aws-sdk-core 2.3.23 → 3.89.1

data/lib/aws-sdk-core/errors.rb

@@ -1,10 +1,8 @@
-require 'thread'
-
 module Aws
-
-  # Each Service module has its own Errors module, e.g. {S3::Errors}.
   module Errors
 
+    class NonSupportedRubyVersionError < RuntimeError; end
+
     # The base class for all errors returned by an Amazon Web Service.
     # All ~400 level client errors and ~500 level server errors are raised
     # as service errors.  This indicates it was an error returned from the
@@ -13,9 +11,12 @@ module Aws
 
       # @param [Seahorse::Client::RequestContext] context
       # @param [String] message
-      def initialize(context, message)
+      # @param [Aws::Structure] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
         @code = self.class.code
+        @message = message if message && !message.empty?
         @context = context
+        @data = data
         super(message)
       end
 
@@ -26,6 +27,9 @@ module Aws
       #   that triggered the remote service to return this error.
       attr_reader :context
 
+      # @return [Aws::Structure]
+      attr_reader :data
+
       class << self
 
         # @return [String]
@@ -34,20 +38,222 @@ module Aws
       end
     end
 
+    # Raised when InstanceProfileCredentialsProvider or
+    # EcsCredentialsProvider fails to parse the metadata response after retries
+    class MetadataParserError < RuntimeError
+      def initialize(*args)
+        msg = "Failed to parse metadata service response."
+        super(msg)
+      end
+    end
+
+    # Raised when a `streaming` operation has `requiresLength` trait
+    # enabled but request payload size/length cannot be calculated
+    class MissingContentLength < RuntimeError
+      def initialize(*args)
+        msg = 'Required `Content-Length` value missing for the request.'
+        super(msg)
+      end
+    end
+
+    # Rasied when endpoint discovery failed for operations
+    # that requires endpoints from endpoint discovery
+    class EndpointDiscoveryError < RuntimeError
+      def initialize(*args)
+        msg = 'Endpoint discovery failed for the operation or discovered endpoint is not working, '\
+          'request will keep failing until endpoint discovery succeeds or :endpoint option is provided.'
+        super(msg)
+      end
+    end
+
+    # raised when hostLabel member is not provided
+    # at operation input when endpoint trait is available
+    # with 'hostPrefix' requirement
+    class MissingEndpointHostLabelValue < RuntimeError
+
+      def initialize(name)
+        msg = "Missing required parameter #{name} to construct"\
+          " endpoint host prefix. You can disable host prefix by"\
+          " setting :disable_host_prefix_injection to `true`."
+        super(msg)
+      end
+
+    end
+
+    # Raised when attempting to #signal an event before
+    # making an async request
+    class SignalEventError < RuntimeError; end
+
+    # Raised when EventStream Parser failed to parse
+    # a raw event message
+    class EventStreamParserError < RuntimeError; end
+
+    # Raise when EventStream Builder failed to build
+    # an event message with parameters provided
+    class EventStreamBuilderError < RuntimeError; end
+
+    # Error event in an event stream which has event_type :error
+    # error code and error message can be retrieved when available.
+    #
+    # example usage:
+    #
+    #   client.stream_foo(name: 'bar') do |event|
+    #     stream.on_error_event do |event|
+    #       puts "Error #{event.error_code}: #{event.error_message}"
+    #       raise event
+    #     end
+    #   end
+    #
+    class EventError < RuntimeError
+
+      def initialize(event_type, code, message)
+        @event_type = event_type
+        @error_code = code
+        @error_message = message
+      end
+
+      # @return [Symbol]
+      attr_reader :event_type
+
+      # @return [String]
+      attr_reader :error_code
+
+      # @return [String]
+      attr_reader :error_message
+
+    end
+
+    # Raised when ARN string input doesn't follow the standard:
+    # https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-arns
+    class InvalidARNError < RuntimeError; end
+
+    # Raised when the region from the ARN string is different from the :region
+    # configured on the service client.
+    class InvalidARNRegionError < RuntimeError
+      def initialize(*args)
+        msg = 'ARN region is different from the configured client region.'
+        super(msg)
+      end
+    end
+
+    # Raised when the partition of the ARN region is different than the
+    # partition of the :region configured on the service client.
+    class InvalidARNPartitionError < RuntimeError
+      def initialize(*args)
+        msg = 'ARN region partition is different from the configured '\
+              'client region partition.'
+        super(msg)
+      end
+    end
+
     # Various plugins perform client-side checksums of responses.
     # This error indicates a checksum failed.
     class ChecksumError < RuntimeError; end
 
-    # Raised when a {Service} is constructed and the specified shared
+    # Raised when a client is constructed and the specified shared
     # credentials profile does not exist.
     class NoSuchProfileError < RuntimeError; end
 
-    # Raised when a {Service} is constructed and credentials are not
+    # Raised when a client is constructed, where Assume Role credentials are
+    # expected, and there is no source profile specified.
+    class NoSourceProfileError < RuntimeError; end
+
+    # Raised when a client is constructed with Assume Role credentials using
+    # a credential_source, and that source type is unsupported.
+    class InvalidCredentialSourceError < RuntimeError; end
+
+    # Raised when a client is constructed with Assume Role credentials, but
+    # the profile has both source_profile and credential_source.
+    class CredentialSourceConflictError < RuntimeError; end
+
+    # Raised when a client is constructed with Assume Role credentials using
+    # a credential_source, and that source doesn't provide credentials.
+    class NoSourceCredentialsError < RuntimeError; end
+
+    # Raised when a client is constructed and credentials are not
     # set, or the set credentials are empty.
-    class MissingCredentialsError < RuntimeError; end
+    class MissingCredentialsError < RuntimeError
+      def initialize(*args)
+        msg = 'unable to sign request without credentials set'
+        super(msg)
+      end
+    end
+
+    # Raised when :web_identity_token_file parameter is not
+    # provided or the file doesn't exist when initializing
+    # AssumeRoleWebIdentityCredentials credential provider
+    class MissingWebIdentityTokenFile < RuntimeError
+      def initialize(*args)
+        msg = 'Missing :web_identity_token_file parameter or'\
+          ' invalid file path provided for'\
+          ' Aws::AssumeRoleWebIdentityCredentials provider'
+        super(msg)
+      end
+    end
+
+    # Raised when a credentials provider process returns a JSON
+    # payload with either invalid version number or malformed contents
+    class InvalidProcessCredentialsPayload < RuntimeError; end
+
+    # Raised when a client is constructed and region is not specified.
+    class MissingRegionError < ArgumentError
+      def initialize(*args)
+        msg = "missing region; use :region option or "
+        msg << "export region name to ENV['AWS_REGION']"
+        super(msg)
+      end
+    end
+
+    # Raised when attempting to connect to an endpoint and a `SocketError`
+    # is received from the HTTP client. This error is typically the result
+    # of configuring an invalid `:region`.
+    class NoSuchEndpointError < RuntimeError
+
+      def initialize(options = {})
+        @context = options[:context]
+        @endpoint = @context.http_request.endpoint
+        @original_error = options[:original_error]
+        super(<<-MSG)
+Encountered a `SocketError` while attempting to connect to:
 
-    # Raised when a {Service} is constructed and region is not specified.
-    class MissingRegionError < ArgumentError; end
+  #{endpoint.to_s}
+
+This is typically the result of an invalid `:region` option or a
+poorly formatted `:endpoint` option.
+
+* Avoid configuring the `:endpoint` option directly. Endpoints are constructed
+  from the `:region`. The `:endpoint` option is reserved for connecting to
+  non-standard test endpoints.
+
+* Not every service is available in every region.
+
+* Never suffix region names with availability zones.
+  Use "us-east-1", not "us-east-1a"
+
+Known AWS regions include (not specific to this service):
+
+#{possible_regions}
+        MSG
+      end
+
+      attr_reader :context
+
+      attr_reader :endpoint
+
+      attr_reader :original_error
+
+      private
+
+      def possible_regions
+        Aws.partitions.inject([]) do |region_names, partition|
+          partition.regions.each do |region|
+            region_names << region.name
+          end
+          region_names
+        end.join("\n")
+      end
+
+    end
 
     # This module is mixed into another module, providing dynamic
     # error classes.  Error classes all inherit from {ServiceError}.
@@ -82,7 +288,11 @@ module Aws
       def error_class(error_code)
         constant = error_class_constant(error_code)
         if error_const_set?(constant)
-          const_get(constant)
+          # modeled error class exist
+          # set code attribute
+          err_class = const_get(constant)
+          err_class.code = constant.to_s
+          err_class
         else
           set_error_constant(constant)
         end

data/lib/aws-sdk-core/event_emitter.rb

@@ -0,0 +1,62 @@
+module Aws
+  class EventEmitter
+
+    def initialize
+      @listeners = {}
+      @validate_event = true
+      @status = :sleep
+      @signal_queue = Queue.new
+    end
+
+    attr_accessor :stream
+
+    attr_accessor :encoder
+
+    attr_accessor :validate_event
+
+    attr_accessor :signal_queue
+
+    def on(type, callback)
+      (@listeners[type] ||= []) << callback
+    end
+
+    def signal(type, event)
+      return unless @listeners[type]
+      @listeners[type].each do |listener|
+        listener.call(event) if event.event_type == type
+      end
+    end
+
+    def emit(type, params)
+      unless @stream
+        raise Aws::Errors::SignalEventError.new(
+          "Singaling events before making async request"\
+          " is not allowed."
+        )
+      end
+      if @validate_event && type != :end_stream
+        Aws::ParamValidator.validate!(
+          @encoder.rules.shape.member(type), params)
+      end
+      _ready_for_events?
+      @stream.data(
+        @encoder.encode(type, params),
+        end_stream: type == :end_stream
+      )
+    end
+
+    private
+
+    def _ready_for_events?
+      return true if @status == :ready
+
+      # blocked until once initial 200 response is received
+      # signal will be available in @signal_queue
+      # and this check will no longer be blocked
+      @signal_queue.pop
+      @status = :ready
+      true
+    end
+
+  end
+end

data/lib/aws-sdk-core/ini_parser.rb

@@ -0,0 +1,41 @@
+module Aws
+  # @api private
+  class IniParser
+    class << self
+
+      def ini_parse(raw)
+        current_profile = nil
+        current_prefix = nil
+        raw.lines.inject({}) do |acc, line|
+          line = line.split(/^|\s;/).first # remove comments
+          profile = line.match(/^\[([^\[\]]+)\]\s*(#.+)?$/) unless line.nil?
+          if profile
+            current_profile = profile[1]
+            named_profile = current_profile.match(/^profile\s+(.+?)$/)
+            current_profile = named_profile[1] if named_profile
+          elsif current_profile
+            unless line.nil?
+              item = line.match(/^(.+?)\s*=\s*(.+?)\s*$/)
+              prefix = line.match(/^(.+?)\s*=\s*$/)
+            end
+            if item && item[1].match(/^\s+/)
+              # Need to add lines to a nested configuration.
+              inner_item = line.match(/^\s*(.+?)\s*=\s*(.+?)\s*$/)
+              acc[current_profile] ||= {}
+              acc[current_profile][current_prefix] ||= {}
+              acc[current_profile][current_prefix][inner_item[1]] = inner_item[2]
+            elsif item
+              current_prefix = nil
+              acc[current_profile] ||= {}
+              acc[current_profile][item[1]] = item[2]
+            elsif prefix
+              current_prefix = prefix[1]
+            end
+          end
+          acc
+        end
+      end
+
+    end
+  end
+end

data/lib/aws-sdk-core/instance_profile_credentials.rb

@@ -11,6 +11,12 @@ module Aws
     # @api private
     class Non200Response < RuntimeError; end
 
+    # @api private
+    class TokenRetrivalError < RuntimeError; end
+
+    # @api private
+    class TokenExpiredError < RuntimeError; end
+
     # These are the errors we trap when attempting to talk to the
     # instance metadata service.  Any of these imply the service
     # is not present, no responding or some other non-recoverable
@@ -23,16 +29,24 @@ module Aws
       Errno::ENETUNREACH,
       SocketError,
       Timeout::Error,
-      Non200Response,
-    ]
+      Non200Response
+    ].freeze
+
+    # Path base for GET request for profile and credentials
+    # @api private
+    METADATA_PATH_BASE = '/latest/meta-data/iam/security-credentials/'.freeze
+
+    # Path for PUT request for token
+    # @api private
+    METADATA_TOKEN_PATH = '/latest/api/token'.freeze
 
     # @param [Hash] options
-    # @option options [Integer] :retries (5) Number of times to retry
+    # @option options [Integer] :retries (1) Number of times to retry
     #   when retrieving credentials.
     # @option options [String] :ip_address ('169.254.169.254')
     # @option options [Integer] :port (80)
-    # @option options [Float] :http_open_timeout (5)
-    # @option options [Float] :http_read_timeout (5)
+    # @option options [Float] :http_open_timeout (1)
+    # @option options [Float] :http_read_timeout (1)
     # @option options [Numeric, Proc] :delay By default, failures are retried
     #   with exponential back-off, i.e. `sleep(1.2 ** num_failures)`. You can
     #   pass a number of seconds to sleep between failed attempts, or
@@ -40,19 +54,25 @@ module Aws
     # @option options [IO] :http_debug_output (nil) HTTP wire
     #   traces are sent to this object.  You can specify something
     #   like $stdout.
-    def initialize options = {}
-      @retries = options[:retries] || 5
+    # @option options [Integer] :token_ttl Time-to-Live in seconds for EC2
+    #   Metadata Token used for fetching Metadata Profile Credentials, defaults
+    #   to 21600 seconds
+    def initialize(options = {})
+      @retries = options[:retries] || 1
       @ip_address = options[:ip_address] || '169.254.169.254'
       @port = options[:port] || 80
-      @http_open_timeout = options[:http_open_timeout] || 5
-      @http_read_timeout = options[:http_read_timeout] || 5
+      @http_open_timeout = options[:http_open_timeout] || 1
+      @http_read_timeout = options[:http_read_timeout] || 1
       @http_debug_output = options[:http_debug_output]
       @backoff = backoff(options[:backoff])
+      @token_ttl = options[:token_ttl] || 21_600
+      @token = nil
       super
     end
 
-    # @return [Integer] The number of times to retry failed atttempts to
-    #   fetch credentials from the instance metadata service. Defaults to 0.
+    # @return [Integer] Number of times to retry when retrieving credentials
+    #   from the instance metadata service. Defaults to 0 when resolving from
+    #   the default credential chain ({Aws::CredentialProviderChain}).
     attr_reader :retries
 
     private
@@ -60,8 +80,8 @@ module Aws
     def backoff(backoff)
       case backoff
       when Proc then backoff
-      when Numeric then lambda { |_| sleep(backoff) }
-      else lambda { |num_failures| Kernel.sleep(1.2 ** num_failures) }
+      when Numeric then ->(_) { sleep(backoff) }
+      else ->(num_failures) { Kernel.sleep(1.2**num_failures) }
       end
     end
 
@@ -69,33 +89,67 @@ module Aws
       # Retry loading credentials up to 3 times is the instance metadata
       # service is responding but is returning invalid JSON documents
       # in response to the GET profile credentials call.
-      retry_errors([JSON::ParserError, StandardError], max_retries: 3) do
-        c = JSON.parse(get_credentials.to_s)
-        @credentials = Credentials.new(
-          c['AccessKeyId'],
-          c['SecretAccessKey'],
-          c['Token']
-        )
-        @expiration = c['Expiration'] ? Time.parse(c['Expiration']) : nil
+      begin
+        retry_errors([JSON::ParserError, StandardError], max_retries: 3) do
+          c = JSON.parse(get_credentials.to_s)
+          @credentials = Credentials.new(
+            c['AccessKeyId'],
+            c['SecretAccessKey'],
+            c['Token']
+          )
+          @expiration = c['Expiration'] ? Time.iso8601(c['Expiration']) : nil
+        end
+      rescue JSON::ParserError
+        raise Aws::Errors::MetadataParserError
       end
     end
 
     def get_credentials
       # Retry loading credentials a configurable number of times if
       # the instance metadata service is not responding.
-      begin
-        retry_errors(NETWORK_ERRORS, max_retries: @retries) do
-          open_connection do |conn|
-            path = '/latest/meta-data/iam/security-credentials/'
-            profile_name = http_get(conn, path).lines.first.strip
-            http_get(conn, path + profile_name)
+      if _metadata_disabled?
+        '{}'
+      else
+        begin
+          retry_errors(NETWORK_ERRORS, max_retries: @retries) do
+            open_connection do |conn|
+              # attempt to fetch token to start secure flow first
+              # and rescue to failover
+              begin
+                retry_errors(NETWORK_ERRORS, max_retries: @retries) do
+                  unless token_set?
+                    token_value, ttl = http_put(
+                      conn, METADATA_TOKEN_PATH, @token_ttl
+                    )
+                    @token = Token.new(token_value, ttl) if token_value && ttl
+                  end
+                end
+              rescue *NETWORK_ERRORS
+                # token attempt failed, reset token
+                # fallback to non-token mode
+                @token = nil
+              end
+
+              token = @token.value if token_set?
+              metadata = http_get(conn, METADATA_PATH_BASE, token)
+              profile_name = metadata.lines.first.strip
+              http_get(conn, METADATA_PATH_BASE + profile_name, token)
+            end
           end
+        rescue
+          '{}'
         end
-      rescue
-        '{}'
       end
     end
 
+    def token_set?
+      @token && !@token.expired?
+    end
+
+    def _metadata_disabled?
+      ENV.fetch('AWS_EC2_METADATA_DISABLED', 'false').downcase == 'true'
+    end
+
     def open_connection
       http = Net::HTTP.new(@ip_address, @port, nil)
       http.open_timeout = @http_open_timeout
@@ -105,30 +159,67 @@ module Aws
       yield(http).tap { http.finish }
     end
 
-    def http_get(connection, path)
-      response = connection.request(Net::HTTP::Get.new(path))
-      if response.code.to_i == 200
-        response.body
+    # GET request fetch profile and credentials
+    def http_get(connection, path, token = nil)
+      headers = { 'User-Agent' => "aws-sdk-ruby3/#{CORE_GEM_VERSION}" }
+      headers['x-aws-ec2-metadata-token'] = token if token
+      response = connection.request(Net::HTTP::Get.new(path, headers))
+      raise Non200Response unless response.code.to_i == 200
+
+      response.body
+    end
+
+    # PUT request fetch token with ttl
+    def http_put(connection, path, ttl)
+      headers = {
+        'User-Agent' => "aws-sdk-ruby3/#{CORE_GEM_VERSION}",
+        'x-aws-ec2-metadata-token-ttl-seconds' => ttl.to_s
+      }
+      response = connection.request(Net::HTTP::Put.new(path, headers))
+      case response.code.to_i
+      when 200
+        [
+          response.body,
+          response.header['x-aws-ec2-metadata-token-ttl-seconds'].to_i
+        ]
+      when 400
+        raise TokenRetrivalError
+      when 401
+        raise TokenExpiredError
       else
         raise Non200Response
       end
     end
 
-    def retry_errors(error_classes, options = {}, &block)
+    def retry_errors(error_classes, options = {}, &_block)
       max_retries = options[:max_retries]
       retries = 0
       begin
         yield
-      rescue *error_classes => error
-        if retries < max_retries
-          @backoff.call(retries)
-          retries += 1
-          retry
-        else
-          raise
-        end
+      rescue *error_classes
+        raise unless retries < max_retries
+
+        @backoff.call(retries)
+        retries += 1
+        retry
       end
     end
 
+    # @api private
+    # Token used to fetch IMDS profile and credentials
+    class Token
+      def initialize(value, ttl)
+        @ttl = ttl
+        @value = value
+        @created_time = Time.now
+      end
+
+      # [String] token value
+      attr_reader :value
+
+      def expired?
+        Time.now - @created_time > @ttl
+      end
+    end
   end
 end