aws-sdk-core 2.11.212 → 3.170.0

data/lib/aws-sdk-core/rest/response/body.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Rest
     module Response
@@ -15,7 +17,9 @@ module Aws
         # @param [IO] body
         # @param [Hash, Struct] data
         def apply(body, data)
-          if streaming?
+          if event_stream?
+            data[@rules[:payload]] = parse_eventstream(body)
+          elsif streaming?
             data[@rules[:payload]] = body
           elsif @rules[:payload]
             data[@rules[:payload]] = parse(body.read, @rules[:payload_member])
@@ -26,6 +30,10 @@ module Aws
 
         private
 
+        def event_stream?
+          @rules[:payload] && @rules[:payload_member].eventstream
+        end
+
         def streaming?
           @rules[:payload] && (
             BlobShape === @rules[:payload_member].shape ||
@@ -37,6 +45,13 @@ module Aws
           @parser_class.new(rules).parse(body, target) if body.size > 0
         end
 
+        def parse_eventstream(body)
+          # body contains an array of parsed event when they arrive
+          @rules[:payload_member].shape.struct_class.new do |payload|
+            body.each { |event| payload << event }
+          end
+        end
+
       end
     end
   end

data/lib/aws-sdk-core/rest/response/headers.rb

@@ -1,6 +1,7 @@
+# frozen_string_literal: true
+
 require 'time'
 require 'base64'
-require 'json'
 
 module Aws
   module Rest
@@ -39,9 +40,13 @@ module Aws
           when IntegerShape then value.to_i
           when FloatShape then value.to_f
           when BooleanShape then value == 'true'
+          when ListShape then
+            value.split(",").map { |v| cast_value(ref.shape.member, v) }
           when TimestampShape
-            if value =~ /\d+(\.\d*)/
+            if value =~ /^\d+(\.\d*)/
               Time.at(value.to_f)
+            elsif value =~ /^\d+$/
+              Time.at(value.to_i)
             else
               begin
                 Time.parse(value)
@@ -64,7 +69,7 @@ module Aws
         end
 
         def extract_json_trait(value)
-          JSON.parse(Base64.decode64(value))
+          Aws::Json.load(Base64.decode64(value))
         end
 
       end

data/lib/aws-sdk-core/rest/response/parser.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Rest
     module Response
@@ -5,31 +7,34 @@ module Aws
 
         def apply(response)
           # TODO : remove this unless check once response stubbing is fixed
-          unless response.data
-            response.data = response.context.operation.output[:struct_class].new
+          if rules = response.context.operation.output
+            response.data = rules.shape.struct_class.new
+            extract_status_code(rules, response)
+            extract_headers(rules, response)
+            extract_body(rules, response)
+          else
+            response.data = EmptyStructure.new
           end
-          extract_status_code(response)
-          extract_headers(response)
-          extract_body(response)
         end
 
         private
 
-        def extract_status_code(response)
-          status_code = StatusCode.new(response.context.operation.output)
+        def extract_status_code(rules, response)
+          status_code = StatusCode.new(rules)
           status_code.apply(response.context.http_response, response.data)
         end
 
-        def extract_headers(response)
-          headers = Headers.new(response.context.operation.output)
+        def extract_headers(rules, response)
+          headers = Headers.new(rules)
           headers.apply(response.context.http_response, response.data)
         end
 
-        def extract_body(response)
-          Body.new(
-            parser_class(response),
-            response.context.operation.output,
-          ).apply(response.context.http_response.body, response.data)
+        def extract_body(rules, response)
+          Body.new(parser_class(response), rules).
+            apply(
+              response.context.http_response.body,
+              response.data
+            )
         end
 
         def parser_class(response)
@@ -37,6 +42,7 @@ module Aws
           case protocol
           when 'rest-xml' then Xml::Parser
           when 'rest-json' then Json::Parser
+          when 'api-gateway' then Json::Parser
           else raise "unsupported protocol #{protocol}"
           end
         end

data/lib/aws-sdk-core/rest/response/status_code.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Rest
     module Response

data/lib/aws-sdk-core/rest.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require_relative 'rest/handler'
+require_relative 'rest/request/body'
+require_relative 'rest/request/builder'
+require_relative 'rest/request/endpoint'
+require_relative 'rest/request/headers'
+require_relative 'rest/request/querystring_builder'
+require_relative 'rest/response/body'
+require_relative 'rest/response/headers'
+require_relative 'rest/response/parser'
+require_relative 'rest/response/status_code'

data/lib/aws-sdk-core/shared_config.rb

@@ -1,7 +1,13 @@
-module Aws
+# frozen_string_literal: true
 
+module Aws
   # @api private
   class SharedConfig
+    SSO_CREDENTIAL_PROFILE_KEYS = %w[sso_account_id sso_role_name].freeze
+    SSO_PROFILE_KEYS = %w[sso_session sso_start_url sso_region sso_account_id sso_role_name].freeze
+    SSO_TOKEN_PROFILE_KEYS = %w[sso_session].freeze
+    SSO_SESSION_KEYS = %w[sso_region sso_start_url].freeze
+
 
     # @return [String]
     attr_reader :credentials_path
@@ -20,7 +26,11 @@ module Aws
     # `~/.aws/credentials`) and the shared config file (the default path for
     # which is `~/.aws/config`) are loaded. However, if you set the
     # `ENV['AWS_SDK_CONFIG_OPT_OUT']` environment variable, only the shared
-    # credential file will be loaded.
+    # credential file will be loaded. You can specify the shared credential
+    # file path with the `ENV['AWS_SHARED_CREDENTIALS_FILE']` environment
+    # variable or with the `:credentials_path` option. Similarly, you can
+    # specify the shared config file path with the `ENV['AWS_CONFIG_FILE']`
+    # environment variable or with the `:config_path` option.
     #
     # The default profile name is 'default'. You can specify the profile name
     # with the `ENV['AWS_PROFILE']` environment variable or with the
@@ -28,9 +38,11 @@ module Aws
     #
     # @param [Hash] options
     # @option options [String] :credentials_path Path to the shared credentials
-    #   file. Defaults to "#{Dir.home}/.aws/credentials".
+    #   file. If not specified, will check `ENV['AWS_SHARED_CREDENTIALS_FILE']`
+    #   before using the default value of "#{Dir.home}/.aws/credentials".
     # @option options [String] :config_path Path to the shared config file.
-    #   Defaults to "#{Dir.home}/.aws/config".
+    #   If not specified, will check `ENV['AWS_CONFIG_FILE']` before using the
+    #   default value of "#{Dir.home}/.aws/config".
     # @option options [String] :profile_name The credential/config profile name
     #   to use. If not specified, will check `ENV['AWS_PROFILE']` before using
     #   the fixed default value of 'default'.
@@ -38,14 +50,17 @@ module Aws
     #   file and enables new config values outside of the old shared credential
     #   spec.
     def initialize(options = {})
+      @parsed_config = nil
       @profile_name = determine_profile(options)
       @config_enabled = options[:config_enabled]
       @credentials_path = options[:credentials_path] ||
-        determine_credentials_path
+                          determine_credentials_path
+      @credentials_path = File.expand_path(@credentials_path) if @credentials_path
       @parsed_credentials = {}
       load_credentials_file if loadable?(@credentials_path)
       if @config_enabled
         @config_path = options[:config_path] || determine_config_path
+        @config_path = File.expand_path(@config_path) if @config_path
         load_config_file if loadable?(@config_path)
       end
     end
@@ -60,7 +75,7 @@ module Aws
       @config_enabled = options[:config_enabled] ? true : false
       @profile_name = determine_profile(options)
       @credentials_path = options[:credentials_path] ||
-        determine_credentials_path
+                          determine_credentials_path
       load_credentials_file if loadable?(@credentials_path)
       if @config_enabled
         @config_path = options[:config_path] || determine_config_path
@@ -84,20 +99,18 @@ module Aws
 
     # Sources static credentials from shared credential/config files.
     #
-    # @param [Hash] options
+    # @param [Hash] opts
     # @option options [String] :profile the name of the configuration file from
     #   which credentials are being sourced.
     # @return [Aws::Credentials] credentials sourced from configuration values,
     #   or `nil` if no valid credentials were found.
     def credentials(opts = {})
       p = opts[:profile] || @profile_name
-      validate_profile_exists(p) if credentials_present?
-      if credentials = credentials_from_shared(p, opts)
+      validate_profile_exists(p)
+      if (credentials = credentials_from_shared(p, opts))
         credentials
-      elsif credentials = credentials_from_config(p, opts)
+      elsif (credentials = credentials_from_config(p, opts))
         credentials
-      else
-        nil
       end
     end
 
@@ -106,84 +119,280 @@ module Aws
     # file, if present.
     def assume_role_credentials_from_config(opts = {})
       p = opts.delete(:profile) || @profile_name
-      credentials = assume_role_from_profile(@parsed_credentials, p, opts)
+      chain_config = opts.delete(:chain_config)
+      credentials = assume_role_from_profile(@parsed_credentials, p, opts, chain_config)
       if @parsed_config
-        credentials ||= assume_role_from_profile(@parsed_config, p, opts)
+        credentials ||= assume_role_from_profile(@parsed_config, p, opts, chain_config)
       end
       credentials
     end
 
-    def region(opts = {})
+    def assume_role_web_identity_credentials_from_config(opts = {})
       p = opts[:profile] || @profile_name
-      if @config_enabled
-        if @parsed_credentials
-          region = @parsed_credentials.fetch(p, {})["region"]
-        end
-        if @parsed_config
-          region ||= @parsed_config.fetch(p, {})["region"]
+      if @config_enabled && @parsed_config
+        entry = @parsed_config.fetch(p, {})
+        if entry['web_identity_token_file'] && entry['role_arn']
+          cfg = {
+            role_arn: entry['role_arn'],
+            web_identity_token_file: entry['web_identity_token_file'],
+            role_session_name: entry['role_session_name']
+          }
+          cfg[:region] = opts[:region] if opts[:region]
+          AssumeRoleWebIdentityCredentials.new(cfg)
         end
-        region
-      else
-        nil
       end
     end
 
-    def endpoint_discovery(opts = {})
+    # Attempts to load from shared config or shared credentials file.
+    # Will always attempt first to load from the shared credentials
+    # file, if present.
+    def sso_credentials_from_config(opts = {})
       p = opts[:profile] || @profile_name
-      if @config_enabled && @parsed_config
-        @parsed_config.fetch(p, {})["endpoint_discovery_enabled"]
+      credentials = sso_credentials_from_profile(@parsed_credentials, p)
+      if @parsed_config
+        credentials ||= sso_credentials_from_profile(@parsed_config, p)
+      end
+      credentials
+    end
+
+    # Attempts to load from shared config or shared credentials file.
+    # Will always attempt first to load from the shared credentials
+    # file, if present.
+    def sso_token_from_config(opts = {})
+      p = opts[:profile] || @profile_name
+      token = sso_token_from_profile(@parsed_credentials, p)
+      if @parsed_config
+        token ||= sso_token_from_profile(@parsed_config, p)
       end
+      token
     end
 
+    # Add an accessor method (similar to attr_reader) to return a configuration value
+    # Uses the get_config_value below to control where
+    # values are loaded from
+    def self.config_reader(*attrs)
+      attrs.each do |attr|
+        define_method(attr) { |opts = {}| get_config_value(attr.to_s, opts) }
+      end
+    end
+
+    config_reader(
+      :region,
+      :ca_bundle,
+      :credential_process,
+      :endpoint_discovery_enabled,
+      :use_dualstack_endpoint,
+      :use_fips_endpoint,
+      :ec2_metadata_service_endpoint,
+      :ec2_metadata_service_endpoint_mode,
+      :max_attempts,
+      :retry_mode,
+      :adaptive_retry_wait_to_fill,
+      :correct_clock_skew,
+      :csm_client_id,
+      :csm_enabled,
+      :csm_host,
+      :csm_port,
+      :sts_regional_endpoints,
+      :s3_use_arn_region,
+      :s3_us_east_1_regional_endpoint,
+      :s3_disable_multiregion_access_points,
+      :defaults_mode
+    )
+
     private
-    def credentials_present?
-      (@parsed_credentials && !@parsed_credentials.empty?) ||
-        (@parsed_config && !@parsed_config.empty?)
+
+    # Get a config value from from shared credential/config files.
+    # Only loads a value when config_enabled is true
+    # Return a value from credentials preferentially over config
+    def get_config_value(key, opts)
+      p = opts[:profile] || @profile_name
+
+      value = @parsed_credentials.fetch(p, {})[key] if @parsed_credentials
+      value ||= @parsed_config.fetch(p, {})[key] if @config_enabled && @parsed_config
+      value
     end
-    def assume_role_from_profile(cfg, profile, opts)
+
+    def assume_role_from_profile(cfg, profile, opts, chain_config)
       if cfg && prof_cfg = cfg[profile]
-        opts[:source_profile] ||= prof_cfg["source_profile"]
-        if opts[:source_profile]
-          opts[:credentials] = credentials(profile: opts[:source_profile])
+        opts[:source_profile] ||= prof_cfg['source_profile']
+        credential_source = opts.delete(:credential_source)
+        credential_source ||= prof_cfg['credential_source']
+        if opts[:source_profile] && credential_source
+          raise Errors::CredentialSourceConflictError,
+            "Profile #{profile} has a source_profile, and "\
+            'a credential_source. For assume role credentials, must '\
+            'provide only source_profile or credential_source, not both.'
+        elsif opts[:source_profile]
+          opts[:visited_profiles] ||= Set.new
+          opts[:credentials] = resolve_source_profile(opts[:source_profile], opts)
           if opts[:credentials]
-            opts[:role_session_name] ||= prof_cfg["role_session_name"]
-            opts[:role_session_name] ||= "default_session"
-            opts[:role_arn] ||= prof_cfg["role_arn"]
-            opts[:external_id] ||= prof_cfg["external_id"]
-            opts[:serial_number] ||= prof_cfg["mfa_serial"]
+            opts[:role_session_name] ||= prof_cfg['role_session_name']
+            opts[:role_session_name] ||= 'default_session'
+            opts[:role_arn] ||= prof_cfg['role_arn']
+            opts[:duration_seconds] ||= prof_cfg['duration_seconds']
+            opts[:external_id] ||= prof_cfg['external_id']
+            opts[:serial_number] ||= prof_cfg['mfa_serial']
             opts[:profile] = opts.delete(:source_profile)
+            opts.delete(:visited_profiles)
             AssumeRoleCredentials.new(opts)
           else
-            raise Errors::NoSourceProfileError.new(
+            raise Errors::NoSourceProfileError,
               "Profile #{profile} has a role_arn, and source_profile, but the"\
-                " source_profile does not have credentials."
-            )
+              ' source_profile does not have credentials.'
           end
-        elsif prof_cfg["role_arn"]
-          raise Errors::NoSourceProfileError.new(
-            "Profile #{profile} has a role_arn, but no source_profile."
+        elsif credential_source
+          opts[:credentials] = credentials_from_source(
+            credential_source,
+            chain_config
           )
-        else
-          nil
+          if opts[:credentials]
+            opts[:role_session_name] ||= prof_cfg['role_session_name']
+            opts[:role_session_name] ||= 'default_session'
+            opts[:role_arn] ||= prof_cfg['role_arn']
+            opts[:duration_seconds] ||= prof_cfg['duration_seconds']
+            opts[:external_id] ||= prof_cfg['external_id']
+            opts[:serial_number] ||= prof_cfg['mfa_serial']
+            opts.delete(:source_profile) # Cleanup
+            AssumeRoleCredentials.new(opts)
+          else
+            raise Errors::NoSourceCredentials,
+              "Profile #{profile} could not get source credentials from"\
+              " provider #{credential_source}"
+          end
+        elsif prof_cfg['role_arn']
+          raise Errors::NoSourceProfileError, "Profile #{profile} has a role_arn, but no source_profile."
         end
+      end
+    end
+
+    def resolve_source_profile(profile, opts = {})
+      if opts[:visited_profiles] && opts[:visited_profiles].include?(profile)
+        raise Errors::SourceProfileCircularReferenceError
+      end
+      opts[:visited_profiles].add(profile) if opts[:visited_profiles]
+
+      profile_config = @parsed_credentials[profile]
+      if @config_enabled
+        profile_config ||= @parsed_config[profile]
+      end
+
+      if (creds = credentials(profile: profile))
+        creds # static credentials
+      elsif profile_config && profile_config['source_profile']
+        opts.delete(:source_profile)
+        assume_role_credentials_from_config(opts.merge(profile: profile))
+      elsif (provider = assume_role_web_identity_credentials_from_config(opts.merge(profile: profile)))
+        provider.credentials if provider.credentials.set?
+      elsif (provider = assume_role_process_credentials_from_config(profile))
+        provider.credentials if provider.credentials.set?
+      elsif (provider = sso_credentials_from_config(profile: profile))
+        provider.credentials if provider.credentials.set?
+      end
+    end
+
+    def credentials_from_source(credential_source, config)
+      case credential_source
+      when 'Ec2InstanceMetadata'
+        InstanceProfileCredentials.new(
+          retries: config ? config.instance_profile_credentials_retries : 0,
+          http_open_timeout: config ? config.instance_profile_credentials_timeout : 1,
+          http_read_timeout: config ? config.instance_profile_credentials_timeout : 1
+        )
+      when 'EcsContainer'
+        ECSCredentials.new
       else
-        nil
+        raise Errors::InvalidCredentialSourceError, "Unsupported credential_source: #{credential_source}"
+      end
+    end
+
+    def assume_role_process_credentials_from_config(profile)
+      validate_profile_exists(profile)
+      credential_process = @parsed_credentials.fetch(profile, {})['credential_process']
+      if @parsed_config
+        credential_process ||= @parsed_config.fetch(profile, {})['credential_process']
       end
+      ProcessCredentials.new(credential_process) if credential_process
     end
 
-    def credentials_from_shared(profile, opts)
+    def credentials_from_shared(profile, _opts)
       if @parsed_credentials && prof_config = @parsed_credentials[profile]
         credentials_from_profile(prof_config)
-      else
-        nil
       end
     end
 
-    def credentials_from_config(profile, opts)
+    def credentials_from_config(profile, _opts)
       if @parsed_config && prof_config = @parsed_config[profile]
         credentials_from_profile(prof_config)
-      else
-        nil
+      end
+    end
+
+    # If any of the sso_ profile values are present, attempt to construct
+    # SSOCredentials
+    def sso_credentials_from_profile(cfg, profile)
+      if @parsed_config &&
+         (prof_config = cfg[profile]) &&
+         !(prof_config.keys & SSO_CREDENTIAL_PROFILE_KEYS).empty?
+
+        if sso_session_name = prof_config['sso_session']
+          sso_session = cfg["sso-session #{sso_session_name}"]
+          unless sso_session
+            raise ArgumentError,
+                  "sso-session #{sso_session_name} must be defined in the config file. " \
+                    "Referenced by profile #{profile}"
+          end
+          sso_region = sso_session['sso_region']
+          sso_start_url = sso_session['sso_start_url']
+
+          # validate sso_region and sso_start_url don't conflict if set on profile and session
+          if prof_config['sso_region'] &&  prof_config['sso_region'] != sso_region
+            raise ArgumentError,
+                  "sso-session #{sso_session_name}'s sso_region (#{sso_region}) " \
+                    "does not match the profile #{profile}'s sso_region (#{prof_config['sso_region']}'"
+          end
+          if prof_config['sso_start_url'] &&  prof_config['sso_start_url'] != sso_start_url
+            raise ArgumentError,
+                  "sso-session #{sso_session_name}'s sso_start_url (#{sso_start_url}) " \
+                    "does not match the profile #{profile}'s sso_start_url (#{prof_config['sso_start_url']}'"
+          end
+        else
+          sso_region = prof_config['sso_region']
+          sso_start_url = prof_config['sso_start_url']
+        end
+
+        SSOCredentials.new(
+          sso_account_id: prof_config['sso_account_id'],
+          sso_role_name: prof_config['sso_role_name'],
+          sso_session: prof_config['sso_session'],
+          sso_region: sso_region,
+          sso_start_url: prof_config['sso_start_url']
+          )
+      end
+    end
+
+    # If the required sso_ profile values are present, attempt to construct
+    # SSOTokenProvider
+    def sso_token_from_profile(cfg, profile)
+      if @parsed_config &&
+        (prof_config = cfg[profile]) &&
+        !(prof_config.keys & SSO_TOKEN_PROFILE_KEYS).empty?
+
+        sso_session_name = prof_config['sso_session']
+        sso_session = cfg["sso-session #{sso_session_name}"]
+        unless sso_session
+          raise ArgumentError,
+                "sso-session #{sso_session_name} must be defined in the config file." \
+                  "Referenced by profile #{profile}"
+        end
+
+        unless sso_session['sso_region']
+          raise ArgumentError, "sso-session #{sso_session_name} missing required parameter: sso_region"
+        end
+
+        SSOTokenProvider.new(
+          sso_session: sso_session_name,
+          sso_region: sso_session['sso_region']
+        )
       end
     end
 
@@ -193,15 +402,7 @@ module Aws
         prof_config['aws_secret_access_key'],
         prof_config['aws_session_token']
       )
-      if credentials_complete(creds)
-        creds
-      else
-        nil
-      end
-    end
-
-    def credentials_complete(creds)
-      creds.set?
+      creds if creds.set?
     end
 
     def load_credentials_file
@@ -215,11 +416,11 @@ module Aws
     end
 
     def determine_credentials_path
-      default = default_shared_config_path('credentials')
+      ENV['AWS_SHARED_CREDENTIALS_FILE'] || default_shared_config_path('credentials')
     end
 
     def determine_config_path
-      default = default_shared_config_path('config')
+      ENV['AWS_CONFIG_FILE'] || default_shared_config_path('config')
     end
 
     def default_shared_config_path(file)
@@ -231,19 +432,18 @@ module Aws
 
     def validate_profile_exists(profile)
       unless (@parsed_credentials && @parsed_credentials[profile]) ||
-          (@parsed_config && @parsed_config[profile])
-        msg = "Profile `#{profile}' not found in #{@credentials_path}"
-        msg << " or #{@config_path}" if @config_path
-        raise Errors::NoSuchProfileError.new(msg)
+             (@parsed_config && @parsed_config[profile])
+        msg = "Profile `#{profile}' not found in #{@credentials_path}"\
+              "#{" or #{@config_path}" if @config_path}"
+        raise Errors::NoSuchProfileError, msg
       end
     end
 
     def determine_profile(options)
       ret = options[:profile_name]
-      ret ||= ENV["AWS_PROFILE"]
-      ret ||= "default"
+      ret ||= ENV['AWS_PROFILE']
+      ret ||= 'default'
       ret
     end
-
   end
 end

data/lib/aws-sdk-core/shared_credentials.rb

@@ -1,3 +1,7 @@
+# frozen_string_literal: true
+
+require_relative 'ini_parser'
+
 module Aws
   class SharedCredentials
 
@@ -10,11 +14,17 @@ module Aws
       'aws_session_token' => 'session_token',
     }
 
-    # Constructs a new SharedCredentials object. This will load AWS access
+    # Constructs a new SharedCredentials object. This will load static
+    # (access_key_id, secret_access_key and session_token) AWS access
     # credentials from an ini file, which supports profiles. The default
     # profile name is 'default'. You can specify the profile name with the
     # `ENV['AWS_PROFILE']` or with the `:profile_name` option.
     #
+    # To use credentials from the default credential resolution chain
+    # create a client without the credential option specified.
+    # You may access the resolved credentials through
+    # `client.config.credentials`.
+    #
     # @option [String] :path Path to the shared file.  Defaults
     #   to "#{Dir.home}/.aws/credentials".
     #