aws-sdk-core 3.171.1 → 3.234.0

data/lib/aws-sdk-core/plugins/sign.rb

@@ -13,10 +13,6 @@ module Aws
       option(:sigv4_region)
       option(:unsigned_operations, default: [])
 
-      supported_auth_types = %w[sigv4 bearer none]
-      supported_auth_types += ['sigv4a'] if Aws::Sigv4::Signer.use_crt?
-      SUPPORTED_AUTH_TYPES = supported_auth_types.freeze
-
       def add_handlers(handlers, cfg)
         operations = cfg.api.operation_names - cfg.unsigned_operations
         handlers.add(Handler, step: :sign, operations: operations)
@@ -24,12 +20,16 @@ module Aws
 
       # @api private
       # Return a signer with the `sign(context)` method
-      def self.signer_for(auth_scheme, config, region_override = nil)
+      def self.signer_for(auth_scheme, config, sigv4_region_override = nil, sigv4_credentials_override = nil)
         case auth_scheme['name']
-        when 'sigv4', 'sigv4a'
-          SignatureV4.new(auth_scheme, config, region_override)
+        when 'sigv4', 'sigv4a', 'sigv4-s3express'
+          sigv4_overrides = {
+            region: sigv4_region_override,
+            credentials: sigv4_credentials_override
+          }
+          SignatureV4.new(auth_scheme, config, sigv4_overrides)
         when 'bearer'
-          Bearer.new
+          Bearer.new(config)
         else
           NullSigner.new
         end
@@ -42,15 +42,27 @@ module Aws
             signer = Sign.signer_for(
               context[:auth_scheme],
               context.config,
-              context[:sigv4_region]
+              context[:sigv4_region],
+              context[:sigv4_credentials]
             )
             signer.sign(context)
           end
-          @handler.call(context)
+          with_metrics(signer) { @handler.call(context) }
         end
 
         private
 
+        def with_metrics(signer, &block)
+          case signer
+          when SignatureV4
+            Aws::Plugins::UserAgent.metric(*signer.credentials.metrics, &block)
+          when Bearer
+            Aws::Plugins::UserAgent.metric(*signer.token_provider.metrics, &block)
+          else
+            block.call
+          end
+        end
+
         def v2_signing?(config)
           # 's3' is legacy signing, 'v4' is default
           config.respond_to?(:signature_version) &&
@@ -60,21 +72,19 @@ module Aws
 
       # @api private
       class Bearer
-        def initialize
+        def initialize(config)
+          @token_provider = config.token_provider
         end
 
+        attr_reader :token_provider
+
         def sign(context)
           if context.http_request.endpoint.scheme != 'https'
-            raise ArgumentError,
-                  'Unable to use bearer authorization on non https endpoint.'
+            raise ArgumentError, 'Unable to use bearer authorization on non https endpoint.'
           end
+          raise Errors::MissingBearerTokenError unless @token_provider && @token_provider.set?
 
-          token_provider = context.config.token_provider
-
-          raise Errors::MissingBearerTokenError unless token_provider&.set?
-
-          context.http_request.headers['Authorization'] =
-            "Bearer #{token_provider.token.token}"
+          context.http_request.headers['Authorization'] = "Bearer #{@token_provider.token.token}"
         end
 
         def presign_url(*args)
@@ -88,33 +98,33 @@ module Aws
 
       # @api private
       class SignatureV4
-        def initialize(auth_scheme, config, region_override = nil)
+        def initialize(auth_scheme, config, sigv4_overrides = {})
           scheme_name = auth_scheme['name']
-
-          unless %w[sigv4 sigv4a].include?(scheme_name)
-            raise ArgumentError,
-                  "Expected sigv4 or sigv4a auth scheme, got #{scheme_name}"
+          unless %w[sigv4 sigv4a sigv4-s3express].include?(scheme_name)
+            raise ArgumentError, "Expected sigv4, sigv4a, or sigv4-s3express auth scheme, got #{scheme_name}"
           end
-
           region = if scheme_name == 'sigv4a'
-                     auth_scheme['signingRegionSet'].first
+                     auth_scheme['signingRegionSet'].join(',')
                    else
                      auth_scheme['signingRegion']
                    end
           begin
-            @signer = Aws::Sigv4::Signer.new(
+            @signer = config.sigv4_signer || Aws::Sigv4::Signer.new(
               service: config.sigv4_name || auth_scheme['signingName'],
-              region: region_override || config.sigv4_region || region,
-              credentials_provider: config.credentials,
+              region: sigv4_overrides[:region] || config.sigv4_region || region,
+              credentials_provider: sigv4_overrides[:credentials] || config.credentials,
               signing_algorithm: scheme_name.to_sym,
-              uri_escape_path: !!!auth_scheme['disableDoubleEncoding'],
-              unsigned_headers: %w[content-length user-agent x-amzn-trace-id]
+              uri_escape_path: !auth_scheme['disableDoubleEncoding'],
+              normalize_path: !auth_scheme['disableNormalizePath'],
+              unsigned_headers: %w[content-length user-agent x-amzn-trace-id expect transfer-encoding connection]
             )
           rescue Aws::Sigv4::Errors::MissingCredentialsError
             raise Aws::Errors::MissingCredentialsError
           end
         end
 
+        attr_reader :signer
+
         def sign(context)
           req = context.http_request
 
@@ -150,15 +160,27 @@ module Aws
           @signer.sign_event(*args)
         end
 
+        def credentials
+          @signer.credentials_provider
+        end
+
         private
 
         def apply_authtype(context, req)
-          if context.operation['authtype'].eql?('v4-unsigned-body') &&
-             req.endpoint.scheme.eql?('https')
+          # only used for event streaming at input
+          if context[:input_event_emitter]
+            req.headers['X-Amz-Content-Sha256'] = 'STREAMING-AWS4-HMAC-SHA256-EVENTS'
+          elsif unsigned_payload?(context, req)
             req.headers['X-Amz-Content-Sha256'] ||= 'UNSIGNED-PAYLOAD'
           end
         end
 
+        def unsigned_payload?(context, req)
+          (context.operation['unsignedPayload'] ||
+            context.operation['authtype'] == 'v4-unsigned-body') &&
+            req.endpoint.scheme == 'https'
+        end
+
         def reset_signature(req)
           # in case this request is being re-signed
           req.headers.delete('Authorization')

data/lib/aws-sdk-core/plugins/signature_v2.rb

@@ -3,7 +3,8 @@
 module Aws
   module Plugins
     # @api private
-    # Necessary to keep after Endpoints 2.0
+    # Deprecated - does not look at new traits like `auth` and `unsignedPayload`
+    # Necessary to exist after endpoints 2.0 for old service clients + new core
     class SignatureV2 < Seahorse::Client::Plugin
 
       option(:v2_signer) do |cfg|

data/lib/aws-sdk-core/plugins/signature_v4.rb

@@ -5,7 +5,8 @@ require 'aws-sigv4'
 module Aws
   module Plugins
     # @api private
-    # Necessary to exist after endpoints 2.0
+    # Deprecated - does not look at new traits like `auth` and `unsignedPayload`
+    # Necessary to exist after endpoints 2.0 for old service clients + new core
     class SignatureV4 < Seahorse::Client::Plugin
 
       V4_AUTH = %w[v4 v4-unsigned-payload v4-unsigned-body]

data/lib/aws-sdk-core/plugins/stub_responses.rb

@@ -8,6 +8,7 @@ module Aws
       option(:stub_responses,
         default: false,
         doc_type: 'Boolean',
+        rbs_type: 'untyped',
         docstring: <<-DOCS)
 Causes the client to return stubbed responses. By default
 fake responses are generated and returned. You can specify
@@ -28,8 +29,22 @@ requests are made, and retries are disabled.
         end
       end
 
+      option(:token_provider) do |config|
+        if config.stub_responses
+          StaticTokenProvider.new('stubbed-token')
+        end
+      end
+
+      option(:stubs) { {} }
+      option(:stubs_mutex) { Mutex.new }
+      option(:api_requests) { [] }
+      option(:api_requests_mutex) { Mutex.new }
+
       def add_handlers(handlers, config)
-        handlers.add(Handler, step: :send) if config.stub_responses
+        return unless config.stub_responses
+
+        handlers.add(ApiRequestsHandler)
+        handlers.add(StubbingHandler, step: :send)
       end
 
       def after_initialize(client)
@@ -45,20 +60,43 @@ requests are made, and retries are disabled.
         end
       end
 
-      class Handler < Seahorse::Client::Handler
+      class ApiRequestsHandler < Seahorse::Client::Handler
+        def call(context)
+          context.config.api_requests_mutex.synchronize do
+            context.config.api_requests << {
+              operation_name: context.operation_name,
+              params: context.params,
+              context: context
+            }
+          end
+          @handler.call(context)
+        end
+      end
 
+      class StubbingHandler < Seahorse::Client::Handler
         def call(context)
-          stub = context.client.next_stub(context)
+          span_wrapper(context) do
+            stub_responses(context)
+          end
+        end
+
+        private
+
+        def stub_responses(context)
           resp = Seahorse::Client::Response.new(context: context)
           async_mode = context.client.is_a? Seahorse::Client::AsyncBase
-          if Hash === stub && stub[:mutex]
-            stub[:mutex].synchronize { apply_stub(stub, resp, async_mode) }
+          stub = context.client.next_stub(context)
+          stub[:mutex].synchronize { apply_stub(stub, resp, async_mode) }
+
+          if async_mode
+            Seahorse::Client::AsyncResponse.new(
+              context: context,
+              stream: context[:input_event_stream_handler].event_emitter.stream,
+              sync_queue: Queue.new
+            )
           else
-            apply_stub(stub, resp, async_mode)
+            resp
           end
-
-          async_mode ? Seahorse::Client::AsyncResponse.new(
-            context: context, stream: context[:input_event_stream_handler].event_emitter.stream, sync_queue: Queue.new) : resp
         end
 
         def apply_stub(stub, response, async_mode = false)
@@ -98,6 +136,18 @@ requests are made, and retries are disabled.
           http_resp.signal_done
         end
 
+        def span_wrapper(context, &block)
+          context.tracer.in_span(
+            'Handler.StubResponses',
+            attributes: Aws::Telemetry.http_request_attrs(context)
+          ) do |span|
+            block.call.tap do
+              span.add_attributes(
+                Aws::Telemetry.http_response_attrs(context)
+              )
+            end
+          end
+        end
       end
     end
   end

data/lib/aws-sdk-core/plugins/telemetry.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Aws
+  module Plugins
+    # @api private
+    class Telemetry < Seahorse::Client::Plugin
+      option(
+        :telemetry_provider,
+        default: Aws::Telemetry::NoOpTelemetryProvider,
+        doc_type: Aws::Telemetry::TelemetryProviderBase,
+        rbs_type: Aws::Telemetry::TelemetryProviderBase,
+        docstring: <<-DOCS) do |_cfg|
+Allows you to provide a telemetry provider, which is used to 
+emit telemetry data. By default, uses `NoOpTelemetryProvider` which 
+will not record or emit any telemetry data. The SDK supports the 
+following telemetry providers:
+
+* OpenTelemetry (OTel) - To use the OTel provider, install and require the 
+`opentelemetry-sdk` gem and then, pass in an instance of a 
+`Aws::Telemetry::OTelProvider` for telemetry provider.
+        DOCS
+        Aws::Telemetry::NoOpTelemetryProvider.new
+      end
+
+      def after_initialize(client)
+        validate_telemetry_provider(client.config)
+      end
+
+      def validate_telemetry_provider(config)
+        unless config.telemetry_provider.is_a?(Aws::Telemetry::TelemetryProviderBase)
+          raise ArgumentError,
+                'Must provide a telemetry provider for the '\
+                '`telemetry_provider` configuration option.'
+        end
+      end
+
+      class Handler < Seahorse::Client::Handler
+        def call(context)
+          span_wrapper(context) { @handler.call(context) }
+        end
+
+        private
+
+        def span_wrapper(context, &block)
+          service_id = service_id(context)
+          attributes = {
+            'rpc.system' => 'aws-api',
+            'rpc.service' => service_id,
+            'rpc.method' => context.operation.name,
+            'code.function' => context.operation_name.to_s,
+            'code.namespace' => 'Aws::Plugins::Telemetry'
+          }
+          context.tracer.in_span(
+            parent_span_name(context, service_id),
+            attributes: attributes,
+            kind: Aws::Telemetry::SpanKind::CLIENT,
+            &block
+          )
+        end
+
+        def service_id(context)
+          context.config.api.metadata['serviceId'] ||
+            context.config.api.metadata['serviceAbbreviation'] ||
+            context.config.api.metadata['serviceFullName']
+        end
+
+        def parent_span_name(context, service_id)
+          "#{service_id}.#{context.operation.name}".delete(' ')
+        end
+      end
+
+      handler(Handler, step: :initialize, priority: 99)
+    end
+  end
+end

data/lib/aws-sdk-core/plugins/transfer_encoding.rb

@@ -5,7 +5,8 @@ module Aws
 
     # For Streaming Input Operations, when `requiresLength` is enabled
     # checking whether `Content-Length` header can be set,
-    # for `v4-unsigned-body` operations, set `Transfer-Encoding` header
+    # for `unsignedPayload` and `v4-unsigned-body` operations,
+    # set `Transfer-Encoding` header.
     class TransferEncoding < Seahorse::Client::Plugin
 
       # @api private
@@ -16,8 +17,8 @@ module Aws
             unless context.http_request.body.respond_to?(:size)
               if requires_length?(context.operation.input)
                 # if size of the IO is not available but required
-                raise Aws::Errors::MissingContentLength.new
-              elsif context.operation['authtype'] == "v4-unsigned-body"
+                raise Aws::Errors::MissingContentLength
+              elsif unsigned_payload?(context.operation)
                 context.http_request.headers['Transfer-Encoding'] = 'chunked'
               end
             end
@@ -29,18 +30,24 @@ module Aws
         private
 
         def streaming?(ref)
-          if payload = ref[:payload_member]
-            payload["streaming"] || # checking ref and shape
-              payload.shape["streaming"]
+          if (payload = ref[:payload_member])
+            payload['streaming'] || payload.shape['streaming']
           else
             false
           end
         end
 
+        def unsigned_payload?(operation)
+          operation['unsignedPayload'] ||
+            operation['authtype'] == 'v4-unsigned-body'
+        end
+
         def requires_length?(ref)
-          payload = ref[:payload_member]
-          payload["requiresLength"] || # checking ref and shape
-            payload.shape["requiresLength"]
+          if (payload = ref[:payload_member])
+            payload['requiresLength'] || payload.shape['requiresLength']
+          else
+            false
+          end
         end
 
       end

data/lib/aws-sdk-core/plugins/user_agent.rb

@@ -4,7 +4,93 @@ module Aws
   module Plugins
     # @api private
     class UserAgent < Seahorse::Client::Plugin
+      METRICS = Aws::Json.load(<<-METRICS)
+        {
+          "RESOURCE_MODEL": "A",
+          "WAITER": "B",
+          "PAGINATOR": "C",
+          "RETRY_MODE_LEGACY": "D",
+          "RETRY_MODE_STANDARD": "E",
+          "RETRY_MODE_ADAPTIVE": "F",
+          "S3_TRANSFER": "G",
+          "S3_CRYPTO_V1N": "H",
+          "S3_CRYPTO_V2": "I",
+          "S3_EXPRESS_BUCKET": "J",
+          "S3_ACCESS_GRANTS": "K",
+          "GZIP_REQUEST_COMPRESSION": "L",
+          "PROTOCOL_RPC_V2_CBOR": "M",
+          "ENDPOINT_OVERRIDE": "N",
+          "ACCOUNT_ID_ENDPOINT": "O",
+          "ACCOUNT_ID_MODE_PREFERRED": "P",
+          "ACCOUNT_ID_MODE_DISABLED": "Q",
+          "ACCOUNT_ID_MODE_REQUIRED": "R",
+          "SIGV4A_SIGNING": "S",
+          "RESOLVED_ACCOUNT_ID": "T",
+          "FLEXIBLE_CHECKSUMS_REQ_CRC32" : "U",
+          "FLEXIBLE_CHECKSUMS_REQ_CRC32C" : "V",
+          "FLEXIBLE_CHECKSUMS_REQ_CRC64" : "W",
+          "FLEXIBLE_CHECKSUMS_REQ_SHA1" : "X",
+          "FLEXIBLE_CHECKSUMS_REQ_SHA256" : "Y",
+          "FLEXIBLE_CHECKSUMS_REQ_WHEN_SUPPORTED" : "Z",
+          "FLEXIBLE_CHECKSUMS_REQ_WHEN_REQUIRED" : "a",
+          "FLEXIBLE_CHECKSUMS_RES_WHEN_SUPPORTED" : "b",
+          "FLEXIBLE_CHECKSUMS_RES_WHEN_REQUIRED" : "c",
+          "DDB_MAPPER": "d",
+          "CREDENTIALS_CODE" : "e",
+          "CREDENTIALS_ENV_VARS" : "g",
+          "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN" : "h",
+          "CREDENTIALS_STS_ASSUME_ROLE" : "i",
+          "CREDENTIALS_STS_ASSUME_ROLE_WEB_ID" : "k",
+          "CREDENTIALS_PROFILE" : "n",
+          "CREDENTIALS_PROFILE_SOURCE_PROFILE" : "o",
+          "CREDENTIALS_PROFILE_NAMED_PROVIDER" : "p",
+          "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN" : "q",
+          "CREDENTIALS_PROFILE_SSO" : "r",
+          "CREDENTIALS_SSO" : "s",
+          "CREDENTIALS_PROFILE_SSO_LEGACY" : "t",
+          "CREDENTIALS_SSO_LEGACY" : "u",
+          "CREDENTIALS_PROFILE_PROCESS" : "v",
+          "CREDENTIALS_PROCESS" : "w",
+          "CREDENTIALS_HTTP" : "z",
+          "CREDENTIALS_IMDS" : "0",
+          "SSO_LOGIN_DEVICE" : "1",
+          "SSO_LOGIN_AUTH" : "2",
+          "BEARER_SERVICE_ENV_VARS": "3"
+        }
+      METRICS
+
+      # @api private
       option(:user_agent_suffix)
+      # @api private
+      option(:user_agent_frameworks, default: [])
+
+      option(
+        :sdk_ua_app_id,
+        doc_type: 'String',
+        docstring: <<-DOCS) do |cfg|
+A unique and opaque application ID that is appended to the
+User-Agent header as app/sdk_ua_app_id. It should have a
+maximum length of 50. This variable is sourced from environment
+variable AWS_SDK_UA_APP_ID or the shared config profile attribute sdk_ua_app_id.
+        DOCS
+        app_id = ENV['AWS_SDK_UA_APP_ID']
+        app_id ||= Aws.shared_config.sdk_ua_app_id(profile: cfg.profile)
+        app_id
+      end
+
+      # Deprecated - must exist for old service gems
+      def self.feature(_feature, &block)
+        block.call
+      end
+
+      def self.metric(*metrics, &block)
+        Thread.current[:aws_sdk_core_user_agent_metric] ||= []
+        metrics = metrics.map { |metric| METRICS[metric] }.compact
+        Thread.current[:aws_sdk_core_user_agent_metric].concat(metrics)
+        block.call
+      ensure
+        Thread.current[:aws_sdk_core_user_agent_metric].pop(metrics.size)
+      end
 
       # @api private
       class Handler < Seahorse::Client::Handler
@@ -14,33 +100,125 @@ module Aws
         end
 
         def set_user_agent(context)
-          ua = "aws-sdk-ruby3/#{CORE_GEM_VERSION}"
+          context.http_request.headers['User-Agent'] = UserAgent.new(context).to_s
+        end
+
+        class UserAgent
+          def initialize(context)
+            @context = context
+          end
+
+          def to_s
+            ua = "aws-sdk-ruby3/#{CORE_GEM_VERSION}"
+            ua += ' ua/2.1'
+            if (api_m = api_metadata)
+              ua += " #{api_m}"
+            end
+            ua += " #{os_metadata}"
+            ua += " #{language_metadata}"
+            if (env_m = env_metadata)
+              ua += " #{env_m}"
+            end
+            if (app_id_m = app_id_metadata)
+              ua += " #{app_id_m}"
+            end
+            if (framework_m = framework_metadata)
+              ua += " #{framework_m}"
+            end
+            if (metric_m = metric_metadata)
+              ua += " #{metric_m}"
+            end
+            if @context.config.user_agent_suffix
+              ua += " #{@context.config.user_agent_suffix}"
+            end
+            ua.strip
+          end
+
+          private
 
-          begin
-            ua += " #{RUBY_ENGINE}/#{RUBY_VERSION}"
-          rescue
-            ua += " RUBY_ENGINE_NA/#{RUBY_VERSION}"
+          # Used to be gem_name/gem_version
+          def api_metadata
+            service_id = @context.config.api.metadata['serviceId']
+            return unless service_id
+
+            service_id = service_id.gsub(' ', '_').downcase
+            gem_version = @context[:gem_version]
+            "api/#{service_id}##{gem_version}"
           end
 
-          ua += " #{RUBY_PLATFORM}"
+          # Used to be RUBY_PLATFORM
+          def os_metadata
+            os =
+              case RbConfig::CONFIG['host_os']
+              when /mac|darwin/
+                'macos'
+              when /linux|cygwin/
+                'linux'
+              when /mingw|mswin/
+                'windows'
+              else
+                'other'
+              end
+            metadata = "os/#{os}"
+            local_version = Gem::Platform.local.version
+            metadata += "##{local_version}" if local_version
+            metadata += " md/#{RbConfig::CONFIG['host_cpu']}"
+          end
 
-          if context[:gem_name] && context[:gem_version]
-            ua += " #{context[:gem_name]}/#{context[:gem_version]}"
+          # Used to be RUBY_ENGINE/RUBY_VERSION
+          def language_metadata
+            "lang/#{RUBY_ENGINE}##{RUBY_ENGINE_VERSION} md/#{RUBY_VERSION}"
           end
 
-          if (execution_env = ENV['AWS_EXECUTION_ENV'])
-            ua += " exec-env/#{execution_env}"
+          def env_metadata
+            return unless (execution_env = ENV['AWS_EXECUTION_ENV'])
+
+            "exec-env/#{execution_env}"
           end
 
-          if context.config.user_agent_suffix
-            ua += " #{context.config.user_agent_suffix}"
+          def app_id_metadata
+            return unless (app_id = @context.config.sdk_ua_app_id)
+
+            # Sanitize and only allow these characters
+            app_id = app_id.gsub(/[^!#$%&'*+\-.^_`|~0-9A-Za-z]/, '-')
+            "app/#{app_id}"
           end
 
-          context.http_request.headers['User-Agent'] = ua.strip
+          def framework_metadata
+            if (frameworks_cfg = @context.config.user_agent_frameworks).empty?
+              return
+            end
+
+            # Frameworks may be aws-record, aws-sdk-rails, etc.
+            regex = /gems\/(?<name>#{frameworks_cfg.join('|')})-(?<version>\d+\.\d+\.\d+)/.freeze
+            frameworks = {}
+            Kernel.caller.each do |line|
+              match = line.match(regex)
+              next unless match
+
+              frameworks[match[:name]] = match[:version]
+            end
+            frameworks.map { |n, v| "lib/#{n}##{v}" }.join(' ')
+          end
+
+          def metric_metadata
+            if Thread.current[:aws_sdk_core_user_agent_metric].nil? ||
+               Thread.current[:aws_sdk_core_user_agent_metric].empty?
+              return
+            end
+
+            metrics = Thread.current[:aws_sdk_core_user_agent_metric].join(',')
+            # Metric metadata is limited to 1024 bytes
+            return "m/#{metrics}" if metrics.bytesize <= 1024
+
+            # Removes the last unfinished metric
+            "m/#{metrics[0...metrics[0..1024].rindex(',')]}"
+          end
         end
       end
 
-      handler(Handler)
+      # Priority set to 5 in order to add user agent as late as possible after signing
+      handler(Handler, step: :sign, priority: 5)
     end
   end
 end