aws-sdk-core 3.100.0 → 3.130.0

data/lib/aws-sdk-core/rest/response/headers.rb

@@ -1,6 +1,7 @@
+# frozen_string_literal: true
+
 require 'time'
 require 'base64'
-require 'json'
 
 module Aws
   module Rest
@@ -39,8 +40,10 @@ module Aws
           when IntegerShape then value.to_i
           when FloatShape then value.to_f
           when BooleanShape then value == 'true'
+          when ListShape then
+            value.split(",").map { |v| cast_value(ref.shape.member, v) }
           when TimestampShape
-            if value =~ /\d+(\.\d*)/
+            if value =~ /^\d+(\.\d*)/
               Time.at(value.to_f)
             elsif value =~ /^\d+$/
               Time.at(value.to_i)
@@ -66,7 +69,7 @@ module Aws
         end
 
         def extract_json_trait(value)
-          JSON.parse(Base64.decode64(value))
+          Aws::Json.load(Base64.decode64(value))
         end
 
       end

data/lib/aws-sdk-core/rest/response/parser.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Rest
     module Response

data/lib/aws-sdk-core/rest/response/status_code.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Rest
     module Response

data/lib/aws-sdk-core/rest.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'rest/handler'
 require_relative 'rest/request/body'
 require_relative 'rest/request/builder'

data/lib/aws-sdk-core/shared_config.rb

@@ -1,6 +1,10 @@
+# frozen_string_literal: true
+
 module Aws
   # @api private
   class SharedConfig
+    SSO_PROFILE_KEYS = %w[sso_start_url sso_region sso_account_id sso_role_name].freeze
+
     # @return [String]
     attr_reader :credentials_path
 
@@ -96,7 +100,7 @@ module Aws
     #   or `nil` if no valid credentials were found.
     def credentials(opts = {})
       p = opts[:profile] || @profile_name
-      validate_profile_exists(p) if credentials_present?
+      validate_profile_exists(p)
       if (credentials = credentials_from_shared(p, opts))
         credentials
       elsif (credentials = credentials_from_config(p, opts))
@@ -133,6 +137,18 @@ module Aws
       end
     end
 
+    # Attempts to load from shared config or shared credentials file.
+    # Will always attempt first to load from the shared credentials
+    # file, if present.
+    def sso_credentials_from_config(opts = {})
+      p = opts[:profile] || @profile_name
+      credentials = sso_credentials_from_profile(@parsed_credentials, p)
+      if @parsed_config
+        credentials ||= sso_credentials_from_profile(@parsed_config, p)
+      end
+      credentials
+    end
+
     # Add an accessor method (similar to attr_reader) to return a configuration value
     # Uses the get_config_value below to control where
     # values are loaded from
@@ -144,8 +160,13 @@ module Aws
 
     config_reader(
       :region,
+      :ca_bundle,
       :credential_process,
       :endpoint_discovery_enabled,
+      :use_dualstack_endpoint,
+      :use_fips_endpoint,
+      :ec2_metadata_service_endpoint,
+      :ec2_metadata_service_endpoint_mode,
       :max_attempts,
       :retry_mode,
       :adaptive_retry_wait_to_fill,
@@ -156,7 +177,9 @@ module Aws
       :csm_port,
       :sts_regional_endpoints,
       :s3_use_arn_region,
-      :s3_us_east_1_regional_endpoint
+      :s3_us_east_1_regional_endpoint,
+      :s3_disable_multiregion_access_points,
+      :defaults_mode
     )
 
     private
@@ -172,11 +195,6 @@ module Aws
       value
     end
 
-    def credentials_present?
-      (@parsed_credentials && !@parsed_credentials.empty?) ||
-        (@parsed_config && !@parsed_config.empty?)
-    end
-
     def assume_role_from_profile(cfg, profile, opts, chain_config)
       if cfg && prof_cfg = cfg[profile]
         opts[:source_profile] ||= prof_cfg['source_profile']
@@ -188,6 +206,7 @@ module Aws
             'a credential_source. For assume role credentials, must '\
             'provide only source_profile or credential_source, not both.'
         elsif opts[:source_profile]
+          opts[:visited_profiles] ||= Set.new
           opts[:credentials] = resolve_source_profile(opts[:source_profile], opts)
           if opts[:credentials]
             opts[:role_session_name] ||= prof_cfg['role_session_name']
@@ -197,6 +216,7 @@ module Aws
             opts[:external_id] ||= prof_cfg['external_id']
             opts[:serial_number] ||= prof_cfg['mfa_serial']
             opts[:profile] = opts.delete(:source_profile)
+            opts.delete(:visited_profiles)
             AssumeRoleCredentials.new(opts)
           else
             raise Errors::NoSourceProfileError,
@@ -229,12 +249,27 @@ module Aws
     end
 
     def resolve_source_profile(profile, opts = {})
+      if opts[:visited_profiles] && opts[:visited_profiles].include?(profile)
+        raise Errors::SourceProfileCircularReferenceError
+      end
+      opts[:visited_profiles].add(profile) if opts[:visited_profiles]
+
+      profile_config = @parsed_credentials[profile]
+      if @config_enabled
+        profile_config ||= @parsed_config[profile]
+      end
+
       if (creds = credentials(profile: profile))
         creds # static credentials
+      elsif profile_config && profile_config['source_profile']
+        opts.delete(:source_profile)
+        assume_role_credentials_from_config(opts.merge(profile: profile))
       elsif (provider = assume_role_web_identity_credentials_from_config(opts.merge(profile: profile)))
         provider.credentials if provider.credentials.set?
       elsif (provider = assume_role_process_credentials_from_config(profile))
         provider.credentials if provider.credentials.set?
+      elsif (provider = sso_credentials_from_config(profile: profile))
+        provider.credentials if provider.credentials.set?
       end
     end
 
@@ -255,7 +290,10 @@ module Aws
 
     def assume_role_process_credentials_from_config(profile)
       validate_profile_exists(profile)
-      credential_process = @parsed_config[profile]['credential_process']
+      credential_process = @parsed_credentials.fetch(profile, {})['credential_process']
+      if @parsed_config
+        credential_process ||= @parsed_config.fetch(profile, {})['credential_process']
+      end
       ProcessCredentials.new(credential_process) if credential_process
     end
 
@@ -271,6 +309,22 @@ module Aws
       end
     end
 
+    # If any of the sso_ profile values are present, attempt to construct
+    # SSOCredentials
+    def sso_credentials_from_profile(cfg, profile)
+      if @parsed_config &&
+         (prof_config = cfg[profile]) &&
+         !(prof_config.keys & SSO_PROFILE_KEYS).empty?
+
+        SSOCredentials.new(
+          sso_start_url: prof_config['sso_start_url'],
+          sso_region: prof_config['sso_region'],
+          sso_account_id: prof_config['sso_account_id'],
+          sso_role_name: prof_config['sso_role_name']
+        )
+      end
+    end
+
     def credentials_from_profile(prof_config)
       creds = Credentials.new(
         prof_config['aws_access_key_id'],

data/lib/aws-sdk-core/shared_credentials.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'ini_parser'
 
 module Aws
@@ -12,11 +14,17 @@ module Aws
       'aws_session_token' => 'session_token',
     }
 
-    # Constructs a new SharedCredentials object. This will load AWS access
+    # Constructs a new SharedCredentials object. This will load static
+    # (access_key_id, secret_access_key and session_token) AWS access
     # credentials from an ini file, which supports profiles. The default
     # profile name is 'default'. You can specify the profile name with the
     # `ENV['AWS_PROFILE']` or with the `:profile_name` option.
     #
+    # To use credentials from the default credential resolution chain
+    # create a client without the credential option specified.
+    # You may access the resolved credentials through
+    # `client.config.credentials`.
+    #
     # @option [String] :path Path to the shared file.  Defaults
     #   to "#{Dir.home}/.aws/credentials".
     #

data/lib/aws-sdk-core/sso_credentials.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module Aws
+  # An auto-refreshing credential provider that works by assuming a
+  # role via {Aws::SSO::Client#get_role_credentials} using a cached access
+  # token.  This class does NOT implement the SSO login token flow - tokens
+  # must generated and refreshed separately by running `aws login` from the
+  # AWS CLI with the correct profile.
+  #
+  # For more background on AWS SSO see the official
+  # {https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html what is SSO Userguide}
+  #
+  # ## Refreshing Credentials from SSO
+  #
+  # The `SSOCredentials` will auto-refresh the AWS credentials from SSO. In
+  # addition to AWS credentials expiring after a given amount of time, the
+  # access token generated and cached from `aws login` will also expire.
+  # Once this token expires, it will not be usable to refresh AWS credentials,
+  # and another token will be needed. The SDK does not manage refreshing of
+  # the token value, but this can be done by running `aws login` with the
+  # correct profile.
+  #
+  #
+  #     # You must first run aws sso login --profile your-sso-profile
+  #     sso_credentials = Aws::SSOCredentials.new(
+  #       sso_account_id: '123456789',
+  #       sso_role_name: "role_name",
+  #       sso_region: "us-east-1",
+  #       sso_start_url: 'https://your-start-url.awsapps.com/start'
+  #     )
+  #
+  #     ec2 = Aws::EC2::Client.new(credentials: sso_credentials)
+  #
+  # If you omit `:client` option, a new {SSO::Client} object will be
+  # constructed.
+  class SSOCredentials
+
+    include CredentialProvider
+    include RefreshingCredentials
+
+    # @api private
+    SSO_REQUIRED_OPTS = [:sso_account_id, :sso_region, :sso_role_name, :sso_start_url].freeze
+
+    # @api private
+    SSO_LOGIN_GUIDANCE = 'The SSO session associated with this profile has '\
+    'expired or is otherwise invalid. To refresh this SSO session run '\
+    'aws sso login with the corresponding profile.'.freeze
+
+    # @option options [required, String] :sso_account_id The AWS account ID
+    #   that temporary AWS credentials will be resolved for
+    #
+    # @option options [required, String] :sso_region The AWS region where the
+    #   SSO directory for the given sso_start_url is hosted.
+    #
+    # @option options [required, String] :sso_role_name The corresponding
+    #   IAM role in the AWS account that temporary AWS credentials
+    #   will be resolved for.
+    #
+    # @option options [required, String] :sso_start_url The start URL is
+    #   provided by the SSO service via the console and is the URL used to
+    #   login to the SSO directory. This is also sometimes referred to as
+    #   the "User Portal URL"
+    #
+    # @option options [SSO::Client] :client Optional `SSO::Client`.  If not
+    #   provided, a client will be constructed.
+    #
+    # @option options [Callable] before_refresh Proc called before
+    #   credentials are refreshed. `before_refresh` is called
+    #   with an instance of this object when
+    #   AWS credentials are required and need to be refreshed.
+    def initialize(options = {})
+
+      missing_keys = SSO_REQUIRED_OPTS.select { |k| options[k].nil? }
+      unless missing_keys.empty?
+        raise ArgumentError, "Missing required keys: #{missing_keys}"
+      end
+
+      @sso_start_url = options.delete(:sso_start_url)
+      @sso_region = options.delete(:sso_region)
+      @sso_role_name = options.delete(:sso_role_name)
+      @sso_account_id = options.delete(:sso_account_id)
+
+      # validate we can read the token file
+      read_cached_token
+
+      options[:region] = @sso_region
+      options[:credentials] = nil
+      @client = options[:client] || Aws::SSO::Client.new(options)
+      @async_refresh = true
+      super
+    end
+
+    # @return [SSO::Client]
+    attr_reader :client
+
+    private
+
+    def read_cached_token
+      cached_token = Json.load(File.read(sso_cache_file))
+      # validation
+      unless cached_token['accessToken'] && cached_token['expiresAt']
+        raise ArgumentError, 'Missing required field(s)'
+      end
+      expires_at = DateTime.parse(cached_token['expiresAt'])
+      if expires_at < DateTime.now
+        raise ArgumentError, 'Cached SSO Token is expired.'
+      end
+      cached_token
+    rescue Errno::ENOENT, Aws::Json::ParseError, ArgumentError
+      raise Errors::InvalidSSOCredentials, SSO_LOGIN_GUIDANCE
+    end
+
+    def refresh
+      cached_token = read_cached_token
+      c = @client.get_role_credentials(
+        account_id: @sso_account_id,
+        role_name: @sso_role_name,
+        access_token: cached_token['accessToken']
+      ).role_credentials
+
+      @credentials = Credentials.new(
+        c.access_key_id,
+        c.secret_access_key,
+        c.session_token
+      )
+      @expiration = c.expiration
+    end
+
+    def sso_cache_file
+      start_url_sha1 = OpenSSL::Digest::SHA1.hexdigest(@sso_start_url.encode('utf-8'))
+      File.join(Dir.home, '.aws', 'sso', 'cache', "#{start_url_sha1}.json")
+    rescue ArgumentError
+      # Dir.home raises ArgumentError when ENV['home'] is not set
+      raise ArgumentError, "Unable to load sso_cache_file: ENV['HOME'] is not set."
+    end
+  end
+end

data/lib/aws-sdk-core/structure.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   # @api private
   module Structure
@@ -46,7 +48,7 @@ module Aws
 
     # Wraps the default #to_s logic with filtering of sensitive parameters.
     def to_s(obj = self)
-      Aws::Log::ParamFilter.new.filter(obj).to_s
+      Aws::Log::ParamFilter.new.filter(obj, obj.class).to_s
     end
 
     class << self
@@ -68,11 +70,20 @@ module Aws
       end
 
     end
+
+    module Union
+      def member
+        self.members.select { |k| self[k] != nil }.first
+      end
+
+      def value
+        self[member] if member
+      end
+    end
   end
 
   # @api private
   class EmptyStructure < Struct.new('AwsEmptyStructure')
     include(Aws::Structure)
   end
-
 end

data/lib/aws-sdk-core/stubbing/data_applicator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     class DataApplicator

data/lib/aws-sdk-core/stubbing/empty_stub.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     class EmptyStub

data/lib/aws-sdk-core/stubbing/protocols/api_gateway.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     module Protocols

data/lib/aws-sdk-core/stubbing/protocols/ec2.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     module Protocols

data/lib/aws-sdk-core/stubbing/protocols/json.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     module Protocols
@@ -27,7 +29,7 @@ module Aws
         private
 
         def content_type(api)
-          "application/x-amz-json-#{api.metadata['jsonVerison']}"
+          "application/x-amz-json-#{api.metadata['jsonVersion']}"
         end
 
         def build_body(operation, data)

data/lib/aws-sdk-core/stubbing/protocols/query.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     module Protocols

data/lib/aws-sdk-core/stubbing/protocols/rest.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'aws-eventstream'
 
 module Aws
@@ -118,7 +120,7 @@ module Aws
 
         def encode_unknown_event(opts, event_type, event_data)
           # right now h2 events are only rest_json
-          opts[:payload] = StringIO.new(JSON.dump(event_data))
+          opts[:payload] = StringIO.new(Aws::Json.dump(event_data))
           opts[:headers][':event-type'] = Aws::EventStream::HeaderValue.new(
             value: event_type.to_s,
             type: 'string'

data/lib/aws-sdk-core/stubbing/protocols/rest_json.rb

@@ -1,9 +1,11 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     module Protocols
       class RestJson < Rest
 
-        def body_for(_, _, rules, data)
+        def body_for(_a, _b, rules, data)
           if eventstream?(rules)
             encode_eventstream_response(rules, data, Aws::Json::Builder)
           else

data/lib/aws-sdk-core/stubbing/protocols/rest_xml.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     module Protocols
       class RestXml < Rest
 
-        include Seahorse::Model::Shapes
-
         def body_for(api, operation, rules, data)
           if eventstream?(rules)
             encode_eventstream_response(rules, data, Xml::Builder)

data/lib/aws-sdk-core/stubbing/stub_data.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   # @api private
   module Stubbing

data/lib/aws-sdk-core/stubbing/xml_error.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Stubbing
     class XmlError

data/lib/aws-sdk-core/type_builder.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   # @api private
   class TypeBuilder

data/lib/aws-sdk-core/util.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'cgi'
 
 module Aws

data/lib/aws-sdk-core/waiters/errors.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Waiters
     module Errors

data/lib/aws-sdk-core/waiters/poller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Waiters
 

data/lib/aws-sdk-core/waiters/waiter.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Waiters
     # @api private

data/lib/aws-sdk-core/waiters.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'waiters/errors'
 require_relative 'waiters/poller'
 require_relative 'waiters/waiter'

data/lib/aws-sdk-core/xml/builder.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'base64'
 
 module Aws
@@ -9,7 +11,7 @@ module Aws
       def initialize(rules, options = {})
         @rules = rules
         @xml = options[:target] || []
-        indent = options[:indent] || '  '
+        indent = options[:indent] || ''
         pad = options[:pad] || ''
         @builder = DocBuilder.new(target: @xml, indent: indent, pad: pad)
       end
@@ -46,7 +48,7 @@ module Aws
       end
 
       def list(name, ref, values)
-        if ref.shape.flattened
+        if ref[:flattened] || ref.shape.flattened
           values.each do |value|
             member(ref.shape.member.location_name || name, ref.shape.member, value)
           end

data/lib/aws-sdk-core/xml/default_list.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Xml
     # @api private

data/lib/aws-sdk-core/xml/default_map.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Xml
     # @api private

data/lib/aws-sdk-core/xml/doc_builder.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Aws
   module Xml
     class DocBuilder
@@ -65,7 +67,12 @@ module Aws
       end
 
       def escape(string, text_or_attr)
-        string.to_s.encode(:xml => text_or_attr)
+        string.to_s
+          .encode(:xml => text_or_attr)
+          .gsub("\u{000D}", '
') # Carriage Return
+          .gsub("\u{000A}", '
') # Line Feed
+          .gsub("\u{0085}", '…') # Next Line
+          .gsub("\u{2028}", '
') # Line Separator
       end
 
       def attributes(attr)

data/lib/aws-sdk-core/xml/error_handler.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'cgi'
 
 module Aws

data/lib/aws-sdk-core/xml/parser/engines/libxml.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'libxml'
 
 module Aws

data/lib/aws-sdk-core/xml/parser/engines/nokogiri.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'nokogiri'
 
 module Aws

data/lib/aws-sdk-core/xml/parser/engines/oga.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'oga'
 
 module Aws

data/lib/aws-sdk-core/xml/parser/engines/ox.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'ox'
 require 'stringio'
 
@@ -14,7 +16,7 @@ module Aws
           Ox.sax_parse(
             @stack, StringIO.new(xml),
             :convert_special => true,
-            :skip => :skip_white
+            :skip => :skip_return
           )
         end
 

data/lib/aws-sdk-core/xml/parser/engines/rexml.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rexml/document'
 require 'rexml/streamlistener'