aws-sdk-core 2.11.386 → 3.68.1

data/lib/aws-sdk-core/plugins/regional_endpoint.rb

@@ -1,14 +1,6 @@
 module Aws
   module Plugins
-
-    # @seahorse.client.option [required, String] :region
-    #   The AWS region to connect to.  The region is used to construct
-    #   the client endpoint.  Defaults to `ENV['AWS_REGION']`.
-    #   Also checks `AMAZON_REGION` and `AWS_DEFAULT_REGION`.
-    #
-    # @seahorse.client.option [String] :endpoint A default endpoint is
-    #   constructed from the `:region`.
-    #
+    # @api private
     class RegionalEndpoint < Seahorse::Client::Plugin
 
       # raised when region is not configured
@@ -16,26 +8,40 @@ module Aws
 
       option(:profile)
 
-      option(:region) do |cfg|
+      option(:region,
+        required: true,
+        doc_type: String,
+        docstring: <<-DOCS) do |cfg|
+The AWS region to connect to.  The configured `:region` is
+used to determine the service `:endpoint`. When not passed,
+a default `:region` is search for in the following locations:
+
+* `Aws.config[:region]`
+* `ENV['AWS_REGION']`
+* `ENV['AMAZON_REGION']`
+* `ENV['AWS_DEFAULT_REGION']`
+* `~/.aws/credentials`
+* `~/.aws/config`
+        DOCS
         resolve_region(cfg)
       end
 
       option(:regional_endpoint, false)
 
-      option(:endpoint) do |cfg|
+      option(:endpoint, doc_type: String, docstring: <<-DOCS) do |cfg|
+The client endpoint is normally constructed from the `:region`
+option. You should only configure an `:endpoint` when connecting
+to test endpoints. This should be avalid HTTP(S) URI.
+        DOCS
         endpoint_prefix = cfg.api.metadata['endpointPrefix']
         if cfg.region && endpoint_prefix
-          EndpointProvider.resolve(cfg.region, endpoint_prefix)
-          sts_regional = cfg.respond_to?(:sts_regional_endpoints) ? cfg.sts_regional_endpoints : nil
-          EndpointProvider.resolve(cfg.region, endpoint_prefix, sts_regional)
+          Aws::Partitions::EndpointProvider.resolve(cfg.region, endpoint_prefix)
         end
       end
 
       def after_initialize(client)
         if client.config.region.nil? or client.config.region == ''
-          msg = "missing region; use :region option or "
-          msg << "export region name to ENV['AWS_REGION']"
-          raise Errors::MissingRegionError, msg
+          raise Errors::MissingRegionError
         end
       end
 

data/lib/aws-sdk-core/plugins/response_paging.rb

@@ -1,35 +1,22 @@
 module Aws
   module Plugins
+    # @api private
     class ResponsePaging < Seahorse::Client::Plugin
 
-      def add_handlers(handlers, config)
-        handlers.add(Handler,
-          operations: pageable_operations(config),
-          step: :initialize,
-          priority: 90)
-      end
-
-      private
-
-      def pageable_operations(config)
-        config.api.operations.inject([]) do |pageable, (name, operation)|
-          pageable << name if operation[:pager]
-          pageable
-        end
-      end
-
-      # @api private
       class Handler < Seahorse::Client::Handler
 
         def call(context)
           context[:original_params] = context.params
           resp = @handler.call(context)
           resp.extend(PageableResponse)
-          resp.pager = context.operation[:pager]
+          resp.pager = context.operation[:pager] || Aws::Pager::NullPager.new
           resp
         end
 
       end
+
+      handle(Handler, step: :initialize, priority: 90)
+
     end
   end
 end

data/lib/aws-sdk-core/plugins/retry_errors.rb

@@ -2,18 +2,67 @@ require 'set'
 
 module Aws
   module Plugins
-
-    # @seahorse.client.option [Integer] :retry_limit (3)
-    #   The maximum number of times to retry failed requests.  Only
-    #   ~ 500 level server errors and certain ~ 400 level client errors
-    #   are retried.  Generally, these are throttling errors, data
-    #   checksum errors, networking errors, timeout errors and auth
-    #   errors from expired credentials.
+    # @api private
     class RetryErrors < Seahorse::Client::Plugin
 
-      option(:retry_limit, 3)
+      EQUAL_JITTER = lambda { |delay| (delay / 2) + Kernel.rand(0..(delay/2))}
+      FULL_JITTER = lambda { |delay| Kernel.rand(0..delay) }
+      NO_JITTER = lambda { |delay| delay }
+
+      JITTERS = {
+        none: NO_JITTER,
+        equal: EQUAL_JITTER,
+        full: FULL_JITTER
+      }
+
+      JITTERS.default_proc = lambda { |h,k|
+        raise KeyError, "#{k} is not a named jitter function. Must be one of #{h.keys}"
+      }
+
+      DEFAULT_BACKOFF = lambda do |c|
+        delay = 2 ** c.retries * c.config.retry_base_delay
+        delay = [delay, c.config.retry_max_delay].min if (c.config.retry_max_delay || 0) > 0
+        jitter = c.config.retry_jitter
+        jitter = JITTERS[jitter] if Symbol === jitter
+        delay = jitter.call(delay) if jitter
+        Kernel.sleep(delay)
+      end
 
-      option(:retry_backoff, lambda { |c| Kernel.sleep(2 ** c.retries * 0.3) })
+      option(:retry_limit,
+        default: 3,
+        doc_type: Integer,
+        docstring: <<-DOCS)
+The maximum number of times to retry failed requests.  Only
+~ 500 level server errors and certain ~ 400 level client errors
+are retried.  Generally, these are throttling errors, data
+checksum errors, networking errors, timeout errors and auth
+errors from expired credentials.
+        DOCS
+
+      option(:retry_max_delay,
+        default: 0,
+        doc_type: Integer,
+        docstring: <<-DOCS)
+The maximum number of seconds to delay between retries (0 for no limit) used by the default backoff function.
+        DOCS
+
+      option(:retry_base_delay,
+        default: 0.3,
+        doc_type: Float,
+        docstring: <<-DOCS)
+The base delay in seconds used by the default backoff function.
+        DOCS
+
+      option(:retry_jitter,
+        default: :none,
+        doc_type: Symbol,
+        docstring: <<-DOCS)
+A delay randomiser function used by the default backoff function. Some predefined functions can be referenced by name - :none, :equal, :full, otherwise a Proc that takes and returns a number.
+
+@see https://www.awsarchitectureblog.com/2015/03/backoff.html
+        DOCS
+
+      option(:retry_backoff, DEFAULT_BACKOFF)
 
       # @api private
       class ErrorInspector
@@ -23,17 +72,22 @@ module Aws
           'UnrecognizedClientException', # json services
           'InvalidAccessKeyId',          # s3
           'AuthFailure',                 # ec2
+          'InvalidIdentityToken',        # sts
+          'ExpiredToken',                # route53
         ])
 
         THROTTLING_ERRORS = Set.new([
           'Throttling',                             # query services
           'ThrottlingException',                    # json services
           'RequestThrottled',                       # sqs
+          'RequestThrottledException',
           'ProvisionedThroughputExceededException', # dynamodb
+          'TransactionInProgressException',         # dynamodb
           'RequestLimitExceeded',                   # ec2
           'BandwidthLimitExceeded',                 # cloud search
           'LimitExceededException',                 # kinesis
           'TooManyRequestsException',               # batch
+          'PriorRequestNotComplete',                # route53
         ])
 
         CHECKSUM_ERRORS = Set.new([
@@ -41,7 +95,8 @@ module Aws
         ])
 
         NETWORKING_ERRORS = Set.new([
-          'RequestTimeout', # s3
+          'RequestTimeout',         # s3
+          'IDPCommunicationError',  # sts
         ])
 
         def initialize(error, http_status_code)
@@ -55,7 +110,7 @@ module Aws
         end
 
         def throttling_error?
-          !!(THROTTLING_ERRORS.include?(@name) || @name.match(/throttl/i))
+          !!(THROTTLING_ERRORS.include?(@name) || @name.match(/throttl/i) || @http_status_code == 429)
         end
 
         def checksum?
@@ -64,6 +119,7 @@ module Aws
 
         def networking?
           @error.is_a?(Seahorse::Client::NetworkingError) ||
+          @error.is_a?(Errors::NoSuchEndpointError) ||
           NETWORKING_ERRORS.include?(@name)
         end
 
@@ -90,8 +146,21 @@ module Aws
           end
         end
 
+        def retryable?(context)
+          (expired_credentials? and refreshable_credentials?(context)) or
+            throttling_error? or
+            checksum? or
+            networking? or
+            server? or
+            endpoint_discovery?(context)
+        end
+
         private
 
+        def refreshable_credentials?(context)
+          context.config.credentials.respond_to?(:refresh!)
+        end
+
         def extract_name(error)
           if error.is_a?(Errors::ServiceError)
             error.class.code
@@ -144,24 +213,11 @@ module Aws
         end
 
         def should_retry?(context, error)
-          retryable?(context, error) and
+          error.retryable?(context) and
           context.retries < retry_limit(context) and
           response_truncatable?(context)
         end
 
-        def retryable?(context, error)
-          (error.expired_credentials? and refreshable_credentials?(context)) or
-          error.throttling_error? or
-          error.checksum? or
-          error.networking? or
-          error.server? or
-          error.endpoint_discovery?(context)
-        end
-
-        def refreshable_credentials?(context)
-          context.config.credentials.respond_to?(:refresh!)
-        end
-
         def retry_limit(context)
           context.config.retry_limit
         end

data/lib/aws-sdk-core/plugins/signature_v2.rb

@@ -0,0 +1,51 @@
+module Aws
+  module Plugins
+    # @api private
+    class SignatureV2 < Seahorse::Client::Plugin
+
+      option(:v2_signer) do |cfg|
+        Aws::Sigv2::Signer.new(credentials_provider: cfg.credentials)
+      end
+
+      def add_handlers(handlers, _)
+        handlers.add(Handler, step: :sign)
+      end
+
+      class Handler < Seahorse::Client::Handler
+
+        def call(context)
+          apply_signature(
+            context.http_request,
+            context.config.v2_signer
+          )
+          @handler.call(context)
+        end
+
+        private
+
+        def apply_signature(req, signer)
+
+          param_list = req.body.param_list
+          param_list.delete('Timestamp') # in case of re-signing
+
+          signature = signer.sign_request(
+            http_method: req.http_method,
+            url: req.endpoint,
+            params: param_list.inject({}) do |hash, param|
+              hash[param.name] = param.value
+              hash
+            end
+          )
+
+          # apply signature
+          signature.each_pair do |param_name, param_value|
+            param_list.set(param_name, param_value)
+          end
+
+          req.body = param_list.to_io
+
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-core/plugins/signature_v4.rb

@@ -0,0 +1,141 @@
+require 'aws-sigv4'
+
+module Aws
+  module Plugins
+    # @api private
+    class SignatureV4 < Seahorse::Client::Plugin
+
+      option(:sigv4_signer) do |cfg|
+        SignatureV4.build_signer(cfg)
+      end
+
+      option(:sigv4_name) do |cfg|
+        cfg.api.metadata['signingName'] || cfg.api.metadata['endpointPrefix']
+      end
+
+      option(:sigv4_region) do |cfg|
+
+        # The signature version 4 signing region is most
+        # commonly the configured region. There are a few
+        # notable exceptions:
+        #
+        # * Some services have a global endpoint to the entire
+        #   partition. For example, when constructing a route53
+        #   client for a region like "us-west-2", we will
+        #   always use "route53.amazonaws.com". This endpoint
+        #   is actually global to the entire partition,
+        #   and must be signed as "us-east-1".
+        #
+        # * When the region is configured, but it is configured
+        #   to a non region, such as "aws-global". This is similar
+        #   to the previous case. We use the Aws::Partitions::EndpointProvider
+        #   to resolve to the actual signing region.
+        #
+        prefix = cfg.api.metadata['endpointPrefix']
+        if prefix && cfg.endpoint.to_s.match(/#{prefix}\.amazonaws\.com/)
+          'us-east-1'
+        elsif cfg.region
+          Aws::Partitions::EndpointProvider.signing_region(cfg.region, cfg.sigv4_name)
+        end
+      end
+
+      option(:unsigned_operations) do |cfg|
+        cfg.api.operation_names.inject([]) do |unsigned, operation_name|
+          if cfg.api.operation(operation_name)['authtype'] == 'none' ||
+            cfg.api.operation(operation_name)['authtype'] == 'custom'
+            # Unsign requests that has custom apigateway authorizer as well
+            unsigned << operation_name
+          else
+            unsigned
+          end
+        end
+      end
+
+      def add_handlers(handlers, cfg)
+        if cfg.unsigned_operations.empty?
+          handlers.add(Handler, step: :sign)
+        else
+          operations = cfg.api.operation_names - cfg.unsigned_operations
+          handlers.add(Handler, step: :sign, operations: operations)
+        end
+      end
+
+      class Handler < Seahorse::Client::Handler
+        def call(context)
+          SignatureV4.apply_signature(context: context)
+          @handler.call(context)
+        end
+      end
+
+      class MissingCredentialsSigner
+        def sign_request(*args)
+          raise Errors::MissingCredentialsError
+        end
+      end
+
+      class << self
+
+        # @api private
+        def build_signer(cfg)
+          if cfg.credentials && cfg.sigv4_region
+            Aws::Sigv4::Signer.new(
+              service: cfg.sigv4_name,
+              region: cfg.sigv4_region,
+              credentials_provider: cfg.credentials,
+              unsigned_headers: ['content-length', 'user-agent', 'x-amzn-trace-id']
+            )
+          elsif cfg.credentials
+            raise Errors::MissingRegionError
+          elsif cfg.sigv4_region
+            # Instead of raising now, we return a signer that raises only
+            # if you attempt to sign a request. Some services have unsigned
+            # operations and it okay to initialize clients for these services
+            # without credentials. Unsigned operations have an "authtype"
+            # trait of "none".
+            MissingCredentialsSigner.new
+          end
+        end
+
+        # @api private
+        def apply_signature(options = {})
+          context = apply_authtype(options[:context])
+          signer = options[:signer] || context.config.sigv4_signer
+          req = context.http_request
+
+          # in case this request is being re-signed
+          req.headers.delete('Authorization')
+          req.headers.delete('X-Amz-Security-Token')
+          req.headers.delete('X-Amz-Date')
+
+          # compute the signature
+          begin
+            signature = signer.sign_request(
+              http_method: req.http_method,
+              url: req.endpoint,
+              headers: req.headers,
+              body: req.body
+            )
+          rescue Aws::Sigv4::Errors::MissingCredentialsError
+            raise Aws::Errors::MissingCredentialsError
+          end
+
+          # apply signature headers
+          req.headers.update(signature.headers)
+
+          # add request metadata with signature components for debugging
+          context[:canonical_request] = signature.canonical_request
+          context[:string_to_sign] = signature.string_to_sign
+        end
+
+        # @api private
+        def apply_authtype(context)
+          if context.operation['authtype'].eql?('v4-unsigned-body') &&
+            context.http_request.endpoint.scheme.eql?('https')
+            context.http_request.headers['X-Amz-Content-Sha256'] = 'UNSIGNED-PAYLOAD'
+          end
+          context
+        end
+      end
+    end
+  end
+end