aws-sdk-core 3.131.0 → 3.158.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +177 -1
- data/VERSION +1 -1
- data/lib/aws-sdk-core/errors.rb +13 -0
- data/lib/aws-sdk-core/pageable_response.rb +7 -0
- data/lib/aws-sdk-core/plugins/bearer_authorization.rb +67 -0
- data/lib/aws-sdk-core/plugins/jsonvalue_converter.rb +34 -6
- data/lib/aws-sdk-core/plugins/recursion_detection.rb +14 -3
- data/lib/aws-sdk-core/plugins/signature_v4.rb +12 -7
- data/lib/aws-sdk-core/refreshing_token.rb +71 -0
- data/lib/aws-sdk-core/rest/handler.rb +1 -1
- data/lib/aws-sdk-core/shared_config.rb +43 -0
- data/lib/aws-sdk-core/sso_token_provider.rb +134 -0
- data/lib/aws-sdk-core/static_token_provider.rb +14 -0
- data/lib/aws-sdk-core/structure.rb +6 -4
- data/lib/aws-sdk-core/token.rb +31 -0
- data/lib/aws-sdk-core/token_provider.rb +15 -0
- data/lib/aws-sdk-core/token_provider_chain.rb +51 -0
- data/lib/aws-sdk-core/xml/error_handler.rb +7 -0
- data/lib/aws-sdk-core.rb +10 -0
- data/lib/aws-sdk-sso/client.rb +32 -9
- data/lib/aws-sdk-sso/types.rb +8 -8
- data/lib/aws-sdk-sso.rb +1 -1
- data/lib/aws-sdk-ssooidc/client.rb +589 -0
- data/lib/aws-sdk-ssooidc/client_api.rb +216 -0
- data/lib/aws-sdk-ssooidc/customizations.rb +1 -0
- data/lib/aws-sdk-ssooidc/errors.rb +290 -0
- data/lib/aws-sdk-ssooidc/resource.rb +26 -0
- data/lib/aws-sdk-ssooidc/types.rb +534 -0
- data/lib/aws-sdk-ssooidc.rb +55 -0
- data/lib/aws-sdk-sts/client.rb +1 -1
- data/lib/aws-sdk-sts.rb +1 -1
- data/lib/seahorse/client/plugins/request_callback.rb +9 -9
- metadata +24 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 928b2da70d94db4871b85d48b62af8cf7ac1caafb7739192df938a532bebe205
|
4
|
+
data.tar.gz: 5c87fe225cced2fa51b5f204131fefc8b35ed0ca0315f362363deb4047890e9a
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 11e4d7f3c7fc9162e1b1fb6976e68b794fa68843e1144266b6e73ae980c1a57beb623bb9729c58eacfff577456da03df86475921f6c9793c27f4caa6a4768628
|
7
|
+
data.tar.gz: 71447e2b792db6bc08aa2e07f12af9b7e0ad282d2988384bbd2a7ba1eb1b96a62e0f8ddf4dcda864e84a8cbe4fd57f3e7ccc53457105f61ac7e1241a3a2a7d88
|
data/CHANGELOG.md
CHANGED
@@ -1,6 +1,182 @@
|
|
1
1
|
Unreleased Changes
|
2
2
|
------------------
|
3
3
|
|
4
|
+
3.158.1 (2022-10-06)
|
5
|
+
------------------
|
6
|
+
|
7
|
+
* Issue - Ensure that the ReadCallbackIO is always unwrapped (#2761).
|
8
|
+
|
9
|
+
3.158.0 (2022-09-30)
|
10
|
+
------------------
|
11
|
+
|
12
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
13
|
+
|
14
|
+
3.157.0 (2022-09-29)
|
15
|
+
------------------
|
16
|
+
|
17
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
18
|
+
|
19
|
+
3.156.0 (2022-09-27)
|
20
|
+
------------------
|
21
|
+
|
22
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
23
|
+
|
24
|
+
3.155.0 (2022-09-26)
|
25
|
+
------------------
|
26
|
+
|
27
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
28
|
+
|
29
|
+
3.154.0 (2022-09-23)
|
30
|
+
------------------
|
31
|
+
|
32
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
33
|
+
|
34
|
+
3.153.0 (2022-09-22)
|
35
|
+
------------------
|
36
|
+
|
37
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
38
|
+
|
39
|
+
3.152.0 (2022-09-21)
|
40
|
+
------------------
|
41
|
+
|
42
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
43
|
+
|
44
|
+
3.151.0 (2022-09-20)
|
45
|
+
------------------
|
46
|
+
|
47
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
48
|
+
|
49
|
+
3.150.0 (2022-09-19)
|
50
|
+
------------------
|
51
|
+
|
52
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
53
|
+
|
54
|
+
3.149.0 (2022-09-16)
|
55
|
+
------------------
|
56
|
+
|
57
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
58
|
+
|
59
|
+
3.148.0 (2022-09-15)
|
60
|
+
------------------
|
61
|
+
|
62
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
63
|
+
|
64
|
+
3.147.0 (2022-09-14)
|
65
|
+
------------------
|
66
|
+
|
67
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
68
|
+
|
69
|
+
3.146.0 (2022-09-13)
|
70
|
+
------------------
|
71
|
+
|
72
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
73
|
+
|
74
|
+
3.145.0 (2022-09-12)
|
75
|
+
------------------
|
76
|
+
|
77
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
78
|
+
|
79
|
+
3.144.0 (2022-09-09)
|
80
|
+
------------------
|
81
|
+
|
82
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
83
|
+
|
84
|
+
3.143.0 (2022-09-08)
|
85
|
+
------------------
|
86
|
+
|
87
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
88
|
+
|
89
|
+
3.142.0 (2022-09-07)
|
90
|
+
------------------
|
91
|
+
|
92
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
93
|
+
|
94
|
+
3.141.0 (2022-09-06)
|
95
|
+
------------------
|
96
|
+
|
97
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
98
|
+
|
99
|
+
3.140.0 (2022-09-02)
|
100
|
+
------------------
|
101
|
+
|
102
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
103
|
+
|
104
|
+
3.139.0 (2022-09-01)
|
105
|
+
------------------
|
106
|
+
|
107
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
108
|
+
|
109
|
+
3.138.0 (2022-08-31)
|
110
|
+
------------------
|
111
|
+
|
112
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
113
|
+
|
114
|
+
3.137.0 (2022-08-30)
|
115
|
+
------------------
|
116
|
+
|
117
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
118
|
+
|
119
|
+
* Issue - Fix errors in recursion detection when `_X_AMZN_TRACE_ID` is unset (#2748).
|
120
|
+
|
121
|
+
3.136.0 (2022-08-25)
|
122
|
+
------------------
|
123
|
+
|
124
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
125
|
+
|
126
|
+
3.135.0 (2022-08-24)
|
127
|
+
------------------
|
128
|
+
|
129
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
130
|
+
|
131
|
+
3.134.0 (2022-08-23)
|
132
|
+
------------------
|
133
|
+
|
134
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
135
|
+
|
136
|
+
* Feature - Add support for Bearer Token Authentication and TokenProviders.
|
137
|
+
* Issue - Validate that `_X_AMZN_TRACE_ID` ENV value contains only valid, non-control characters.
|
138
|
+
|
139
|
+
3.133.0 (2022-08-22)
|
140
|
+
------------------
|
141
|
+
|
142
|
+
* Feature - Moved functionality from `aws-sdk-ssoidc` into core.
|
143
|
+
|
144
|
+
3.132.0 (2022-08-08)
|
145
|
+
------------------
|
146
|
+
|
147
|
+
* Feature - Updated Aws::SSO::Client with the latest API changes.
|
148
|
+
|
149
|
+
3.131.6 (2022-08-03)
|
150
|
+
------------------
|
151
|
+
|
152
|
+
* Issue - Fix typo in `RecursionDetection`, change amz to amzn in header and env name.
|
153
|
+
|
154
|
+
3.131.5 (2022-07-28)
|
155
|
+
------------------
|
156
|
+
|
157
|
+
* Issue - Fix `to_json` usage in nested hashes by defining `as_json` (#2733).
|
158
|
+
|
159
|
+
3.131.4 (2022-07-27)
|
160
|
+
------------------
|
161
|
+
|
162
|
+
* Issue - Fix `to_json` usage on pageable responses when using Rails (#2733).
|
163
|
+
* Issue - Use `expand_path` on credential/config paths in SharedConfig (#2735).
|
164
|
+
|
165
|
+
3.131.3 (2022-07-18)
|
166
|
+
------------------
|
167
|
+
|
168
|
+
* Issue - Add support for serializing shapes on the body with `jsonvalue` members.
|
169
|
+
|
170
|
+
3.131.2 (2022-06-20)
|
171
|
+
------------------
|
172
|
+
|
173
|
+
* Issue - Populate context :request_id for XML error responses.
|
174
|
+
|
175
|
+
3.131.1 (2022-05-20)
|
176
|
+
------------------
|
177
|
+
|
178
|
+
* Issue - Bump the minimum version of `jmespath` dependency.
|
179
|
+
|
4
180
|
3.131.0 (2022-05-16)
|
5
181
|
------------------
|
6
182
|
|
@@ -55,7 +231,7 @@ Unreleased Changes
|
|
55
231
|
3.126.2 (2022-02-16)
|
56
232
|
------------------
|
57
233
|
|
58
|
-
* Issue - Add a before_refresh callback to AssumeRoleCredentials (#2529).
|
234
|
+
* Issue - Add a before_refresh callback to AssumeRoleCredentials (#2529).
|
59
235
|
* Issue - Raise a `NoSuchProfileError` when config and credentials files don't exist.
|
60
236
|
|
61
237
|
3.126.1 (2022-02-14)
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
3.
|
1
|
+
3.158.1
|
data/lib/aws-sdk-core/errors.rb
CHANGED
@@ -210,6 +210,19 @@ module Aws
|
|
210
210
|
# Raised when SSO Credentials are invalid
|
211
211
|
class InvalidSSOCredentials < RuntimeError; end
|
212
212
|
|
213
|
+
# Raised when SSO Token is invalid
|
214
|
+
class InvalidSSOToken < RuntimeError; end
|
215
|
+
|
216
|
+
# Raised when a client is unable to sign a request because
|
217
|
+
# the bearer token is not configured or available
|
218
|
+
class MissingBearerTokenError < RuntimeError
|
219
|
+
def initialize(*args)
|
220
|
+
msg = 'unable to sign request without token set'
|
221
|
+
super(msg)
|
222
|
+
end
|
223
|
+
end
|
224
|
+
|
225
|
+
|
213
226
|
# Raised when there is a circular reference in chained
|
214
227
|
# source_profiles
|
215
228
|
class SourceProfileCircularReferenceError < RuntimeError; end
|
@@ -146,6 +146,13 @@ module Aws
|
|
146
146
|
data.to_h
|
147
147
|
end
|
148
148
|
|
149
|
+
def as_json(_options = {})
|
150
|
+
data.to_h(data, as_json: true)
|
151
|
+
end
|
152
|
+
|
153
|
+
def to_json(options = {})
|
154
|
+
as_json.to_json(options)
|
155
|
+
end
|
149
156
|
end
|
150
157
|
|
151
158
|
# The actual decorator module implementation. It is in a distinct module
|
@@ -0,0 +1,67 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Aws
|
4
|
+
# @api private
|
5
|
+
module Plugins
|
6
|
+
# @api private
|
7
|
+
class BearerAuthorization < Seahorse::Client::Plugin
|
8
|
+
|
9
|
+
option(:token_provider,
|
10
|
+
required: false,
|
11
|
+
doc_type: 'Aws::TokenProvider',
|
12
|
+
docstring: <<-DOCS
|
13
|
+
A Bearer Token Provider. This can be an instance of any one of the
|
14
|
+
following classes:
|
15
|
+
|
16
|
+
* `Aws::StaticTokenProvider` - Used for configuring static, non-refreshing
|
17
|
+
tokens.
|
18
|
+
|
19
|
+
* `Aws::SSOTokenProvider` - Used for loading tokens from AWS SSO using an
|
20
|
+
access token generated from `aws login`.
|
21
|
+
|
22
|
+
When `:token_provider` is not configured directly, the `Aws::TokenProviderChain`
|
23
|
+
will be used to search for tokens configured for your profile in shared configuration files.
|
24
|
+
DOCS
|
25
|
+
) do |config|
|
26
|
+
if config.stub_responses
|
27
|
+
StaticTokenProvider.new('token')
|
28
|
+
else
|
29
|
+
TokenProviderChain.new(config).resolve
|
30
|
+
end
|
31
|
+
end
|
32
|
+
|
33
|
+
|
34
|
+
def add_handlers(handlers, cfg)
|
35
|
+
bearer_operations =
|
36
|
+
if cfg.api.metadata['signatureVersion'] == 'bearer'
|
37
|
+
# select operations where authtype is either not set or is bearer
|
38
|
+
cfg.api.operation_names.select do |o|
|
39
|
+
!cfg.api.operation(o)['authtype'] || cfg.api.operation(o)['authtype'] == 'bearer'
|
40
|
+
end
|
41
|
+
else # service is not bearer auth
|
42
|
+
# select only operations where authtype is explicitly bearer
|
43
|
+
cfg.api.operation_names.select do |o|
|
44
|
+
cfg.api.operation(o)['authtype'] == 'bearer'
|
45
|
+
end
|
46
|
+
end
|
47
|
+
handlers.add(Handler, step: :sign, operations: bearer_operations)
|
48
|
+
end
|
49
|
+
|
50
|
+
class Handler < Seahorse::Client::Handler
|
51
|
+
def call(context)
|
52
|
+
if context.http_request.endpoint.scheme != 'https'
|
53
|
+
raise ArgumentError, 'Unable to use bearer authorization on non https endpoint.'
|
54
|
+
end
|
55
|
+
|
56
|
+
token_provider = context.config.token_provider
|
57
|
+
if token_provider && token_provider.set?
|
58
|
+
context.http_request.headers['Authorization'] = "Bearer #{token_provider.token.token}"
|
59
|
+
else
|
60
|
+
raise Errors::MissingBearerTokenError
|
61
|
+
end
|
62
|
+
@handler.call(context)
|
63
|
+
end
|
64
|
+
end
|
65
|
+
end
|
66
|
+
end
|
67
|
+
end
|
@@ -11,15 +11,43 @@ module Aws
|
|
11
11
|
|
12
12
|
def call(context)
|
13
13
|
context.operation.input.shape.members.each do |m, ref|
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
14
|
+
convert_jsonvalue(m, ref, context.params, 'params')
|
15
|
+
end
|
16
|
+
@handler.call(context)
|
17
|
+
end
|
18
|
+
|
19
|
+
def convert_jsonvalue(m, ref, params, context)
|
20
|
+
return if params.nil? || !params.key?(m)
|
21
|
+
|
22
|
+
if ref['jsonvalue']
|
23
|
+
params[m] = serialize_jsonvalue(params[m], "#{context}[#{m}]")
|
24
|
+
else
|
25
|
+
case ref.shape
|
26
|
+
when Seahorse::Model::Shapes::StructureShape
|
27
|
+
ref.shape.members.each do |member_m, ref|
|
28
|
+
convert_jsonvalue(member_m, ref, params[m], "#{context}[#{m}]")
|
29
|
+
end
|
30
|
+
when Seahorse::Model::Shapes::ListShape
|
31
|
+
if ref.shape.member['jsonvalue']
|
32
|
+
params[m] = params[m].each_with_index.map do |v, i|
|
33
|
+
serialize_jsonvalue(v, "#{context}[#{m}][#{i}]")
|
34
|
+
end
|
35
|
+
end
|
36
|
+
when Seahorse::Model::Shapes::MapShape
|
37
|
+
if ref.shape.value['jsonvalue']
|
38
|
+
params[m].each do |k, v|
|
39
|
+
params[m][k] = serialize_jsonvalue(v, "#{context}[#{m}][#{k}]")
|
40
|
+
end
|
18
41
|
end
|
19
|
-
context.params[m] = param_value.to_json
|
20
42
|
end
|
21
43
|
end
|
22
|
-
|
44
|
+
end
|
45
|
+
|
46
|
+
def serialize_jsonvalue(v, context)
|
47
|
+
unless v.respond_to?(:to_json)
|
48
|
+
raise ArgumentError, "The value of #{context} is not JSON serializable."
|
49
|
+
end
|
50
|
+
v.to_json
|
23
51
|
end
|
24
52
|
|
25
53
|
end
|
@@ -9,14 +9,25 @@ module Aws
|
|
9
9
|
class Handler < Seahorse::Client::Handler
|
10
10
|
def call(context)
|
11
11
|
|
12
|
-
unless context.http_request.headers.key?('x-
|
12
|
+
unless context.http_request.headers.key?('x-amzn-trace-id')
|
13
13
|
if ENV['AWS_LAMBDA_FUNCTION_NAME'] &&
|
14
|
-
(trace_id = ENV['
|
15
|
-
context.http_request.headers['x-
|
14
|
+
(trace_id = validate_header(ENV['_X_AMZN_TRACE_ID']))
|
15
|
+
context.http_request.headers['x-amzn-trace-id'] = trace_id
|
16
16
|
end
|
17
17
|
end
|
18
18
|
@handler.call(context)
|
19
19
|
end
|
20
|
+
|
21
|
+
private
|
22
|
+
def validate_header(header_value)
|
23
|
+
return unless header_value
|
24
|
+
|
25
|
+
if (header_value.chars & (0..31).map(&:chr)).any?
|
26
|
+
raise ArgumentError, 'Invalid _X_AMZN_TRACE_ID value: '\
|
27
|
+
'contains ASCII control characters'
|
28
|
+
end
|
29
|
+
header_value
|
30
|
+
end
|
20
31
|
end
|
21
32
|
|
22
33
|
# should be at the end of build so that
|
@@ -7,6 +7,8 @@ module Aws
|
|
7
7
|
# @api private
|
8
8
|
class SignatureV4 < Seahorse::Client::Plugin
|
9
9
|
|
10
|
+
V4_AUTH = %w[v4 v4-unsigned-payload v4-unsigned-body]
|
11
|
+
|
10
12
|
option(:sigv4_signer) do |cfg|
|
11
13
|
SignatureV4.build_signer(cfg)
|
12
14
|
end
|
@@ -32,13 +34,16 @@ module Aws
|
|
32
34
|
end
|
33
35
|
|
34
36
|
option(:unsigned_operations) do |cfg|
|
35
|
-
cfg.api.
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
37
|
+
if cfg.api.metadata['signatureVersion'] == 'v4'
|
38
|
+
# select operations where authtype is set and is not v4
|
39
|
+
cfg.api.operation_names.select do |o|
|
40
|
+
cfg.api.operation(o)['authtype'] && !V4_AUTH.include?(cfg.api.operation(o)['authtype'])
|
41
|
+
end
|
42
|
+
else # service is not v4 auth
|
43
|
+
# select all operations where authtype is not v4
|
44
|
+
# (includes operations with no explicit authtype)
|
45
|
+
cfg.api.operation_names.select do |o|
|
46
|
+
!V4_AUTH.include?(cfg.api.operation(o)['authtype'])
|
42
47
|
end
|
43
48
|
end
|
44
49
|
end
|
@@ -0,0 +1,71 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
require 'thread'
|
4
|
+
|
5
|
+
module Aws
|
6
|
+
|
7
|
+
# Module/mixin used by token provider classes that can be refreshed. This
|
8
|
+
# provides basic refresh logic in a thread-safe manner. Classes mixing in
|
9
|
+
# this module are expected to implement a #refresh method that populates
|
10
|
+
# the following instance variable:
|
11
|
+
#
|
12
|
+
# * `@token` [Token] - {Aws::Token} object with the `expiration` and `token`
|
13
|
+
# fields set.
|
14
|
+
#
|
15
|
+
# @api private
|
16
|
+
module RefreshingToken
|
17
|
+
|
18
|
+
def initialize(options = {})
|
19
|
+
@mutex = Mutex.new
|
20
|
+
@before_refresh = options.delete(:before_refresh) if Hash === options
|
21
|
+
|
22
|
+
@before_refresh.call(self) if @before_refresh
|
23
|
+
refresh
|
24
|
+
end
|
25
|
+
|
26
|
+
# @return [Token]
|
27
|
+
def token
|
28
|
+
refresh_if_near_expiration
|
29
|
+
@token
|
30
|
+
end
|
31
|
+
|
32
|
+
# @return [Time,nil]
|
33
|
+
def expiration
|
34
|
+
refresh_if_near_expiration
|
35
|
+
@expiration
|
36
|
+
end
|
37
|
+
|
38
|
+
# Refresh token.
|
39
|
+
# @return [void]
|
40
|
+
def refresh!
|
41
|
+
@mutex.synchronize do
|
42
|
+
@before_refresh.call(self) if @before_refresh
|
43
|
+
refresh
|
44
|
+
end
|
45
|
+
end
|
46
|
+
|
47
|
+
private
|
48
|
+
|
49
|
+
# Refreshes token if it is within
|
50
|
+
# 5 minutes of expiration.
|
51
|
+
def refresh_if_near_expiration
|
52
|
+
if near_expiration?
|
53
|
+
@mutex.synchronize do
|
54
|
+
if near_expiration?
|
55
|
+
@before_refresh.call(self) if @before_refresh
|
56
|
+
refresh
|
57
|
+
end
|
58
|
+
end
|
59
|
+
end
|
60
|
+
end
|
61
|
+
|
62
|
+
def near_expiration?
|
63
|
+
if @token && @token.expiration
|
64
|
+
# are we within 5 minutes of expiration?
|
65
|
+
(Time.now.to_i + 5 * 60) > @token.expiration.to_i
|
66
|
+
else
|
67
|
+
true
|
68
|
+
end
|
69
|
+
end
|
70
|
+
end
|
71
|
+
end
|
@@ -4,6 +4,9 @@ module Aws
|
|
4
4
|
# @api private
|
5
5
|
class SharedConfig
|
6
6
|
SSO_PROFILE_KEYS = %w[sso_start_url sso_region sso_account_id sso_role_name].freeze
|
7
|
+
SSO_TOKEN_PROFILE_KEYS = %w[sso_session].freeze
|
8
|
+
SSO_SESSION_KEYS = %w[sso_region]
|
9
|
+
|
7
10
|
|
8
11
|
# @return [String]
|
9
12
|
attr_reader :credentials_path
|
@@ -51,10 +54,12 @@ module Aws
|
|
51
54
|
@config_enabled = options[:config_enabled]
|
52
55
|
@credentials_path = options[:credentials_path] ||
|
53
56
|
determine_credentials_path
|
57
|
+
@credentials_path = File.expand_path(@credentials_path) if @credentials_path
|
54
58
|
@parsed_credentials = {}
|
55
59
|
load_credentials_file if loadable?(@credentials_path)
|
56
60
|
if @config_enabled
|
57
61
|
@config_path = options[:config_path] || determine_config_path
|
62
|
+
@config_path = File.expand_path(@config_path) if @config_path
|
58
63
|
load_config_file if loadable?(@config_path)
|
59
64
|
end
|
60
65
|
end
|
@@ -149,6 +154,18 @@ module Aws
|
|
149
154
|
credentials
|
150
155
|
end
|
151
156
|
|
157
|
+
# Attempts to load from shared config or shared credentials file.
|
158
|
+
# Will always attempt first to load from the shared credentials
|
159
|
+
# file, if present.
|
160
|
+
def sso_token_from_config(opts = {})
|
161
|
+
p = opts[:profile] || @profile_name
|
162
|
+
token = sso_token_from_profile(@parsed_credentials, p)
|
163
|
+
if @parsed_config
|
164
|
+
token ||= sso_token_from_profile(@parsed_config, p)
|
165
|
+
end
|
166
|
+
token
|
167
|
+
end
|
168
|
+
|
152
169
|
# Add an accessor method (similar to attr_reader) to return a configuration value
|
153
170
|
# Uses the get_config_value below to control where
|
154
171
|
# values are loaded from
|
@@ -325,6 +342,32 @@ module Aws
|
|
325
342
|
end
|
326
343
|
end
|
327
344
|
|
345
|
+
# If the required sso_ profile values are present, attempt to construct
|
346
|
+
# SSOTokenProvider
|
347
|
+
def sso_token_from_profile(cfg, profile)
|
348
|
+
if @parsed_config &&
|
349
|
+
(prof_config = cfg[profile]) &&
|
350
|
+
!(prof_config.keys & SSO_TOKEN_PROFILE_KEYS).empty?
|
351
|
+
|
352
|
+
sso_session_name = prof_config['sso_session']
|
353
|
+
sso_session = cfg["sso-session #{sso_session_name}"]
|
354
|
+
unless sso_session
|
355
|
+
raise ArgumentError,
|
356
|
+
"sso-session #{sso_session_name} must be defined in the config file." /
|
357
|
+
"Referenced by profile #{profile}"
|
358
|
+
end
|
359
|
+
|
360
|
+
unless sso_session['sso_region']
|
361
|
+
raise ArgumentError, "sso-session #{sso_session_name} missing required parameter: sso_region"
|
362
|
+
end
|
363
|
+
|
364
|
+
SSOTokenProvider.new(
|
365
|
+
sso_session: sso_session_name,
|
366
|
+
sso_region: sso_session['sso_region']
|
367
|
+
)
|
368
|
+
end
|
369
|
+
end
|
370
|
+
|
328
371
|
def credentials_from_profile(prof_config)
|
329
372
|
creds = Credentials.new(
|
330
373
|
prof_config['aws_access_key_id'],
|