aws-sdk-core 3.152.0 → 3.234.0

data/lib/aws-sdk-core/errors.rb

@@ -12,7 +12,7 @@ module Aws
     class ServiceError < RuntimeError
 
       # @param [Seahorse::Client::RequestContext] context
-      # @param [String] message
+      # @param [String, nil] message
       # @param [Aws::Structure] data
       def initialize(context, message, data = Aws::EmptyStructure.new)
         @code = self.class.code
@@ -30,11 +30,11 @@ module Aws
       attr_reader :context
 
       # @return [Aws::Structure]
-      attr_reader :data
+      attr_accessor :data
 
       class << self
 
-        # @return [String]
+        # @return [String, nil]
         attr_accessor :code
 
       end
@@ -68,7 +68,7 @@ module Aws
       end
     end
 
-    # Rasied when endpoint discovery failed for operations
+    # Raised when endpoint discovery failed for operations
     # that requires endpoints from endpoint discovery
     class EndpointDiscoveryError < RuntimeError
       def initialize(*args)
@@ -78,7 +78,7 @@ module Aws
       end
     end
 
-    # raised when hostLabel member is not provided
+    # Raised when hostLabel member is not provided
     # at operation input when endpoint trait is available
     # with 'hostPrefix' requirement
     class MissingEndpointHostLabelValue < RuntimeError
@@ -236,6 +236,15 @@ module Aws
       end
     end
 
+    # Raised when a client is constructed and the sigv4a region set is invalid.
+    # It is invalid when it is empty and/or contains empty strings.
+    class InvalidRegionSetError < ArgumentError
+      def initialize(*args)
+        msg = 'The provided sigv4a region set was empty or invalid.'
+        super(msg)
+      end
+    end
+
     # Raised when a client is contsructed and the region is not valid.
     class InvalidRegionError < ArgumentError
       def initialize(*args)

data/lib/aws-sdk-core/event_emitter.rb

@@ -6,7 +6,6 @@ module Aws
     def initialize
       @listeners = {}
       @validate_event = true
-      @status = :sleep
       @signal_queue = Queue.new
     end
 
@@ -32,7 +31,7 @@ module Aws
     def emit(type, params)
       unless @stream
         raise Aws::Errors::SignalEventError.new(
-          "Singaling events before making async request"\
+          "Signaling events before making async request"\
           " is not allowed."
         )
       end
@@ -40,25 +39,10 @@ module Aws
         Aws::ParamValidator.validate!(
           @encoder.rules.shape.member(type), params)
       end
-      _ready_for_events?
       @stream.data(
         @encoder.encode(type, params),
         end_stream: type == :end_stream
       )
     end
-
-    private
-
-    def _ready_for_events?
-      return true if @status == :ready
-
-      # blocked until once initial 200 response is received
-      # signal will be available in @signal_queue
-      # and this check will no longer be blocked
-      @signal_queue.pop
-      @status = :ready
-      true
-    end
-
   end
 end

data/lib/aws-sdk-core/ini_parser.rb

@@ -8,6 +8,8 @@ module Aws
       def ini_parse(raw)
         current_profile = nil
         current_prefix = nil
+        item = nil
+        previous_item = nil
         raw.lines.inject({}) do |acc, line|
           line = line.split(/^|\s;/).first # remove comments
           profile = line.match(/^\[([^\[\]]+)\]\s*(#.+)?$/) unless line.nil?
@@ -17,11 +19,16 @@ module Aws
             current_profile = named_profile[1] if named_profile
           elsif current_profile
             unless line.nil?
+              previous_item = item
               item = line.match(/^(.+?)\s*=\s*(.+?)\s*$/)
               prefix = line.match(/^(.+?)\s*=\s*$/)
             end
             if item && item[1].match(/^\s+/)
               # Need to add lines to a nested configuration.
+              if current_prefix.nil? && previous_item[2].strip.empty?
+                current_prefix = previous_item[1]
+                acc[current_profile][current_prefix] = {}
+              end
               inner_item = line.match(/^\s*(.+?)\s*=\s*(.+?)\s*$/)
               acc[current_profile] ||= {}
               acc[current_profile][current_prefix] ||= {}

data/lib/aws-sdk-core/instance_profile_credentials.rb

@@ -4,11 +4,23 @@ require 'time'
 require 'net/http'
 
 module Aws
-  # An auto-refreshing credential provider that loads credentials from
-  # EC2 instances.
+  # An auto-refreshing credential provider that loads credentials from EC2 instances.
   #
   #     instance_credentials = Aws::InstanceProfileCredentials.new
   #     ec2 = Aws::EC2::Client.new(credentials: instance_credentials)
+  #
+  # ## Retries
+  # When initialized from the default credential chain, this provider defaults to `0` retries.
+  # Breakdown of retries is as follows:
+  #
+  #  * **Configurable retries** (defaults to `1`): these retries handle errors when communicating
+  #     with the IMDS endpoint. There are two separate retry mechanisms within the provider:
+  #       * Entire token fetch and credential retrieval process
+  #       * Token fetching
+  #  * **JSON parsing retries**: Fixed at 3 attempts to handle cases when IMDS returns malformed JSON
+  #     responses. These retries are separate from configurable retries.
+  #
+  # @see https://docs.aws.amazon.com/sdkref/latest/guide/feature-imds-credentials.html IMDS Credential Provider
   class InstanceProfileCredentials
     include CredentialProvider
     include RefreshingCredentials
@@ -22,10 +34,8 @@ module Aws
     # @api private
     class TokenExpiredError < RuntimeError; end
 
-    # These are the errors we trap when attempting to talk to the
-    # instance metadata service.  Any of these imply the service
-    # is not present, no responding or some other non-recoverable
-    # error.
+    # These are the errors we trap when attempting to talk to the instance metadata service.
+    # Any of these imply the service is not present, no responding or some other non-recoverable error.
     # @api private
     NETWORK_ERRORS = [
       Errno::EHOSTUNREACH,
@@ -46,84 +56,113 @@ module Aws
     METADATA_TOKEN_PATH = '/latest/api/token'.freeze
 
     # @param [Hash] options
-    # @option options [Integer] :retries (1) Number of times to retry
-    #   when retrieving credentials.
-    # @option options [String] :endpoint ('http://169.254.169.254') The IMDS
-    #   endpoint. This option has precedence over the :endpoint_mode.
-    # @option options [String] :endpoint_mode ('IPv4') The endpoint mode for
-    #   the instance metadata service. This is either 'IPv4' ('169.254.169.254')
-    #   or 'IPv6' ('[fd00:ec2::254]').
-    # @option options [String] :ip_address ('169.254.169.254') Deprecated. Use
-    #   :endpoint instead. The IP address for the endpoint.
+    # @option options [Integer] :retries (1) Number of times to retry when retrieving credentials.
+    # @option options [String] :endpoint ('http://169.254.169.254') The IMDS endpoint. This option has precedence
+    #    over the `:endpoint_mode`.
+    # @option options [String] :endpoint_mode ('IPv4') The endpoint mode for the instance metadata service. This is
+    #   either 'IPv4' (`169.254.169.254`) or IPv6' (`[fd00:ec2::254]`).
+    # @option options [Boolean] :disable_imds_v1 (false) Disable the use of the legacy EC2 Metadata Service v1.
+    # @option options [String] :ip_address ('169.254.169.254') Deprecated. Use `:endpoint` instead.
+    #   The IP address for the endpoint.
     # @option options [Integer] :port (80)
     # @option options [Float] :http_open_timeout (1)
     # @option options [Float] :http_read_timeout (1)
-    # @option options [Numeric, Proc] :delay By default, failures are retried
-    #   with exponential back-off, i.e. `sleep(1.2 ** num_failures)`. You can
-    #   pass a number of seconds to sleep between failed attempts, or
-    #   a Proc that accepts the number of failures.
-    # @option options [IO] :http_debug_output (nil) HTTP wire
-    #   traces are sent to this object.  You can specify something
-    #   like $stdout.
-    # @option options [Integer] :token_ttl Time-to-Live in seconds for EC2
-    #   Metadata Token used for fetching Metadata Profile Credentials, defaults
-    #   to 21600 seconds
-    # @option options [Callable] before_refresh Proc called before
-    #   credentials are refreshed. `before_refresh` is called
-    #   with an instance of this object when
-    #   AWS credentials are required and need to be refreshed.
+    # @option options [Numeric, Proc] :delay By default, failures are retried with exponential back-off, i.e.
+    #   `sleep(1.2 ** num_failures)`. You can pass a number of seconds to sleep between failed attempts, or a Proc
+    #   that accepts the number of failures.
+    # @option options [IO] :http_debug_output (nil) HTTP wire traces are sent to this object.
+    #   You can specify something like `$stdout`.
+    # @option options [Integer] :token_ttl Time-to-Live in seconds for EC2 Metadata Token used for fetching
+    #   Metadata Profile Credentials, defaults to 21600 seconds.
+    # @option options [Callable] :before_refresh Proc called before credentials are refreshed. `before_refresh`
+    #   is called with an instance of this object when AWS credentials are required and need to be refreshed.
     def initialize(options = {})
-      @retries = options[:retries] || 1
-      endpoint_mode = resolve_endpoint_mode(options)
-      @endpoint = resolve_endpoint(options, endpoint_mode)
-      @port = options[:port] || 80
+      @backoff = resolve_backoff(options[:backoff])
+      @disable_imds_v1 = resolve_disable_v1(options)
+      @endpoint = resolve_endpoint(options)
       @http_open_timeout = options[:http_open_timeout] || 1
       @http_read_timeout = options[:http_read_timeout] || 1
       @http_debug_output = options[:http_debug_output]
-      @backoff = backoff(options[:backoff])
+      @port = options[:port] || 80
+      @retries = options[:retries] || 1
       @token_ttl = options[:token_ttl] || 21_600
-      @token = nil
-      @no_refresh_until = nil
+
       @async_refresh = false
+      @imds_v1_fallback = false
+      @no_refresh_until = nil
+      @token = nil
+      @metrics = ['CREDENTIALS_IMDS']
       super
     end
 
-    # @return [Integer] Number of times to retry when retrieving credentials
-    #   from the instance metadata service. Defaults to 0 when resolving from
-    #   the default credential chain ({Aws::CredentialProviderChain}).
+    # @return [Boolean0
+    attr_reader :disable_imds_v1
+
+    # @return [Integer]
+    attr_reader :token_ttl
+
+    # @return [Integer]
     attr_reader :retries
 
+    # @return [Proc]
+    attr_reader :backoff
+
+    # @return [String]
+    attr_reader :endpoint
+
+    # @return [Integer]
+    attr_reader :port
+
+    # @return [Integer]
+    attr_reader :http_open_timeout
+
+    # @return [Integer]
+    attr_reader :http_read_timeout
+
+    # @return [IO, nil]
+    attr_reader :http_debug_output
+
     private
 
     def resolve_endpoint_mode(options)
-      value = options[:endpoint_mode]
-      value ||= ENV['AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE']
-      value ||= Aws.shared_config.ec2_metadata_service_endpoint_mode(
-        profile: options[:profile]
-      )
-      value || 'IPv4'
+      options[:endpoint_mode] ||
+        ENV['AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE'] ||
+        Aws.shared_config.ec2_metadata_service_endpoint_mode(profile: options[:profile]) ||
+        'IPv4'
     end
 
-    def resolve_endpoint(options, endpoint_mode)
-      value = options[:endpoint] || options[:ip_address]
-      value ||= ENV['AWS_EC2_METADATA_SERVICE_ENDPOINT']
-      value ||= Aws.shared_config.ec2_metadata_service_endpoint(
-        profile: options[:profile]
-      )
+    def resolve_endpoint(options)
+      if (value = options[:ip_address])
+        warn('The `:ip_address` option is deprecated. Use `:endpoint` instead.')
+        return value
+      end
 
+      value =
+        options[:endpoint] ||
+        ENV['AWS_EC2_METADATA_SERVICE_ENDPOINT'] ||
+        Aws.shared_config.ec2_metadata_service_endpoint(profile: options[:profile]) ||
+        nil
       return value if value
 
+      endpoint_mode = resolve_endpoint_mode(options)
       case endpoint_mode.downcase
       when 'ipv4' then 'http://169.254.169.254'
       when 'ipv6' then 'http://[fd00:ec2::254]'
       else
-        raise ArgumentError,
-              ':endpoint_mode is not valid, expected IPv4 or IPv6, '\
-              "got: #{endpoint_mode}"
+        raise ArgumentError, ":endpoint_mode is not valid, expected IPv4 or IPv6, got: #{endpoint_mode}"
       end
     end
 
-    def backoff(backoff)
+    def resolve_disable_v1(options)
+      value =
+        options[:disable_imds_v1] ||
+        ENV['AWS_EC2_METADATA_V1_DISABLED'] ||
+        Aws.shared_config.ec2_metadata_v1_disabled(profile: options[:profile]) ||
+        'false'
+      Aws::Util.str_2_bool(value.to_s.downcase)
+    end
+
+    def resolve_backoff(backoff)
       case backoff
       when Proc then backoff
       when Numeric then ->(_) { sleep(backoff) }
@@ -137,107 +176,89 @@ module Aws
         return
       end
 
-      # Retry loading credentials up to 3 times is the instance metadata
-      # service is responding but is returning invalid JSON documents
-      # in response to the GET profile credentials call.
-      begin
-        retry_errors([Aws::Json::ParseError, StandardError], max_retries: 3) do
-          c = Aws::Json.load(get_credentials.to_s)
-          if empty_credentials?(@credentials)
-            @credentials = Credentials.new(
-              c['AccessKeyId'],
-              c['SecretAccessKey'],
-              c['Token']
-            )
-            @expiration = c['Expiration'] ? Time.iso8601(c['Expiration']) : nil
-            if @expiration && @expiration < Time.now
-              @no_refresh_until = Time.now + refresh_offset
-              warn_expired_credentials
-            end
-          else
-            #  credentials are already set, update them only if the new ones are not empty
-            if !c['AccessKeyId'] || c['AccessKeyId'].empty?
-              # error getting new credentials
-              @no_refresh_until = Time.now + refresh_offset
-              warn_expired_credentials
-            else
-              @credentials = Credentials.new(
-                c['AccessKeyId'],
-                c['SecretAccessKey'],
-                c['Token']
-              )
-              @expiration = c['Expiration'] ? Time.iso8601(c['Expiration']) : nil
-              if @expiration && @expiration < Time.now
-                @no_refresh_until = Time.now + refresh_offset
-                warn_expired_credentials
-              end
-            end
+      new_creds =
+        begin
+          # Retry loading credentials up to 3 times is the instance metadata
+          # service is responding but is returning invalid JSON documents
+          # in response to the GET profile credentials call.
+          retry_errors([Aws::Json::ParseError], max_retries: 3) do
+            Aws::Json.load(retrieve_credentials.to_s)
           end
-
+        rescue Aws::Json::ParseError
+          raise Aws::Errors::MetadataParserError
         end
-      rescue Aws::Json::ParseError
-        raise Aws::Errors::MetadataParserError
+
+      if @credentials&.set? && empty_credentials?(new_creds)
+        # credentials are already set, but there was an error getting new credentials
+        # so don't update the credentials and use stale ones (static stability)
+        @no_refresh_until = Time.now + rand(300..360)
+        warn_expired_credentials
+      else
+        # credentials are empty or successfully retrieved, update them
+        update_credentials(new_creds)
       end
     end
 
-    def get_credentials
+    def retrieve_credentials
       # Retry loading credentials a configurable number of times if
       # the instance metadata service is not responding.
-      if _metadata_disabled?
-        '{}'
-      else
-        begin
-          retry_errors(NETWORK_ERRORS, max_retries: @retries) do
-            open_connection do |conn|
-              # attempt to fetch token to start secure flow first
-              # and rescue to failover
-              begin
-                retry_errors(NETWORK_ERRORS, max_retries: @retries) do
-                  unless token_set?
-                    created_time = Time.now
-                    token_value, ttl = http_put(
-                      conn, METADATA_TOKEN_PATH, @token_ttl
-                    )
-                    @token = Token.new(token_value, ttl, created_time) if token_value && ttl
-                  end
-                end
-              rescue *NETWORK_ERRORS
-                # token attempt failed, reset token
-                # fallback to non-token mode
-                @token = nil
-              end
-
-              token = @token.value if token_set?
-
-              begin
-                metadata = http_get(conn, METADATA_PATH_BASE, token)
-                profile_name = metadata.lines.first.strip
-                http_get(conn, METADATA_PATH_BASE + profile_name, token)
-              rescue TokenExpiredError
-                # Token has expired, reset it
-                # The next retry should fetch it
-                @token = nil
-                raise Non200Response
-              end
-            end
+      begin
+        retry_errors(NETWORK_ERRORS, max_retries: @retries) do
+          open_connection do |conn|
+            # attempt to fetch token to start secure flow first
+            # and rescue to failover
+            fetch_token(conn) unless @imds_v1_fallback || (@token && !@token.expired?)
+
+            # disable insecure flow if we couldn't get token and imds v1 is disabled
+            raise TokenRetrivalError if @token.nil? && @disable_imds_v1
+
+            fetch_credentials(conn)
           end
-        rescue
-          '{}'
         end
+      rescue StandardError => e
+        warn("Error retrieving instance profile credentials: #{e}")
+        '{}'
       end
     end
 
-    def token_set?
-      @token && !@token.expired?
+    def update_credentials(creds)
+      @credentials = Credentials.new(creds['AccessKeyId'], creds['SecretAccessKey'], creds['Token'])
+      @expiration = creds['Expiration'] ? Time.iso8601(creds['Expiration']) : nil
+      return unless @expiration && @expiration < Time.now
+
+      @no_refresh_until = Time.now + rand(300..360)
+      warn_expired_credentials
     end
 
-    def _metadata_disabled?
-      ENV.fetch('AWS_EC2_METADATA_DISABLED', 'false').downcase == 'true'
+    def fetch_token(conn)
+      created_time = Time.now
+      token_value, ttl = http_put(conn)
+      @token = Token.new(token_value, ttl, created_time) if token_value && ttl
+    rescue *NETWORK_ERRORS
+      # token attempt failed, reset token
+      # fallback to non-token mode
+      @imds_v1_fallback = true
+    end
+
+    def fetch_credentials(conn)
+      metadata = http_get(conn, METADATA_PATH_BASE)
+      profile_name = metadata.lines.first.strip
+      http_get(conn, METADATA_PATH_BASE + profile_name)
+    rescue TokenExpiredError
+      # Token has expired, reset it
+      # The next retry should fetch it
+      @token = nil
+      @imds_v1_fallback = false
+      raise Non200Response
+    end
+
+    def token_set?
+      @token && !@token.expired?
     end
 
     def open_connection
       uri = URI.parse(@endpoint)
-      http = Net::HTTP.new(uri.hostname || @endpoint, @port || uri.port)
+      http = Net::HTTP.new(uri.hostname || @endpoint, uri.port || @port)
       http.open_timeout = @http_open_timeout
       http.read_timeout = @http_read_timeout
       http.set_debug_output(@http_debug_output) if @http_debug_output
@@ -246,9 +267,9 @@ module Aws
     end
 
     # GET request fetch profile and credentials
-    def http_get(connection, path, token = nil)
+    def http_get(connection, path)
       headers = { 'User-Agent' => "aws-sdk-ruby3/#{CORE_GEM_VERSION}" }
-      headers['x-aws-ec2-metadata-token'] = token if token
+      headers['x-aws-ec2-metadata-token'] = @token.value if @token
       response = connection.request(Net::HTTP::Get.new(path, headers))
 
       case response.code.to_i
@@ -262,12 +283,12 @@ module Aws
     end
 
     # PUT request fetch token with ttl
-    def http_put(connection, path, ttl)
+    def http_put(connection)
       headers = {
         'User-Agent' => "aws-sdk-ruby3/#{CORE_GEM_VERSION}",
-        'x-aws-ec2-metadata-token-ttl-seconds' => ttl.to_s
+        'x-aws-ec2-metadata-token-ttl-seconds' => @token_ttl.to_s
       }
-      response = connection.request(Net::HTTP::Put.new(path, headers))
+      response = connection.request(Net::HTTP::Put.new(METADATA_TOKEN_PATH, headers))
       case response.code.to_i
       when 200
         [
@@ -276,8 +297,6 @@ module Aws
         ]
       when 400
         raise TokenRetrivalError
-      when 401
-        raise TokenExpiredError
       else
         raise Non200Response
       end
@@ -298,18 +317,12 @@ module Aws
     end
 
     def warn_expired_credentials
-      warn("Attempting credential expiration extension due to a credential "\
-        "service availability issue. A refresh of these credentials "\
-        "will be attempted again in 5 minutes.")
-    end
-
-    def empty_credentials?(creds)
-      !creds || !creds.access_key_id || creds.access_key_id.empty?
+      warn('Attempting credential expiration extension due to a credential service availability issue. '\
+             'A refresh of these credentials will be attempted again in 5 minutes.')
     end
 
-    # Compute an offset for refresh with jitter
-    def refresh_offset
-      300 + rand(0..60)
+    def empty_credentials?(creds_hash)
+      !creds_hash['AccessKeyId'] || creds_hash['AccessKeyId'].empty?
     end
 
     # @api private

data/lib/aws-sdk-core/json/builder.rb

@@ -8,7 +8,7 @@ module Aws
 
       include Seahorse::Model::Shapes
 
-      def initialize(rules)
+      def initialize(rules, _options = {})
         @rules = rules
       end
 
@@ -20,6 +20,8 @@ module Aws
       private
 
       def structure(ref, values)
+        return nil if values.nil?
+
         shape = ref.shape
         values.each_pair.with_object({}) do |(key, value), data|
           if shape.member?(key) && !value.nil?
@@ -31,11 +33,15 @@ module Aws
       end
 
       def list(ref, values)
+        return nil if values.nil?
+
         member_ref = ref.shape.member
         values.collect { |value| format(member_ref, value) }
       end
 
       def map(ref, values)
+        return nil if values.nil?
+
         value_ref = ref.shape.value
         values.each.with_object({}) do |(key, value), data|
           data[key] = format(value_ref, value)
@@ -49,6 +55,7 @@ module Aws
         when MapShape       then map(ref, value)
         when TimestampShape then timestamp(ref, value)
         when BlobShape      then encode(value)
+        when FloatShape     then Util.serialize_number(value)
         else value
         end
       end