aws-sdk-core 2.11.380 → 3.67.0

data/lib/aws-sdk-core/plugins/signature_v4.rb

@@ -0,0 +1,141 @@
+require 'aws-sigv4'
+
+module Aws
+  module Plugins
+    # @api private
+    class SignatureV4 < Seahorse::Client::Plugin
+
+      option(:sigv4_signer) do |cfg|
+        SignatureV4.build_signer(cfg)
+      end
+
+      option(:sigv4_name) do |cfg|
+        cfg.api.metadata['signingName'] || cfg.api.metadata['endpointPrefix']
+      end
+
+      option(:sigv4_region) do |cfg|
+
+        # The signature version 4 signing region is most
+        # commonly the configured region. There are a few
+        # notable exceptions:
+        #
+        # * Some services have a global endpoint to the entire
+        #   partition. For example, when constructing a route53
+        #   client for a region like "us-west-2", we will
+        #   always use "route53.amazonaws.com". This endpoint
+        #   is actually global to the entire partition,
+        #   and must be signed as "us-east-1".
+        #
+        # * When the region is configured, but it is configured
+        #   to a non region, such as "aws-global". This is similar
+        #   to the previous case. We use the Aws::Partitions::EndpointProvider
+        #   to resolve to the actual signing region.
+        #
+        prefix = cfg.api.metadata['endpointPrefix']
+        if prefix && cfg.endpoint.to_s.match(/#{prefix}\.amazonaws\.com/)
+          'us-east-1'
+        elsif cfg.region
+          Aws::Partitions::EndpointProvider.signing_region(cfg.region, cfg.sigv4_name)
+        end
+      end
+
+      option(:unsigned_operations) do |cfg|
+        cfg.api.operation_names.inject([]) do |unsigned, operation_name|
+          if cfg.api.operation(operation_name)['authtype'] == 'none' ||
+            cfg.api.operation(operation_name)['authtype'] == 'custom'
+            # Unsign requests that has custom apigateway authorizer as well
+            unsigned << operation_name
+          else
+            unsigned
+          end
+        end
+      end
+
+      def add_handlers(handlers, cfg)
+        if cfg.unsigned_operations.empty?
+          handlers.add(Handler, step: :sign)
+        else
+          operations = cfg.api.operation_names - cfg.unsigned_operations
+          handlers.add(Handler, step: :sign, operations: operations)
+        end
+      end
+
+      class Handler < Seahorse::Client::Handler
+        def call(context)
+          SignatureV4.apply_signature(context: context)
+          @handler.call(context)
+        end
+      end
+
+      class MissingCredentialsSigner
+        def sign_request(*args)
+          raise Errors::MissingCredentialsError
+        end
+      end
+
+      class << self
+
+        # @api private
+        def build_signer(cfg)
+          if cfg.credentials && cfg.sigv4_region
+            Aws::Sigv4::Signer.new(
+              service: cfg.sigv4_name,
+              region: cfg.sigv4_region,
+              credentials_provider: cfg.credentials,
+              unsigned_headers: ['content-length', 'user-agent', 'x-amzn-trace-id']
+            )
+          elsif cfg.credentials
+            raise Errors::MissingRegionError
+          elsif cfg.sigv4_region
+            # Instead of raising now, we return a signer that raises only
+            # if you attempt to sign a request. Some services have unsigned
+            # operations and it okay to initialize clients for these services
+            # without credentials. Unsigned operations have an "authtype"
+            # trait of "none".
+            MissingCredentialsSigner.new
+          end
+        end
+
+        # @api private
+        def apply_signature(options = {})
+          context = apply_authtype(options[:context])
+          signer = options[:signer] || context.config.sigv4_signer
+          req = context.http_request
+
+          # in case this request is being re-signed
+          req.headers.delete('Authorization')
+          req.headers.delete('X-Amz-Security-Token')
+          req.headers.delete('X-Amz-Date')
+
+          # compute the signature
+          begin
+            signature = signer.sign_request(
+              http_method: req.http_method,
+              url: req.endpoint,
+              headers: req.headers,
+              body: req.body
+            )
+          rescue Aws::Sigv4::Errors::MissingCredentialsError
+            raise Aws::Errors::MissingCredentialsError
+          end
+
+          # apply signature headers
+          req.headers.update(signature.headers)
+
+          # add request metadata with signature components for debugging
+          context[:canonical_request] = signature.canonical_request
+          context[:string_to_sign] = signature.string_to_sign
+        end
+
+        # @api private
+        def apply_authtype(context)
+          if context.operation['authtype'].eql?('v4-unsigned-body') &&
+            context.http_request.endpoint.scheme.eql?('https')
+            context.http_request.headers['X-Amz-Content-Sha256'] = 'UNSIGNED-PAYLOAD'
+          end
+          context
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-core/plugins/stub_responses.rb

@@ -1,18 +1,20 @@
 module Aws
   module Plugins
-
-    # @seahorse.client.option [Boolean] :stub_responses (false)
-    #   Causes the client to return stubbed responses. By default
-    #   fake responses are generated and returned. You can specify
-    #   the response data to return or errors to raise by calling
-    #   {ClientStubs#stub_responses}. See {ClientStubs} for more information.
-    #
-    #   ** Please note ** When response stubbing is enabled, no HTTP
-    #   requests are made, and retries are disabled.
-    #
+    # @api private
     class StubResponses < Seahorse::Client::Plugin
 
-      option(:stub_responses, false)
+      option(:stub_responses,
+        default: false,
+        doc_type: 'Boolean',
+        docstring: <<-DOCS)
+Causes the client to return stubbed responses. By default
+fake responses are generated and returned. You can specify
+the response data to return or errors to raise by calling
+{ClientStubs#stub_responses}. See {ClientStubs} for more information.
+
+** Please note ** When response stubbing is enabled, no HTTP
+requests are made, and retries are disabled.
+        DOCS
 
       option(:region) do |config|
         'us-stubbed-1' if config.stub_responses
@@ -32,6 +34,9 @@ module Aws
         if client.config.stub_responses
           client.setup_stubbing
           client.handlers.remove(RetryErrors::Handler)
+          client.handlers.remove(ClientMetricsPlugin::Handler)
+          client.handlers.remove(ClientMetricsSendPlugin::LatencyHandler)
+          client.handlers.remove(ClientMetricsSendPlugin::AttemptHandler)
         end
       end
 
@@ -40,15 +45,18 @@ module Aws
         def call(context)
           stub = context.client.next_stub(context)
           resp = Seahorse::Client::Response.new(context: context)
-          apply_stub(stub, resp)
-          resp
+          async_mode = context.client.is_a? Seahorse::Client::AsyncBase
+          apply_stub(stub, resp, async_mode)
+
+          async_mode ? Seahorse::Client::AsyncResponse.new(
+            context: context, stream: context[:input_event_stream_handler].event_emitter.stream, sync_queue: Queue.new) : resp
         end
 
-        def apply_stub(stub, response)
+        def apply_stub(stub, response, async_mode = false)
           http_resp = response.context.http_response
           case
           when stub[:error] then signal_error(stub[:error], http_resp)
-          when stub[:http] then signal_http(stub[:http], http_resp)
+          when stub[:http] then signal_http(stub[:http], http_resp, async_mode)
           when stub[:data] then response.data = stub[:data]
           end
         end
@@ -62,9 +70,18 @@ module Aws
         end
 
         # @param [Seahorse::Client::Http::Response] stub
-        # @param [Seahorse::Client::Http::Response] http_resp
-        def signal_http(stub, http_resp)
-          http_resp.signal_headers(stub.status_code, stub.headers.to_h)
+        # @param [Seahorse::Client::Http::Response | Seahorse::Client::Http::AsyncResponse] http_resp
+        # @param [Boolean] async_mode
+        def signal_http(stub, http_resp, async_mode = false)
+          if async_mode
+            h2_headers = stub.headers.to_h.inject([]) do |arr, (k, v)|
+              arr << [k, v]
+            end
+            h2_headers << [":status", stub.status_code]
+            http_resp.signal_headers(h2_headers)
+          else
+            http_resp.signal_headers(stub.status_code, stub.headers.to_h)
+          end
           while chunk = stub.body.read(1024 * 1024)
             http_resp.signal_data(chunk)
           end

data/lib/aws-sdk-core/plugins/transfer_encoding.rb

@@ -0,0 +1,53 @@
+module Aws
+  module Plugins
+
+    # For Streaming Input Operations, when `requiresLength` is enabled
+    # checking whether `Content-Length` header can be set,
+    # for `v4-unsigned-body` operations, set `Transfer-Encoding` header
+    class TransferEncoding < Seahorse::Client::Plugin
+
+      # @api private
+      class Handler < Seahorse::Client::Handler
+
+        def call(context)
+          if streaming?(context.operation.input)
+            begin
+              context.http_request.body.size
+            rescue
+              if requires_length?(context.operation.input)
+                # if size of the IO is not available but required
+                raise Aws::Errors::MissingContentLength.new
+              elsif context.operation['authtype'] == "v4-unsigned-body"
+                context.http_request.headers['Transfer-Encoding'] = 'chunked'
+              end
+            end
+          end
+
+          @handler.call(context)
+        end
+
+        private
+
+        def streaming?(ref)
+          if payload = ref[:payload_member]
+            payload["streaming"] || # checking ref and shape
+              payload.shape["streaming"]
+          else
+            false
+          end
+        end
+
+        def requires_length?(ref)
+          payload = ref[:payload_member]
+          payload["requiresLength"] || # checking ref and shape
+            payload.shape["requiresLength"]
+        end
+
+      end
+
+      handler(Handler, step: :sign)
+
+    end
+
+  end
+end

data/lib/aws-sdk-core/plugins/user_agent.rb

@@ -1,5 +1,6 @@
 module Aws
   module Plugins
+    # @api private
     class UserAgent < Seahorse::Client::Plugin
 
       option(:user_agent_suffix)
@@ -13,12 +14,28 @@ module Aws
         end
 
         def set_user_agent(context)
-          ua = "aws-sdk-ruby2/#{VERSION} %s/%s %s %s" % [
-            (RUBY_ENGINE rescue nil or "ruby"),
-            RUBY_VERSION,
-            RUBY_PLATFORM,
-            context.config.user_agent_suffix,
-          ]
+          execution_env = ENV["AWS_EXECUTION_ENV"]
+
+          ua = "aws-sdk-ruby3/#{CORE_GEM_VERSION}"
+
+          begin
+            ua += " #{RUBY_ENGINE}/#{RUBY_VERSION}"
+          rescue
+            ua += " RUBY_ENGINE_NA/#{RUBY_VERSION}"
+          end
+
+          ua += " #{RUBY_PLATFORM}"
+
+          if context[:gem_name] && context[:gem_version]
+            ua += " #{context[:gem_name]}/#{context[:gem_version]}"
+          end
+
+          if execution_env
+            ua += " exec-env/#{execution_env}"
+          end
+
+          ua += " #{context.config.user_agent_suffix}" if context.config.user_agent_suffix
+
           context.http_request.headers['User-Agent'] = ua.strip
         end
 

data/lib/aws-sdk-core/process_credentials.rb

@@ -0,0 +1,80 @@
+require 'open3'
+
+module Aws
+
+  # A credential provider that executes a given process and attempts
+  # to read its stdout to recieve a JSON payload containing the credentials
+  #
+  # Automatically handles refreshing credentials if an Expiration time is 
+  # provided in the credentials payload
+  #
+  #     credentials = Aws::ProcessCredentials.new('/usr/bin/credential_proc').credentials
+  #
+  #     ec2 = Aws::EC2::Client.new(credentials: credentials)
+  #
+  # More documentation on process based credentials can be found here:
+  # https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#sourcing-credentials-from-external-processes
+  class ProcessCredentials
+
+    include CredentialProvider
+    include RefreshingCredentials
+
+    # Creates a new ProcessCredentials object, which allows an
+    # external process to be used as a credential provider.
+    #
+    # @param [String] process Invocation string for process
+    # credentials provider. 
+    def initialize(process)
+      @process = process
+      @credentials = credentials_from_process(@process)
+      
+      super
+    end
+
+    private
+    def credentials_from_process(proc_invocation)
+      begin
+        raw_out, process_status = Open3.capture2(proc_invocation)
+      rescue Errno::ENOENT
+        raise Errors::InvalidProcessCredentialsPayload.new("Could not find process #{proc_invocation}")
+      end
+
+      if process_status.success?
+        begin
+          creds_json = JSON.parse(raw_out)
+        rescue JSON::ParserError
+          raise Errors::InvalidProcessCredentialsPayload.new("Invalid JSON response")
+        end
+        payload_version = creds_json['Version']
+        if payload_version == 1
+          _parse_payload_format_v1(creds_json)
+        else
+          raise Errors::InvalidProcessCredentialsPayload.new("Invalid version #{payload_version} for credentials payload")
+        end
+      else
+        raise Errors::InvalidProcessCredentialsPayload.new('credential_process provider failure, the credential process had non zero exit status and failed to provide credentials')
+      end
+    end
+
+    def _parse_payload_format_v1(creds_json)
+      creds = Credentials.new(
+        creds_json['AccessKeyId'],
+        creds_json['SecretAccessKey'],
+        creds_json['SessionToken']
+      )
+
+      @expiration = creds_json['Expiration'] ? Time.iso8601(creds_json['Expiration']) : nil
+      return creds if creds.set?
+      raise Errors::InvalidProcessCredentialsPayload.new("Invalid payload for JSON credentials version 1")
+    end
+
+    def refresh
+      @credentials = credentials_from_process(@process)
+    end
+
+    def near_expiration?
+      # are we within 5 minutes of expiration?
+      @expiration && (Time.now.to_i + 5 * 60) > @expiration.to_i
+    end
+  end
+end

data/lib/aws-sdk-core/query.rb

@@ -0,0 +1,5 @@
+require_relative 'query/ec2_param_builder'
+require_relative 'query/handler'
+require_relative 'query/param'
+require_relative 'query/param_builder'
+require_relative 'query/param_list'

data/lib/aws-sdk-core/query/ec2_param_builder.rb

@@ -45,7 +45,7 @@ module Aws
         when ListShape      then list(ref, value, prefix)
         when MapShape       then raise NotImplementedError
         when BlobShape      then set(prefix, blob(value))
-        when TimestampShape then set(prefix, timestamp(value))
+        when TimestampShape then set(prefix, timestamp(ref, value))
         else
           set(prefix, value.to_s)
         end
@@ -68,8 +68,14 @@ module Aws
         Base64.strict_encode64(value)
       end
 
-      def timestamp(value)
-        value.utc.iso8601
+      def timestamp(ref, value)
+        case ref['timestampFormat'] || ref.shape['timestampFormat']
+        when 'unixTimestamp' then value.to_i
+        when 'rfc822' then value.utc.httpdate
+        else
+          # ec2 defaults to iso8601
+          value.utc.iso8601
+        end
       end
 
     end

data/lib/aws-sdk-core/query/handler.rb

@@ -1,4 +1,5 @@
 module Aws
+  # @api private
   module Query
     class Handler < Seahorse::Client::Handler
 
@@ -6,16 +7,16 @@ module Aws
 
       CONTENT_TYPE = 'application/x-www-form-urlencoded; charset=utf-8'
 
-      WRAPPER_STRUCT = Structure.new(:result, :response_metadata)
+      WRAPPER_STRUCT = ::Struct.new(:result, :response_metadata)
 
-      METADATA_STRUCT = Structure.new(:request_id)
+      METADATA_STRUCT = ::Struct.new(:request_id)
 
       METADATA_REF = begin
         request_id = ShapeRef.new(
           shape: StringShape.new,
           location_name: 'RequestId')
         response_metadata = StructureShape.new
-        response_metadata[:struct_class] = METADATA_STRUCT
+        response_metadata.struct_class = METADATA_STRUCT
         response_metadata.add_member(:request_id, request_id)
         ShapeRef.new(shape: response_metadata, location_name: 'ResponseMetadata')
       end
@@ -26,7 +27,12 @@ module Aws
         build_request(context)
         @handler.call(context).on_success do |response|
           response.error = nil
-          response.data = parse_xml(context)
+          parsed = parse_xml(context)
+          if parsed.nil? || parsed == EmptyStructure
+            response.data = EmptyStructure.new
+          else
+            response.data = parsed
+          end
         end
       end
 
@@ -49,12 +55,8 @@ module Aws
       end
 
       def parse_xml(context)
-        if context.operation.output
-          data = Xml::Parser.new(rules(context)).parse(xml(context))
-          remove_wrapper(data, context)
-        else
-          EmptyStructure.new
-        end
+        data = Xml::Parser.new(rules(context)).parse(xml(context))
+        remove_wrapper(data, context)
       end
 
       def xml(context)
@@ -63,11 +65,13 @@ module Aws
 
       def rules(context)
         shape = Seahorse::Model::Shapes::StructureShape.new
-        shape.add_member(:result, ShapeRef.new(
-          shape: context.operation.output.shape,
-          location_name: context.operation.name + 'Result'
-        ))
-        shape[:struct_class] = WRAPPER_STRUCT
+        if context.operation.output
+          shape.add_member(:result, ShapeRef.new(
+            shape: context.operation.output.shape,
+            location_name: context.operation.name + 'Result'
+          ))
+        end
+        shape.struct_class = WRAPPER_STRUCT
         shape.add_member(:response_metadata, METADATA_REF)
         ShapeRef.new(shape: shape)
       end
@@ -77,7 +81,7 @@ module Aws
           if data.response_metadata
             context[:request_id] = data.response_metadata.request_id
           end
-          data.result || Structure.new(context.operation.output.shape.member_names)
+          data.result || Structure.new(*context.operation.output.shape.member_names)
         else
           data
         end