aws-sdk-core 3.152.0 → 3.234.0

data/lib/aws-sdk-core/ecs_credentials.rb

@@ -2,21 +2,27 @@
 
 require 'time'
 require 'net/http'
+require 'resolv'
 
 module Aws
   # An auto-refreshing credential provider that loads credentials from
-  # instances running in ECS.
+  # instances running in containers.
   #
   #     ecs_credentials = Aws::ECSCredentials.new(retries: 3)
   #     ec2 = Aws::EC2::Client.new(credentials: ecs_credentials)
   class ECSCredentials
-
     include CredentialProvider
     include RefreshingCredentials
 
     # @api private
     class Non200Response < RuntimeError; end
 
+    # Raised when the token file cannot be read.
+    class TokenFileReadError < RuntimeError; end
+
+    # Raised when the token file is invalid.
+    class InvalidTokenError < RuntimeError; end
+
     # These are the errors we trap when attempting to talk to the
     # instance metadata service.  Any of these imply the service
     # is not present, no responding or some other non-recoverable
@@ -29,45 +35,49 @@ module Aws
       Errno::ENETUNREACH,
       SocketError,
       Timeout::Error,
-      Non200Response,
-    ]
+      Non200Response
+    ].freeze
 
     # @param [Hash] options
     # @option options [Integer] :retries (5) Number of times to retry
     #   when retrieving credentials.
-    # @option options [String] :ip_address ('169.254.170.2')
-    # @option options [Integer] :port (80)
+    # @option options [String] :ip_address ('169.254.170.2') This value is
+    #   ignored if `:endpoint` is set and `:credential_path` is not set.
+    # @option options [Integer] :port (80) This value is ignored if `:endpoint`
+    #   is set and `:credential_path` is not set.
     # @option options [String] :credential_path By default, the value of the
-    #   AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable.
+    #   `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` environment variable.
+    # @option options [String] :endpoint The container credential endpoint.
+    #   By default, this is the value of the `AWS_CONTAINER_CREDENTIALS_FULL_URI`
+    #   environment variable. This value is ignored if `:credential_path` or
+    #   `ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']` is set.
     # @option options [Float] :http_open_timeout (5)
     # @option options [Float] :http_read_timeout (5)
-    # @option options [Numeric, Proc] :delay By default, failures are retried
+    # @option options [IO] :http_debug_output (nil) HTTP wire
+    #   traces are sent to this object.  You can specify something
+    #   like `$stdout`.
+    # @option options [Numeric, Proc] :backoff By default, failures are retried
     #   with exponential back-off, i.e. `sleep(1.2 ** num_failures)`. You can
     #   pass a number of seconds to sleep between failed attempts, or
     #   a Proc that accepts the number of failures.
-    # @option options [IO] :http_debug_output (nil) HTTP wire
-    #   traces are sent to this object.  You can specify something
-    #   like $stdout.
-    # @option options [Callable] before_refresh Proc called before
-    #   credentials are refreshed. `before_refresh` is called
+    # @option options [Proc] :before_refresh A Proc called before
+    #   credentials are refreshed. `:before_refresh` is called
     #   with an instance of this object when
     #   AWS credentials are required and need to be refreshed.
-    def initialize options = {}
+    def initialize(options = {})
+      credential_path = options[:credential_path] ||
+                        ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
+      endpoint = options[:endpoint] ||
+                 ENV['AWS_CONTAINER_CREDENTIALS_FULL_URI']
+      initialize_uri(options, credential_path, endpoint)
+
       @retries = options[:retries] || 5
-      @ip_address = options[:ip_address] || '169.254.170.2'
-      @port = options[:port] || 80
-      @credential_path = options[:credential_path]
-      @credential_path ||= ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
-      unless @credential_path
-        raise ArgumentError.new(
-          "Cannot instantiate an ECS Credential Provider without a credential path."
-        )
-      end
       @http_open_timeout = options[:http_open_timeout] || 5
       @http_read_timeout = options[:http_read_timeout] || 5
       @http_debug_output = options[:http_debug_output]
       @backoff = backoff(options[:backoff])
       @async_refresh = false
+      @metrics = ['CREDENTIALS_HTTP']
       super
     end
 
@@ -77,11 +87,95 @@ module Aws
 
     private
 
+    def initialize_uri(options, credential_path, endpoint)
+      if credential_path
+        initialize_relative_uri(options, credential_path)
+      # Use FULL_URI/endpoint only if RELATIVE_URI/path is not set
+      elsif endpoint
+        initialize_full_uri(endpoint)
+      else
+        raise ArgumentError,
+              'Cannot instantiate an ECS Credential Provider '\
+              'without a credential path or endpoint.'
+      end
+    end
+
+    def initialize_relative_uri(options, path)
+      @host = options[:ip_address] || '169.254.170.2'
+      @port = options[:port] || 80
+      @scheme = 'http'
+      @credential_path = path
+    end
+
+    def initialize_full_uri(endpoint)
+      uri = URI.parse(endpoint)
+      validate_full_uri_scheme!(uri)
+      validate_full_uri!(uri)
+      @host = uri.hostname
+      @port = uri.port
+      @scheme = uri.scheme
+      @credential_path = uri.request_uri
+    end
+
+    def validate_full_uri_scheme!(full_uri)
+      return if full_uri.is_a?(URI::HTTP) || full_uri.is_a?(URI::HTTPS)
+
+      raise ArgumentError, "'#{full_uri}' must be a valid HTTP or HTTPS URI"
+    end
+
+    # Validate that the full URI is using a loopback address if scheme is http.
+    def validate_full_uri!(full_uri)
+      return unless full_uri.scheme == 'http'
+
+      begin
+        return if valid_ip_address?(IPAddr.new(full_uri.host))
+      rescue IPAddr::InvalidAddressError
+        addresses = Resolv.getaddresses(full_uri.host)
+        return if addresses.all? { |addr| valid_ip_address?(IPAddr.new(addr)) }
+      end
+
+      raise ArgumentError,
+            'AWS_CONTAINER_CREDENTIALS_FULL_URI must use a local loopback '\
+            'or an ECS or EKS link-local address when using the http scheme.'
+    end
+
+    def valid_ip_address?(ip_address)
+      ip_loopback?(ip_address) || ecs_or_eks_ip?(ip_address)
+    end
+
+    # loopback? method is available in Ruby 2.5+
+    # Replicate the logic here.
+    # loopback (IPv4 127.0.0.0/8, IPv6 ::1/128)
+    def ip_loopback?(ip_address)
+      case ip_address.family
+      when Socket::AF_INET
+        ip_address & 0xff000000 == 0x7f000000
+      when Socket::AF_INET6
+        ip_address == 1
+      else
+        false
+      end
+    end
+
+    # Verify that the IP address is a link-local address from ECS or EKS.
+    # ECS container host (IPv4 `169.254.170.2`)
+    # EKS container host (IPv4 `169.254.170.23`, IPv6 `fd00:ec2::23`)
+    def ecs_or_eks_ip?(ip_address)
+      case ip_address.family
+      when Socket::AF_INET
+        [0xa9feaa02, 0xa9feaa17].include?(ip_address)
+      when Socket::AF_INET6
+        ip_address == 0xfd00_0ec2_0000_0000_0000_0000_0000_0023
+      else
+        false
+      end
+    end
+
     def backoff(backoff)
       case backoff
       when Proc then backoff
-      when Numeric then lambda { |_| sleep(backoff) }
-      else lambda { |num_failures| Kernel.sleep(1.2 ** num_failures) }
+      when Numeric then ->(_) { sleep(backoff) }
+      else ->(num_failures) { Kernel.sleep(1.2**num_failures) }
       end
     end
 
@@ -89,68 +183,100 @@ module Aws
       # Retry loading credentials up to 3 times is the instance metadata
       # service is responding but is returning invalid JSON documents
       # in response to the GET profile credentials call.
-      begin
-        retry_errors([Aws::Json::ParseError, StandardError], max_retries: 3) do
-          c = Aws::Json.load(get_credentials.to_s)
-          @credentials = Credentials.new(
-            c['AccessKeyId'],
-            c['SecretAccessKey'],
-            c['Token']
-          )
-          @expiration = c['Expiration'] ? Time.iso8601(c['Expiration']) : nil
-        end
-      rescue Aws::Json::ParseError
-        raise Aws::Errors::MetadataParserError.new
+
+      retry_errors([Aws::Json::ParseError, StandardError], max_retries: 3) do
+        c = Aws::Json.load(get_credentials.to_s)
+        @credentials = Credentials.new(
+          c['AccessKeyId'],
+          c['SecretAccessKey'],
+          c['Token']
+        )
+        @expiration = c['Expiration'] ? Time.iso8601(c['Expiration']) : nil
       end
+    rescue Aws::Json::ParseError
+      raise Aws::Errors::MetadataParserError
     end
 
     def get_credentials
       # Retry loading credentials a configurable number of times if
       # the instance metadata service is not responding.
-      begin
-        retry_errors(NETWORK_ERRORS, max_retries: @retries) do
-          open_connection do |conn|
-            http_get(conn, @credential_path)
-          end
+
+      retry_errors(NETWORK_ERRORS, max_retries: @retries) do
+        open_connection do |conn|
+          http_get(conn, @credential_path)
         end
-      rescue
-        '{}'
       end
+    rescue TokenFileReadError, InvalidTokenError
+      raise
+    rescue StandardError => e
+      warn("Error retrieving ECS Credentials: #{e.message}")
+      '{}'
+    end
+
+    def fetch_authorization_token
+      if (path = ENV['AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE'])
+        fetch_authorization_token_file(path)
+      elsif (token = ENV['AWS_CONTAINER_AUTHORIZATION_TOKEN'])
+        token
+      end
+    end
+
+    def fetch_authorization_token_file(path)
+      File.read(path).strip
+    rescue Errno::ENOENT
+      raise TokenFileReadError,
+            'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE is set '\
+            "but the file doesn't exist: #{path}"
+    end
+
+    def validate_authorization_token!(token)
+      return unless token.include?("\r\n")
+
+      raise InvalidTokenError,
+            'Invalid Authorization token: token contains '\
+            'a newline and carriage return character.'
     end
 
     def open_connection
-      http = Net::HTTP.new(@ip_address, @port, nil)
+      http = Net::HTTP.new(@host, @port, nil)
       http.open_timeout = @http_open_timeout
       http.read_timeout = @http_read_timeout
       http.set_debug_output(@http_debug_output) if @http_debug_output
+      http.use_ssl = @scheme == 'https'
       http.start
       yield(http).tap { http.finish }
     end
 
     def http_get(connection, path)
-      response = connection.request(Net::HTTP::Get.new(path))
-      if response.code.to_i == 200
-        response.body
-      else
-        raise Non200Response
+      request = Net::HTTP::Get.new(path)
+      set_authorization_token(request)
+      response = connection.request(request)
+      raise Non200Response unless response.code.to_i == 200
+
+      response.body
+    end
+
+    def set_authorization_token(request)
+      if (authorization_token = fetch_authorization_token)
+        validate_authorization_token!(authorization_token)
+        request['Authorization'] = authorization_token
       end
     end
 
-    def retry_errors(error_classes, options = {}, &block)
+    def retry_errors(error_classes, options = {})
       max_retries = options[:max_retries]
       retries = 0
       begin
         yield
-      rescue *error_classes => _error
-        if retries < max_retries
-          @backoff.call(retries)
-          retries += 1
-          retry
-        else
-          raise
-        end
+      rescue TokenFileReadError, InvalidTokenError
+        raise
+      rescue *error_classes => _e
+        raise unless retries < max_retries
+
+        @backoff.call(retries)
+        retries += 1
+        retry
       end
     end
-
   end
 end

data/lib/aws-sdk-core/endpoints/condition.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Aws
+  module Endpoints
+    # This class is deprecated. It is used by the Runtime endpoint
+    # resolution approach. It has been replaced by a code generated
+    # approach in each service gem. It can be removed in a new
+    # major version. It has to exist because
+    # old service gems can use a new core version.
+    # @api private
+    class Condition
+      def initialize(fn:, argv:, assign: nil)
+        @fn = Function.new(fn: fn, argv: argv)
+        @assign = assign
+        @assigned = {}
+      end
+
+      attr_reader :fn
+      attr_reader :argv
+      attr_reader :assign
+
+      attr_reader :assigned
+
+      def match?(parameters, assigns)
+        output = @fn.call(parameters, assigns)
+        @assigned = @assigned.merge({ @assign => output }) if @assign
+        output
+      end
+
+      def self.from_json(conditions_json)
+        conditions_json.each.with_object([]) do |condition, conditions|
+          conditions << new(
+            fn: condition['fn'],
+            argv: condition['argv'],
+            assign: condition['assign']
+          )
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-core/endpoints/endpoint.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Aws
+  module Endpoints
+    class Endpoint
+      def initialize(url:, properties: {}, headers: {}, metadata: {})
+        @url = url
+        @properties = properties
+        @headers = headers
+        @metadata = metadata
+      end
+
+      attr_reader :url
+      attr_reader :properties
+      attr_reader :headers
+      attr_reader :metadata
+    end
+  end
+end

data/lib/aws-sdk-core/endpoints/endpoint_rule.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Aws
+  module Endpoints
+    # This class is deprecated. It is used by the Runtime endpoint
+    # resolution approach. It has been replaced by a code generated
+    # approach in each service gem. It can be removed in a new
+    # major version. It has to exist because
+    # old service gems can use a new core version.    # @api private
+    class EndpointRule < Rule
+      def initialize(type: 'endpoint', conditions:, endpoint:,
+                     documentation: nil)
+        @type = type
+        @conditions = Condition.from_json(conditions)
+        @endpoint = endpoint
+        @documentation = documentation
+      end
+
+      attr_reader :type
+      attr_reader :conditions
+      attr_reader :endpoint
+      attr_reader :documentation
+
+      def match(parameters, assigned = {})
+        assigns = assigned.dup
+        matched = conditions.all? do |condition|
+          output = condition.match?(parameters, assigns)
+          assigns = assigns.merge(condition.assigned) if condition.assign
+          output
+        end
+        resolved_endpoint(parameters, assigns) if matched
+      end
+
+      def resolved_endpoint(parameters, assigns)
+        Endpoint.new(
+          url: resolve_value(@endpoint['url'], parameters, assigns),
+          properties: resolve_properties(
+            @endpoint['properties'] || {},
+            parameters,
+            assigns
+          ),
+          headers: resolve_headers(parameters, assigns)
+        )
+      end
+
+      private
+
+      def resolve_headers(parameters, assigns)
+        (@endpoint['headers'] || {}).each.with_object({}) do |(key, arr), headers|
+          headers[key] = []
+          arr.each do |value|
+            headers[key] << resolve_value(value, parameters, assigns)
+          end
+        end
+      end
+
+      def resolve_properties(obj, parameters, assigns)
+        case obj
+        when Hash
+          obj.each.with_object({}) do |(key, value), hash|
+            hash[key] = resolve_properties(value, parameters, assigns)
+          end
+        when Array
+          obj.collect { |value| resolve_properties(value, parameters, assigns) }
+        else
+          if obj.is_a?(String)
+            Templater.resolve(obj, parameters, assigns)
+          else
+            obj
+          end
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-core/endpoints/error_rule.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Aws
+  module Endpoints
+    # This class is deprecated. It is used by the Runtime endpoint
+    # resolution approach. It has been replaced by a code generated
+    # approach in each service gem. It can be removed in a new
+    # major version. It has to exist because
+    # old service gems can use a new core version.
+    # @api private
+    class ErrorRule < Rule
+      def initialize(type: 'error', conditions:, error: nil, documentation: nil)
+        @type = type
+        @conditions = Condition.from_json(conditions)
+        @error = error
+        @documentation = documentation
+      end
+
+      attr_reader :type
+      attr_reader :conditions
+      attr_reader :error
+      attr_reader :documentation
+
+      def match(parameters, assigned = {})
+        assigns = assigned.dup
+        matched = conditions.all? do |condition|
+          output = condition.match?(parameters, assigns)
+          assigns = assigns.merge(condition.assigned) if condition.assign
+          output
+        end
+        resolved_error(parameters, assigns) if matched
+      end
+
+      private
+
+      def resolved_error(parameters, assigns)
+        error = resolve_value(@error, parameters, assigns)
+        ArgumentError.new(error)
+      end
+    end
+  end
+end

data/lib/aws-sdk-core/endpoints/function.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Aws
+  module Endpoints
+    # This class is deprecated. It is used by the Runtime endpoint
+    # resolution approach. It has been replaced by a code generated
+    # approach in each service gem. It can be removed in a new
+    # major version. It has to exist because
+    # old service gems can use a new core version.
+    # @api private
+    class Function
+      def initialize(fn:, argv:)
+        @fn = fn
+        @argv = build_argv(argv)
+      end
+
+      attr_reader :fn
+      attr_reader :argv
+
+      def call(parameters, assigns)
+        args = []
+        @argv.each do |arg|
+          if arg.is_a?(Reference)
+            args << arg.resolve(parameters, assigns)
+          elsif arg.is_a?(Function)
+            args << arg.call(parameters, assigns)
+          else
+            if arg.is_a?(String)
+              arg = Templater.resolve(arg, parameters, assigns)
+            end
+            args << arg
+          end
+        end
+
+        case @fn
+        when 'isSet'
+          Matchers.set?(*args)
+        when 'not'
+          Matchers.not(*args)
+        when 'getAttr'
+          Matchers.attr(*args)
+        when 'substring'
+          Matchers.substring(*args)
+        when 'stringEquals'
+          Matchers.string_equals?(*args)
+        when 'booleanEquals'
+          Matchers.boolean_equals?(*args)
+        when 'uriEncode'
+          Matchers.uri_encode(*args)
+        when 'parseURL'
+          Matchers.parse_url(*args)
+        when 'isValidHostLabel'
+          Matchers.valid_host_label?(*args)
+        when 'aws.partition'
+          Matchers.aws_partition(*args)
+        when 'aws.parseArn'
+          Matchers.aws_parse_arn(*args)
+        when 'aws.isVirtualHostableS3Bucket'
+          Matchers.aws_virtual_hostable_s3_bucket?(*args)
+        else
+          raise "Function not found: #{@fn}"
+        end
+      end
+
+      private
+
+      def build_argv(argv_json)
+        argv_json.each.with_object([]) do |arg, argv|
+          argv << if arg.is_a?(Hash) && arg['ref']
+                    Reference.new(ref: arg['ref'])
+                  elsif arg.is_a?(Hash) && arg['fn']
+                    Function.new(fn: arg['fn'], argv: arg['argv'])
+                  else
+                    arg
+                  end
+        end
+      end
+    end
+  end
+end