_data *user_data) {
         return;
     }
 
-    /* In this case we fallback to the secure imds flow. */
     if (user_data->status_code == AWS_HTTP_STATUS_CODE_401_UNAUTHORIZED) {
-        s_invalidate_cached_token_safely(user_data);
-        s_reset_scratch_user_data(user_data);
-        aws_retry_token_release(user_data->retry_token);
-        if (s_get_resource_async_with_imds_token(user_data)) {
-            s_user_data_release(user_data);
+        struct aws_imds_client *client = user_data->client;
+        aws_mutex_lock(&client->token_lock);
+        if (aws_byte_buf_eq(&user_data->imds_token, &client->cached_token)) {
+            /* If the token used matches the cached token, that means the cached token is invalid. */
+            client->token_state = AWS_IMDS_TS_INVALID;
+            AWS_LOGF_DEBUG(
+                AWS_LS_IMDS_CLIENT,
+                "(id=%p) IMDS client's cached token is invalidated by requester %p.",
+                (void *)client,
+                (void *)user_data);
+        }
+        /* let following requests use token as it's required. */
+        client->token_required = true;
+        aws_mutex_unlock(&client->token_lock);
+
+        if (!user_data->imds_token_required && !user_data->is_fallback_request) {
+            AWS_LOGF_DEBUG(
+                AWS_LS_IMDS_CLIENT,
+                "(id=%p) IMDS client failed to fetch resource via V1, try to use V2. requester %p.",
+                (void *)user_data->client,
+                (void *)user_data);
+            /* V1 request, fallback to V2 and try again. */
+            s_reset_scratch_user_data(user_data);
+            user_data->is_fallback_request = true;
+            aws_retry_token_release(user_data->retry_token);
+            /* Try V2 now. */
+            if (s_get_resource_async_with_imds_token(user_data)) {
+                s_user_data_release(user_data);
+            }
+            return;
+        } else {
+            /* Not retirable error. */
+            AWS_LOGF_ERROR(
+                AWS_LS_IMDS_CLIENT,
+                "(id=%p) IMDS client failed to fetch resource. Server response 401 UNAUTHORIZED. requester %p.",
+                (void *)user_data->client,
+                (void *)user_data);
+            user_data->error_code = AWS_AUTH_IMDS_CLIENT_SOURCE_FAILURE;
         }
-        return;
     }
 
+    /* TODO: if server sent out error, we will still report as succeed with the error body received from server. */
+    /* TODO: retry for 503 throttle. */
     user_data->original_callback(
         user_data->error_code ? NULL : &user_data->current_result,
         user_data->error_code,
@@ -683,6 +751,7 @@ static void s_on_stream_complete_fn(struct aws_http_stream *stream, int error_co
     client->function_table->aws_http_connection_manager_release_connection(client->connection_manager, connection);
 
     /* on encountering error, see if we could try again */
+    /* TODO: check the status code as well? */
     if (error_code) {
         AWS_LOGF_WARN(
             AWS_LS_IMDS_CLIENT,
@@ -753,8 +822,27 @@ static void s_complete_pending_queries(
         struct imds_user_data *requester = query->user_data;
         aws_mem_release(client->allocator, query);
 
-        requester->imds_token_required = token_required;
         bool should_continue = true;
+        if (requester->imds_token_required && !token_required) {
+            if (requester->is_fallback_request) {
+                AWS_LOGF_ERROR(
+                    AWS_LS_IMDS_CLIENT,
+                    "(id=%p) IMDS client failed to fetch resource without token, and also failed to fetch token. "
+                    "requester %p.",
+                    (void *)requester->client,
+                    (void *)requester);
+                requester->error_code = AWS_AUTH_IMDS_CLIENT_SOURCE_FAILURE;
+                should_continue = false;
+            } else {
+                AWS_LOGF_DEBUG(
+                    AWS_LS_IMDS_CLIENT,
+                    "(id=%p) IMDS client failed to fetch token, fallback to v1. requester %p.",
+                    (void *)requester->client,
+                    (void *)requester);
+                requester->is_fallback_request = true;
+            }
+        }
+        requester->imds_token_required = token_required;
         if (token) {
             aws_byte_buf_reset(&requester->imds_token, true);
             struct aws_byte_cursor cursor = aws_byte_cursor_from_buf(token);
@@ -767,6 +855,7 @@ static void s_complete_pending_queries(
                 should_continue = false;
             }
         } else if (token_required) {
+            requester->error_code = AWS_AUTH_IMDS_CLIENT_SOURCE_FAILURE;
             should_continue = false;
         }
 
@@ -781,9 +870,8 @@ static void s_complete_pending_queries(
         }
 
         if (!should_continue) {
-            requester->error_code = aws_last_error();
             if (requester->error_code == AWS_ERROR_SUCCESS) {
-                requester->error_code = AWS_ERROR_UNKNOWN;
+                requester->error_code = aws_last_error() == AWS_ERROR_SUCCESS ? AWS_ERROR_UNKNOWN : aws_last_error();
             }
             s_query_complete(requester);
         }
@@ -796,25 +884,35 @@ static enum imds_token_copy_result s_copy_token_safely(struct imds_user_data *us
 
     struct aws_linked_list pending_queries;
     aws_linked_list_init(&pending_queries);
-    aws_mutex_lock(&client->token_lock);
+    uint64_t current = 0;
+    user_data->client->function_table->aws_high_res_clock_get_ticks(&current);
 
+    aws_mutex_lock(&client->token_lock);
     if (client->token_state == AWS_IMDS_TS_VALID) {
-        aws_byte_buf_reset(&user_data->imds_token, true);
-        struct aws_byte_cursor cursor = aws_byte_cursor_from_buf(&client->cached_token);
-        if (aws_byte_buf_append_dynamic(&user_data->imds_token, &cursor)) {
-            ret = AWS_IMDS_TCR_UNEXPECTED_ERROR;
+        if (current > client->cached_token_expiration_timestamp) {
+            /* The cached token expired. Switch the state */
+            client->token_state = AWS_IMDS_TS_INVALID;
+            AWS_LOGF_DEBUG(
+                AWS_LS_IMDS_CLIENT,
+                "(id=%p) IMDS client's cached token expired. Fetching new token for requester %p.",
+                (void *)client,
+                (void *)user_data);
         } else {
-            ret = AWS_IMDS_TCR_SUCCESS;
+            aws_byte_buf_reset(&user_data->imds_token, true);
+            struct aws_byte_cursor cursor = aws_byte_cursor_from_buf(&client->cached_token);
+            if (aws_byte_buf_append_dynamic(&user_data->imds_token, &cursor)) {
+                ret = AWS_IMDS_TCR_UNEXPECTED_ERROR;
+            } else {
+                ret = AWS_IMDS_TCR_SUCCESS;
+            }
         }
-    } else {
+    }
+
+    if (client->token_state != AWS_IMDS_TS_VALID) {
         ret = AWS_IMDS_TCR_WAITING_IN_QUEUE;
         struct imds_token_query *query = aws_mem_calloc(client->allocator, 1, sizeof(struct imds_token_query));
-        if (query != NULL) {
-            query->user_data = user_data;
-            aws_linked_list_push_back(&client->pending_queries, &query->node);
-        } else {
-            ret = AWS_IMDS_TCR_UNEXPECTED_ERROR;
-        }
+        query->user_data = user_data;
+        aws_linked_list_push_back(&client->pending_queries, &query->node);
 
         if (client->token_state == AWS_IMDS_TS_INVALID) {
             if (s_client_start_query_token(client)) {
@@ -855,31 +953,16 @@ static enum imds_token_copy_result s_copy_token_safely(struct imds_user_data *us
     }
     return ret;
 }
-
-static void s_invalidate_cached_token_safely(struct imds_user_data *user_data) {
-    bool invalidated = false;
-    struct aws_imds_client *client = user_data->client;
-    aws_mutex_lock(&client->token_lock);
-    if (aws_byte_buf_eq(&user_data->imds_token, &client->cached_token)) {
-        client->token_state = AWS_IMDS_TS_INVALID;
-        invalidated = true;
-    }
-    aws_mutex_unlock(&client->token_lock);
-    if (invalidated) {
-        AWS_LOGF_DEBUG(
-            AWS_LS_IMDS_CLIENT,
-            "(id=%p) IMDS client's cached token is set to be invalid by requester %p.",
-            (void *)client,
-            (void *)user_data);
-    }
-}
-
 /**
  * Once a requseter returns from token request, it should call this function to unblock all other
  * waiting requesters. When the token parameter is NULL, means the token request failed. Now we need
  * a new requester to acquire the token again.
  */
-static bool s_update_token_safely(struct aws_imds_client *client, struct aws_byte_buf *token, bool token_required) {
+static void s_update_token_safely(
+    struct aws_imds_client *client,
+    struct aws_byte_buf *token,
+    bool token_required,
+    uint64_t expire_timestamp) {
     AWS_FATAL_ASSERT(client);
     bool updated = false;
 
@@ -893,6 +976,7 @@ static bool s_update_token_safely(struct aws_imds_client *client, struct aws_byt
         struct aws_byte_cursor cursor = aws_byte_cursor_from_buf(token);
         if (aws_byte_buf_append_dynamic(&client->cached_token, &cursor) == AWS_OP_SUCCESS) {
             client->token_state = AWS_IMDS_TS_VALID;
+            client->cached_token_expiration_timestamp = expire_timestamp;
             updated = true;
         }
     } else {
@@ -909,7 +993,6 @@ static bool s_update_token_safely(struct aws_imds_client *client, struct aws_byt
     } else {
         AWS_LOGF_ERROR(AWS_LS_IMDS_CLIENT, "(id=%p) IMDS client failed to update the token from IMDS.", (void *)client);
     }
-    return updated;
 }
 
 int s_get_resource_async_with_imds_token(struct imds_user_data *user_data) {

data/aws-crt-ffi/crt/aws-c-auth/source/aws_signing.c

@@ -59,6 +59,7 @@ AWS_STRING_FROM_LITERAL(g_aws_signing_credential_query_param_name, "X-Amz-Creden
 AWS_STRING_FROM_LITERAL(g_aws_signing_date_name, "X-Amz-Date");
 AWS_STRING_FROM_LITERAL(g_aws_signing_signed_headers_query_param_name, "X-Amz-SignedHeaders");
 AWS_STRING_FROM_LITERAL(g_aws_signing_security_token_name, "X-Amz-Security-Token");
+AWS_STRING_FROM_LITERAL(g_aws_signing_s3session_token_name, "X-Amz-S3session-Token");
 AWS_STRING_FROM_LITERAL(g_aws_signing_expires_query_param_name, "X-Amz-Expires");
 AWS_STRING_FROM_LITERAL(g_aws_signing_region_set_name, "X-Amz-Region-Set");
 
@@ -87,6 +88,7 @@ static struct aws_byte_cursor s_amz_date_header_name;
 static struct aws_byte_cursor s_authorization_header_name;
 static struct aws_byte_cursor s_region_set_header_name;
 static struct aws_byte_cursor s_amz_security_token_header_name;
+static struct aws_byte_cursor s_amz_s3session_token_header_name;
 
 static struct aws_byte_cursor s_amz_signature_param_name;
 static struct aws_byte_cursor s_amz_date_param_name;
@@ -191,6 +193,11 @@ int aws_signing_init_signing_tables(struct aws_allocator *allocator) {
         return AWS_OP_ERR;
     }
 
+    s_amz_s3session_token_header_name = aws_byte_cursor_from_string(g_aws_signing_s3session_token_name);
+    if (aws_hash_table_put(&s_forbidden_headers, &s_amz_s3session_token_header_name, NULL, NULL)) {
+        return AWS_OP_ERR;
+    }
+
     if (aws_hash_table_init(
             &s_forbidden_params,
             allocator,
@@ -279,25 +286,25 @@ static int s_get_signature_type_cursor(struct aws_signing_state_aws *state, stru
         case AWS_ST_HTTP_REQUEST_QUERY_PARAMS:
         case AWS_ST_CANONICAL_REQUEST_HEADERS:
         case AWS_ST_CANONICAL_REQUEST_QUERY_PARAMS:
-            if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4) {
-                *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4_http_request);
-            } else {
+            if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC) {
                 *cursor = aws_byte_cursor_from_string(g_signature_type_sigv4a_http_request);
+            } else {
+                *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4_http_request);
             }
             break;
         case AWS_ST_HTTP_REQUEST_CHUNK:
         case AWS_ST_HTTP_REQUEST_EVENT:
-            if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4) {
-                *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4_s3_chunked_payload);
-            } else {
+            if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC) {
                 *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4a_s3_chunked_payload);
+            } else {
+                *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4_s3_chunked_payload);
             }
             break;
         case AWS_ST_HTTP_REQUEST_TRAILING_HEADERS:
-            if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4) {
-                *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4_s3_chunked_trailer_payload);
-            } else {
+            if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC) {
                 *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4a_s3_chunked_trailer_payload);
+            } else {
+                *cursor = aws_byte_cursor_from_string(s_signature_type_sigv4_s3_chunked_trailer_payload);
             }
             break;
 
@@ -841,12 +848,20 @@ static int s_add_authorization_query_params(
         }
     }
 
-    /* X-Amz-Security-token */
-    struct aws_byte_cursor security_token_name_cur = aws_byte_cursor_from_string(g_aws_signing_security_token_name);
+    /* X-Amz-*-token */
+    /* We have different token between S3Express and other signing, which needs different token header name */
+    struct aws_byte_cursor token_header_name;
+    if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4_S3EXPRESS) {
+        /* X-Amz-S3session-Token */
+        token_header_name = s_amz_s3session_token_header_name;
+    } else {
+        /* X-Amz-Security-Token */
+        token_header_name = s_amz_security_token_header_name;
+    }
     struct aws_byte_cursor session_token_cursor = aws_credentials_get_session_token(state->config.credentials);
     if (session_token_cursor.len > 0) {
         struct aws_uri_param security_token_param = {
-            .key = security_token_name_cur,
+            .key = token_header_name,
             .value = session_token_cursor,
         };
 
@@ -1262,8 +1277,17 @@ static int s_build_canonical_stable_header_list(
     if (state->config.signature_type == AWS_ST_HTTP_REQUEST_HEADERS) {
 
         /*
-         * X-Amz-Security-Token
+         * X-Amz-*-Token
          */
+        /* We have different token between S3Express and other signing, which needs different token header name */
+        struct aws_byte_cursor token_header_name;
+        if (state->config.algorithm == AWS_SIGNING_ALGORITHM_V4_S3EXPRESS) {
+            /* X-Amz-S3session-Token */
+            token_header_name = s_amz_s3session_token_header_name;
+        } else {
+            /* X-Amz-Security-Token */
+            token_header_name = s_amz_security_token_header_name;
+        }
         struct aws_byte_cursor session_token_cursor = aws_credentials_get_session_token(state->config.credentials);
         if (session_token_cursor.len > 0) {
             /* Note that if omit_session_token is true, it is added to final
@@ -1272,17 +1296,13 @@ static int s_build_canonical_stable_header_list(
                 if (aws_signing_result_append_property_list(
                         &state->result,
                         g_aws_http_headers_property_list_name,
-                        &s_amz_security_token_header_name,
+                        &token_header_name,
                         &session_token_cursor)) {
                     return AWS_OP_ERR;
                 }
             } else {
                 if (s_add_authorization_header(
-                        state,
-                        stable_header_list,
-                        out_required_capacity,
-                        s_amz_security_token_header_name,
-                        session_token_cursor)) {
+                        state, stable_header_list, out_required_capacity, token_header_name, session_token_cursor)) {
                     return AWS_OP_ERR;
                 }
             }
@@ -1597,6 +1617,7 @@ static int s_append_credential_scope_terminator(enum aws_signing_algorithm algor
 
     switch (algorithm) {
         case AWS_SIGNING_ALGORITHM_V4:
+        case AWS_SIGNING_ALGORITHM_V4_S3EXPRESS:
         case AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC:
             terminator_cursor = aws_byte_cursor_from_string(s_credential_scope_sigv4_terminator);
             break;
@@ -2304,6 +2325,7 @@ cleanup:
 int s_calculate_signature_value(struct aws_signing_state_aws *state) {
     switch (state->config.algorithm) {
         case AWS_SIGNING_ALGORITHM_V4:
+        case AWS_SIGNING_ALGORITHM_V4_S3EXPRESS:
             return s_calculate_sigv4_signature_value(state);
 
         case AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC:

data/aws-crt-ffi/crt/aws-c-auth/source/credentials_provider_imds.c

@@ -84,6 +84,7 @@ struct aws_credentials_provider *aws_credentials_provider_new_imds(
         .bootstrap = options->bootstrap,
         .function_table = options->function_table,
         .imds_version = options->imds_version,
+        .ec2_metadata_v1_disabled = options->ec2_metadata_v1_disabled,
         .shutdown_options =
             {
                 .shutdown_callback = s_on_imds_client_shutdown,

data/aws-crt-ffi/crt/aws-c-auth/source/credentials_utils.c

@@ -30,6 +30,7 @@ static struct aws_auth_http_system_vtable s_default_function_table = {
     .aws_http_stream_get_incoming_response_status = aws_http_stream_get_incoming_response_status,
     .aws_http_stream_release = aws_http_stream_release,
     .aws_http_connection_close = aws_http_connection_close,
+    .aws_high_res_clock_get_ticks = aws_high_res_clock_get_ticks,
 };
 
 const struct aws_auth_http_system_vtable *g_aws_credentials_provider_http_function_table = &s_default_function_table;

data/aws-crt-ffi/crt/aws-c-auth/source/signable_http_request.c

@@ -76,6 +76,7 @@ static void s_aws_signable_http_request_destroy(struct aws_signable *signable) {
         return;
     }
 
+    aws_http_message_release(impl->request);
     aws_array_list_clean_up(&impl->headers);
     aws_mem_release(signable->allocator, signable);
 }
@@ -118,7 +119,7 @@ struct aws_signable *aws_signable_new_http_request(struct aws_allocator *allocat
         aws_array_list_push_back(&impl->headers, &property);
     }
 
-    impl->request = request;
+    impl->request = aws_http_message_acquire(request);
 
     return signable;