aws-sdk-core 3.263.0 → 3.264.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e12759793414117f403e7057cb739735502fdb49b051ff038d55c745852b593
-  data.tar.gz: d39be33db7594287f3eba7dab5dee03a0cbd0742189a7808d70b496703754c0c
+  metadata.gz: 0c0e562777b1e5fdc50edc2441fb40908175d08e94fdc0f74bf2d615a1b3586d
+  data.tar.gz: 42ae671ab8a8384b8a254258a9706297f29035cb97d039f6e69d37ca2a078a99
 SHA512:
-  metadata.gz: 50573d7d9dd51663613b353a63fd648f8e481d43ea6c04d8831fa79830e8372aca0f26f69dd62f129a5e7acb6e64aae747a62a844c3be85b649754cd70e9c053
-  data.tar.gz: 4ff98b02a41384117b0c6beb0d231e6b5151a3c54c01dda97482e79d26d4ab1ce4322519b4b64e4ee9522ebf9ce424a661ae7d944da1f9da67fd24e1540047ec
+  metadata.gz: 9a0c773c066180a85a9e1a4d1a05cfe0ef5f7d04244719e3e1daa7887ac36177c30bf00bca21b74946a7ef4db5e3d7fea8a4185a4723c26beee9df76de351ac6
+  data.tar.gz: 0e3b4e4f29d1b814c35842e62f2b812984f3ce4454e27e074cd63f38aefc713355dd35659ff6336b30b5ce7daaf7d81be157c9b6e3117ece4c92d4c8e492f79c

data/CHANGELOG.md

@@ -1,6 +1,13 @@
 Unreleased Changes
 ------------------
 
+3.264.0 (2026-11-04)
+------------------
+
+* Feature - Support refreshing login credentials in the cached sign-in region, falling back to the configured region when missing or empty.
+
+* Issue - Fix clock skew correction for long-running requests and slow response downloads by using the time response headers are received.
+
 3.263.0 (2026-10-29)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-3.263.0
+3.264.0

data/lib/aws-sdk-core/login_credentials.rb

@@ -12,7 +12,9 @@ module Aws
   #     ec2 = Aws::EC2::Client.new(credentials: login_credentials)
   #
   # If you omit the `:client` option, a new {Aws::Signin::Client} object will
-  # be constructed with additional options that were provided.
+  # be constructed with additional options that were provided. When the cached
+  # token records a different `signInRegion`, a client for that region is
+  # constructed the same way and used to refresh.
   class LoginCredentials
     include CredentialProvider
     include RefreshingCredentials
@@ -23,22 +25,26 @@ module Aws
     #   PowerShell automatically.
     #
     # @option options [Signin::Client] :client Optional `Signin::Client`.
-    #   If not provided, a client will be constructed.
+    #   If not provided, a client will be constructed. A provided client is
+    #   used for every refresh, so it must be configured for the region the
+    #   login token was issued in.
     def initialize(options = {})
       raise ArgumentError, 'Missing login_session' unless options[:login_session]
 
       @login_session = options.delete(:login_session)
       @client = options[:client]
       unless @client
-        client_opts = options.reject { |key, _| CLIENT_EXCLUDE_OPTIONS.include?(key) }
-        @client = Signin::Client.new(client_opts.merge(credentials: nil))
+        @client_opts = options.reject { |key, _| CLIENT_EXCLUDE_OPTIONS.include?(key) }.merge(credentials: nil)
+        @client = Signin::Client.new(@client_opts)
       end
       @metrics = ['CREDENTIALS_LOGIN']
       @async_refresh = true
       super
     end
 
-    # @return [Signin::Client]
+    # @return [Signin::Client] The client built from the given options. A refresh
+    #   uses a client for another region when the cached token records a different
+    #   `signInRegion`.
     attr_reader :client
 
     private
@@ -138,7 +144,7 @@ module Aws
           refresh_token: token_json['refreshToken']
         }
       }
-      req = @client.build_request(:create_o_auth_2_token, options)
+      req = signin_client(token_json['signInRegion']).build_request(:create_o_auth_2_token, options)
       endpoint_params = Aws::Signin::EndpointParameters.create(req.context.config)
       endpoint = req.context.config.endpoint_provider.resolve_endpoint(endpoint_params)
       endpoint = URI.join(endpoint.url, @client.config.api.operation(:create_o_auth_2_token).http_request_uri).to_s
@@ -146,6 +152,15 @@ module Aws
       req.send_request
     end
 
+    # Refresh tokens can only be redeemed in the region they were issued in,
+    # which the login tool records in the cached token as `signInRegion`.
+    def signin_client(signin_region)
+      return @client if @client_opts.nil? || signin_region.to_s.empty? || signin_region == @client.config.region
+
+      @signin_region_clients ||= {}
+      @signin_region_clients[signin_region] ||= Signin::Client.new(@client_opts.merge(region: signin_region))
+    end
+
     def dpop_proof(dpop_key, endpoint)
       # Load private key from cached token file
       private_key = OpenSSL::PKey.read(dpop_key)

data/lib/aws-sdk-core/plugins/retries/clock_skew.rb

@@ -39,7 +39,7 @@ module Aws
 
         # Whether a response indicates skew large enough to warrant a retry; records nothing.
         # @param context [Seahorse::Client::RequestContext]
-        # @param sent_at [Time, nil] raw (pre-skew) send time, for the midpoint calculation
+        # @param sent_at [Time, nil] raw (pre-skew) send time, to discard slow requests
         def clock_skewed?(context, sent_at = nil)
           candidate = candidate_skew(context, sent_at)
           !!candidate && candidate.abs > CLOCK_SKEW_THRESHOLD
@@ -47,7 +47,7 @@ module Aws
 
         # Called on every response; records the skew candidate when one can be computed.
         # @param context [Seahorse::Client::RequestContext]
-        # @param sent_at [Time, nil] raw (pre-skew) send time, for the midpoint calculation
+        # @param sent_at [Time, nil] raw (pre-skew) send time, to discard slow requests
         def update_clock_correction(context, sent_at = nil)
           candidate = candidate_skew(context, sent_at)
           return if candidate.nil?
@@ -74,23 +74,22 @@ module Aws
         private
 
         # Single source of truth for skew computation; returns a Float skew or nil.
+        # The candidate is the server Date minus the time the response headers were
+        # received (the current time if that was not recorded).
         # @param context [Seahorse::Client::RequestContext]
-        # @param sent_at [Time, nil] raw (pre-skew) send time; midpoint when present, else server - now
+        # @param sent_at [Time, nil] raw (pre-skew) send time; used only to discard slow requests
         # @return [Float, nil]
         def candidate_skew(context, sent_at = nil)
           response = context.http_response
           server_time = server_time(response)
           # No candidate if the Date header is absent/unparseable or the response was cached.
           return nil if server_time.nil? || response.headers['age']
-          return server_time - Time.now.utc unless sent_at
 
-          received_at = Time.now.utc
-          elapsed = received_at - sent_at
+          received_at = context.metadata[:response_received_at] || Time.now.utc
           # Discard if the request was too slow for the measurement to be trusted.
-          return nil if elapsed > MAX_TRUSTED_REQUEST_DURATION
+          return nil if sent_at && received_at - sent_at > MAX_TRUSTED_REQUEST_DURATION
 
-          # Midpoint formula (NTP clock offset, RFC 5905 section 8).
-          server_time - (sent_at + (elapsed / 2.0))
+          server_time - received_at
         end
 
         ##

data/lib/aws-sdk-core/plugins/retry_errors.rb

@@ -177,6 +177,16 @@ module Aws
       DYNAMODB_SERVICES = Set['DynamoDB', 'DynamoDB Streams'].freeze
 
       class << self
+        # @api private
+        # HTTP retries preserve the listener, so register it only once.
+        def track_response_time(context)
+          return unless context.retries.zero?
+
+          context.http_response.on_headers do
+            context.metadata[:response_received_at] = Time.now.utc
+          end
+        end
+
         # TODO: Remove this gate and hardcode new retry behavior once
         # AWS_NEW_RETRIES_2026 is enabled by default, which includes:
         # - Default retry_mode to 'standard'
@@ -294,6 +304,7 @@ module Aws
         def call(context)
           context.metadata[:retries] ||= {}
           config = context.config
+          RetryErrors.track_response_time(context)
 
           get_send_token(config)
           add_retry_headers(context)
@@ -451,6 +462,7 @@ module Aws
           context.config.credentials.refresh! if refresh_credentials?(context, error)
           context.http_request.body.rewind
           context.http_response.reset
+          context.metadata.delete(:response_received_at)
           call(context)
         end
 
@@ -492,6 +504,7 @@ module Aws
       class LegacyHandler < Seahorse::Client::Handler
 
         def call(context)
+          RetryErrors.track_response_time(context)
           response = with_metric { @handler.call(context) }
           if response.error
             error_inspector = Retries::ErrorInspector.new(
@@ -530,6 +543,7 @@ module Aws
           context.config.credentials.refresh! if refresh_credentials?(context, error)
           context.http_request.body.rewind
           context.http_response.reset
+          context.metadata.delete(:response_received_at)
           call(context)
         end
 

data/lib/aws-sdk-signin/client.rb

@@ -991,7 +991,7 @@ module Aws::Signin
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.263.0'
+      context[:gem_version] = '3.264.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-signin.rb

@@ -56,7 +56,7 @@ module Aws::Signin
   autoload :EndpointProvider, 'aws-sdk-signin/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-signin/endpoints'
 
-  GEM_VERSION = '3.263.0'
+  GEM_VERSION = '3.264.0'
 
 end
 

data/lib/aws-sdk-sso/client.rb

@@ -703,7 +703,7 @@ module Aws::SSO
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.263.0'
+      context[:gem_version] = '3.264.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sso.rb

@@ -56,7 +56,7 @@ module Aws::SSO
   autoload :EndpointProvider, 'aws-sdk-sso/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-sso/endpoints'
 
-  GEM_VERSION = '3.263.0'
+  GEM_VERSION = '3.264.0'
 
 end
 

data/lib/aws-sdk-ssooidc/client.rb

@@ -1086,7 +1086,7 @@ module Aws::SSOOIDC
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.263.0'
+      context[:gem_version] = '3.264.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-ssooidc.rb

@@ -56,7 +56,7 @@ module Aws::SSOOIDC
   autoload :EndpointProvider, 'aws-sdk-ssooidc/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-ssooidc/endpoints'
 
-  GEM_VERSION = '3.263.0'
+  GEM_VERSION = '3.264.0'
 
 end
 

data/lib/aws-sdk-sts/client.rb

@@ -2807,7 +2807,7 @@ module Aws::STS
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.263.0'
+      context[:gem_version] = '3.264.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sts.rb

@@ -56,7 +56,7 @@ module Aws::STS
   autoload :EndpointProvider, 'aws-sdk-sts/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-sts/endpoints'
 
-  GEM_VERSION = '3.263.0'
+  GEM_VERSION = '3.264.0'
 
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-core
 version: !ruby/object:Gem::Version
-  version: 3.263.0
+  version: 3.264.0
 platform: ruby
 authors:
 - Amazon Web Services