aws-sdk-core 3.31.0 → 3.168.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/CHANGELOG.md +1573 -0
- data/LICENSE.txt +202 -0
- data/VERSION +1 -1
- data/lib/aws-defaults/default_configuration.rb +153 -0
- data/lib/aws-defaults/defaults_mode_config_resolver.rb +107 -0
- data/lib/aws-defaults.rb +3 -0
- data/lib/aws-sdk-core/arn.rb +105 -0
- data/lib/aws-sdk-core/arn_parser.rb +40 -0
- data/lib/aws-sdk-core/assume_role_credentials.rb +23 -7
- data/lib/aws-sdk-core/assume_role_web_identity_credentials.rb +108 -0
- data/lib/aws-sdk-core/async_client_stubs.rb +82 -0
- data/lib/aws-sdk-core/binary/decode_handler.rb +11 -1
- data/lib/aws-sdk-core/binary/encode_handler.rb +45 -0
- data/lib/aws-sdk-core/binary/event_builder.rb +124 -0
- data/lib/aws-sdk-core/binary/event_parser.rb +50 -18
- data/lib/aws-sdk-core/binary/event_stream_decoder.rb +7 -2
- data/lib/aws-sdk-core/binary/event_stream_encoder.rb +55 -0
- data/lib/aws-sdk-core/binary.rb +5 -0
- data/lib/aws-sdk-core/client_side_monitoring/publisher.rb +11 -1
- data/lib/aws-sdk-core/client_side_monitoring/request_metrics.rb +71 -9
- data/lib/aws-sdk-core/client_stubs.rb +21 -14
- data/lib/aws-sdk-core/credential_provider.rb +1 -30
- data/lib/aws-sdk-core/credential_provider_chain.rb +107 -43
- data/lib/aws-sdk-core/credentials.rb +2 -0
- data/lib/aws-sdk-core/deprecations.rb +17 -11
- data/lib/aws-sdk-core/eager_loader.rb +2 -0
- data/lib/aws-sdk-core/ec2_metadata.rb +238 -0
- data/lib/aws-sdk-core/ecs_credentials.rb +24 -9
- data/lib/aws-sdk-core/endpoint_cache.rb +193 -0
- data/lib/aws-sdk-core/endpoints/condition.rb +36 -0
- data/lib/aws-sdk-core/endpoints/endpoint.rb +17 -0
- data/lib/aws-sdk-core/endpoints/endpoint_rule.rb +71 -0
- data/lib/aws-sdk-core/endpoints/error_rule.rb +37 -0
- data/lib/aws-sdk-core/endpoints/function.rb +75 -0
- data/lib/aws-sdk-core/endpoints/matchers.rb +127 -0
- data/lib/aws-sdk-core/endpoints/reference.rb +26 -0
- data/lib/aws-sdk-core/endpoints/rule.rb +20 -0
- data/lib/aws-sdk-core/endpoints/rule_set.rb +47 -0
- data/lib/aws-sdk-core/endpoints/rules_provider.rb +32 -0
- data/lib/aws-sdk-core/endpoints/templater.rb +52 -0
- data/lib/aws-sdk-core/endpoints/tree_rule.rb +40 -0
- data/lib/aws-sdk-core/endpoints/url.rb +59 -0
- data/lib/aws-sdk-core/endpoints.rb +74 -0
- data/lib/aws-sdk-core/errors.rb +172 -12
- data/lib/aws-sdk-core/event_emitter.rb +44 -0
- data/lib/aws-sdk-core/ini_parser.rb +2 -0
- data/lib/aws-sdk-core/instance_profile_credentials.rb +231 -42
- data/lib/aws-sdk-core/json/builder.rb +2 -0
- data/lib/aws-sdk-core/json/error_handler.rb +31 -3
- data/lib/aws-sdk-core/json/handler.rb +21 -1
- data/lib/aws-sdk-core/json/json_engine.rb +12 -8
- data/lib/aws-sdk-core/json/oj_engine.rb +35 -6
- data/lib/aws-sdk-core/json/parser.rb +10 -0
- data/lib/aws-sdk-core/json.rb +11 -28
- data/lib/aws-sdk-core/log/formatter.rb +16 -4
- data/lib/aws-sdk-core/log/handler.rb +2 -0
- data/lib/aws-sdk-core/log/param_filter.rb +38 -13
- data/lib/aws-sdk-core/log/param_formatter.rb +2 -0
- data/lib/aws-sdk-core/pageable_response.rb +118 -47
- data/lib/aws-sdk-core/pager.rb +5 -0
- data/lib/aws-sdk-core/param_converter.rb +2 -0
- data/lib/aws-sdk-core/param_validator.rb +63 -7
- data/lib/aws-sdk-core/plugins/api_key.rb +5 -1
- data/lib/aws-sdk-core/plugins/apig_authorizer_token.rb +2 -0
- data/lib/aws-sdk-core/plugins/apig_credentials_configuration.rb +2 -0
- data/lib/aws-sdk-core/plugins/apig_user_agent.rb +2 -0
- data/lib/aws-sdk-core/plugins/bearer_authorization.rb +67 -0
- data/lib/aws-sdk-core/plugins/checksum_algorithm.rb +340 -0
- data/lib/aws-sdk-core/plugins/client_metrics_plugin.rb +65 -6
- data/lib/aws-sdk-core/plugins/client_metrics_send_plugin.rb +10 -4
- data/lib/aws-sdk-core/plugins/credentials_configuration.rb +50 -7
- data/lib/aws-sdk-core/plugins/defaults_mode.rb +40 -0
- data/lib/aws-sdk-core/plugins/endpoint_discovery.rb +172 -0
- data/lib/aws-sdk-core/plugins/endpoint_pattern.rb +65 -0
- data/lib/aws-sdk-core/plugins/event_stream_configuration.rb +16 -0
- data/lib/aws-sdk-core/plugins/global_configuration.rb +2 -0
- data/lib/aws-sdk-core/plugins/helpful_socket_errors.rb +2 -0
- data/lib/aws-sdk-core/plugins/http_checksum.rb +64 -0
- data/lib/aws-sdk-core/plugins/idempotency_token.rb +2 -0
- data/lib/aws-sdk-core/plugins/invocation_id.rb +35 -0
- data/lib/aws-sdk-core/plugins/jsonvalue_converter.rb +36 -6
- data/lib/aws-sdk-core/plugins/logging.rb +2 -0
- data/lib/aws-sdk-core/plugins/param_converter.rb +2 -0
- data/lib/aws-sdk-core/plugins/param_validator.rb +2 -0
- data/lib/aws-sdk-core/plugins/protocols/api_gateway.rb +19 -0
- data/lib/aws-sdk-core/plugins/protocols/ec2.rb +2 -0
- data/lib/aws-sdk-core/plugins/protocols/json_rpc.rb +2 -0
- data/lib/aws-sdk-core/plugins/protocols/query.rb +2 -0
- data/lib/aws-sdk-core/plugins/protocols/rest_json.rb +18 -1
- data/lib/aws-sdk-core/plugins/protocols/rest_xml.rb +2 -0
- data/lib/aws-sdk-core/plugins/recursion_detection.rb +38 -0
- data/lib/aws-sdk-core/plugins/regional_endpoint.rb +81 -16
- data/lib/aws-sdk-core/plugins/response_paging.rb +3 -1
- data/lib/aws-sdk-core/plugins/retries/client_rate_limiter.rb +139 -0
- data/lib/aws-sdk-core/plugins/retries/clock_skew.rb +100 -0
- data/lib/aws-sdk-core/plugins/retries/error_inspector.rb +147 -0
- data/lib/aws-sdk-core/plugins/retries/retry_quota.rb +59 -0
- data/lib/aws-sdk-core/plugins/retry_errors.rb +312 -92
- data/lib/aws-sdk-core/plugins/sign.rb +200 -0
- data/lib/aws-sdk-core/plugins/signature_v2.rb +3 -0
- data/lib/aws-sdk-core/plugins/signature_v4.rb +42 -32
- data/lib/aws-sdk-core/plugins/stub_responses.rb +28 -7
- data/lib/aws-sdk-core/plugins/transfer_encoding.rb +53 -0
- data/lib/aws-sdk-core/plugins/user_agent.rb +9 -5
- data/lib/aws-sdk-core/process_credentials.rb +20 -15
- data/lib/aws-sdk-core/query/ec2_param_builder.rb +2 -0
- data/lib/aws-sdk-core/query/handler.rb +8 -1
- data/lib/aws-sdk-core/query/param.rb +2 -0
- data/lib/aws-sdk-core/query/param_builder.rb +2 -0
- data/lib/aws-sdk-core/query/param_list.rb +2 -0
- data/lib/aws-sdk-core/query.rb +2 -0
- data/lib/aws-sdk-core/refreshing_credentials.rb +45 -12
- data/lib/aws-sdk-core/refreshing_token.rb +71 -0
- data/lib/aws-sdk-core/resources/collection.rb +3 -1
- data/lib/aws-sdk-core/rest/handler.rb +3 -1
- data/lib/aws-sdk-core/rest/request/body.rb +21 -1
- data/lib/aws-sdk-core/rest/request/builder.rb +2 -0
- data/lib/aws-sdk-core/rest/request/endpoint.rb +10 -3
- data/lib/aws-sdk-core/rest/request/headers.rb +16 -6
- data/lib/aws-sdk-core/rest/request/querystring_builder.rb +4 -2
- data/lib/aws-sdk-core/rest/response/body.rb +2 -0
- data/lib/aws-sdk-core/rest/response/headers.rb +6 -3
- data/lib/aws-sdk-core/rest/response/parser.rb +2 -0
- data/lib/aws-sdk-core/rest/response/status_code.rb +2 -0
- data/lib/aws-sdk-core/rest.rb +2 -0
- data/lib/aws-sdk-core/shared_config.rb +222 -118
- data/lib/aws-sdk-core/shared_credentials.rb +9 -1
- data/lib/aws-sdk-core/sso_credentials.rb +172 -0
- data/lib/aws-sdk-core/sso_token_provider.rb +135 -0
- data/lib/aws-sdk-core/static_token_provider.rb +14 -0
- data/lib/aws-sdk-core/structure.rb +24 -7
- data/lib/aws-sdk-core/stubbing/data_applicator.rb +2 -0
- data/lib/aws-sdk-core/stubbing/empty_stub.rb +2 -0
- data/lib/aws-sdk-core/stubbing/protocols/api_gateway.rb +2 -0
- data/lib/aws-sdk-core/stubbing/protocols/ec2.rb +2 -0
- data/lib/aws-sdk-core/stubbing/protocols/json.rb +3 -1
- data/lib/aws-sdk-core/stubbing/protocols/query.rb +4 -2
- data/lib/aws-sdk-core/stubbing/protocols/rest.rb +52 -7
- data/lib/aws-sdk-core/stubbing/protocols/rest_json.rb +3 -1
- data/lib/aws-sdk-core/stubbing/protocols/rest_xml.rb +2 -2
- data/lib/aws-sdk-core/stubbing/stub_data.rb +15 -4
- data/lib/aws-sdk-core/stubbing/xml_error.rb +2 -0
- data/lib/aws-sdk-core/token.rb +31 -0
- data/lib/aws-sdk-core/token_provider.rb +15 -0
- data/lib/aws-sdk-core/token_provider_chain.rb +51 -0
- data/lib/aws-sdk-core/type_builder.rb +2 -0
- data/lib/aws-sdk-core/util.rb +24 -0
- data/lib/aws-sdk-core/waiters/errors.rb +2 -0
- data/lib/aws-sdk-core/waiters/poller.rb +2 -0
- data/lib/aws-sdk-core/waiters/waiter.rb +4 -2
- data/lib/aws-sdk-core/waiters.rb +2 -0
- data/lib/aws-sdk-core/xml/builder.rb +5 -3
- data/lib/aws-sdk-core/xml/default_list.rb +2 -0
- data/lib/aws-sdk-core/xml/default_map.rb +2 -0
- data/lib/aws-sdk-core/xml/doc_builder.rb +15 -4
- data/lib/aws-sdk-core/xml/error_handler.rb +36 -4
- data/lib/aws-sdk-core/xml/parser/engines/libxml.rb +2 -0
- data/lib/aws-sdk-core/xml/parser/engines/nokogiri.rb +2 -0
- data/lib/aws-sdk-core/xml/parser/engines/oga.rb +2 -0
- data/lib/aws-sdk-core/xml/parser/engines/ox.rb +3 -1
- data/lib/aws-sdk-core/xml/parser/engines/rexml.rb +4 -1
- data/lib/aws-sdk-core/xml/parser/frame.rb +25 -0
- data/lib/aws-sdk-core/xml/parser/parsing_error.rb +2 -0
- data/lib/aws-sdk-core/xml/parser/stack.rb +2 -0
- data/lib/aws-sdk-core/xml/parser.rb +7 -0
- data/lib/aws-sdk-core/xml.rb +2 -0
- data/lib/aws-sdk-core.rb +42 -4
- data/lib/aws-sdk-sso/client.rb +610 -0
- data/lib/aws-sdk-sso/client_api.rb +190 -0
- data/lib/aws-sdk-sso/customizations.rb +1 -0
- data/lib/aws-sdk-sso/endpoint_parameters.rb +66 -0
- data/lib/aws-sdk-sso/endpoint_provider.rb +112 -0
- data/lib/aws-sdk-sso/endpoints.rb +71 -0
- data/lib/aws-sdk-sso/errors.rb +102 -0
- data/lib/aws-sdk-sso/plugins/endpoints.rb +76 -0
- data/lib/aws-sdk-sso/resource.rb +26 -0
- data/lib/aws-sdk-sso/types.rb +317 -0
- data/lib/aws-sdk-sso.rb +59 -0
- data/lib/aws-sdk-ssooidc/client.rb +606 -0
- data/lib/aws-sdk-ssooidc/client_api.rb +216 -0
- data/lib/aws-sdk-ssooidc/customizations.rb +1 -0
- data/lib/aws-sdk-ssooidc/endpoint_parameters.rb +66 -0
- data/lib/aws-sdk-ssooidc/endpoint_provider.rb +111 -0
- data/lib/aws-sdk-ssooidc/endpoints.rb +57 -0
- data/lib/aws-sdk-ssooidc/errors.rb +290 -0
- data/lib/aws-sdk-ssooidc/plugins/endpoints.rb +74 -0
- data/lib/aws-sdk-ssooidc/resource.rb +26 -0
- data/lib/aws-sdk-ssooidc/types.rb +502 -0
- data/lib/aws-sdk-ssooidc.rb +59 -0
- data/lib/aws-sdk-sts/client.rb +1426 -616
- data/lib/aws-sdk-sts/client_api.rb +76 -1
- data/lib/aws-sdk-sts/customizations.rb +4 -0
- data/lib/aws-sdk-sts/endpoint_parameters.rb +78 -0
- data/lib/aws-sdk-sts/endpoint_provider.rb +229 -0
- data/lib/aws-sdk-sts/endpoints.rb +135 -0
- data/lib/aws-sdk-sts/errors.rb +153 -1
- data/lib/aws-sdk-sts/plugins/endpoints.rb +84 -0
- data/lib/aws-sdk-sts/plugins/sts_regional_endpoints.rb +38 -0
- data/lib/aws-sdk-sts/presigner.rb +73 -0
- data/lib/aws-sdk-sts/resource.rb +4 -1
- data/lib/aws-sdk-sts/types.rb +918 -296
- data/lib/aws-sdk-sts.rb +20 -6
- data/lib/seahorse/client/async_base.rb +51 -0
- data/lib/seahorse/client/async_response.rb +64 -0
- data/lib/seahorse/client/base.rb +7 -2
- data/lib/seahorse/client/block_io.rb +6 -2
- data/lib/seahorse/client/configuration.rb +17 -3
- data/lib/seahorse/client/events.rb +3 -1
- data/lib/seahorse/client/h2/connection.rb +247 -0
- data/lib/seahorse/client/h2/handler.rb +152 -0
- data/lib/seahorse/client/handler.rb +2 -0
- data/lib/seahorse/client/handler_builder.rb +2 -0
- data/lib/seahorse/client/handler_list.rb +2 -0
- data/lib/seahorse/client/handler_list_entry.rb +6 -4
- data/lib/seahorse/client/http/async_response.rb +44 -0
- data/lib/seahorse/client/http/headers.rb +2 -0
- data/lib/seahorse/client/http/request.rb +5 -3
- data/lib/seahorse/client/http/response.rb +18 -11
- data/lib/seahorse/client/logging/formatter.rb +6 -2
- data/lib/seahorse/client/logging/handler.rb +2 -0
- data/lib/seahorse/client/managed_file.rb +2 -0
- data/lib/seahorse/client/net_http/connection_pool.rb +30 -23
- data/lib/seahorse/client/net_http/handler.rb +24 -7
- data/lib/seahorse/client/net_http/patches.rb +16 -79
- data/lib/seahorse/client/networking_error.rb +30 -0
- data/lib/seahorse/client/plugin.rb +10 -7
- data/lib/seahorse/client/plugin_list.rb +2 -0
- data/lib/seahorse/client/plugins/content_length.rb +14 -3
- data/lib/seahorse/client/plugins/endpoint.rb +4 -2
- data/lib/seahorse/client/plugins/h2.rb +69 -0
- data/lib/seahorse/client/plugins/logging.rb +2 -0
- data/lib/seahorse/client/plugins/net_http.rb +39 -3
- data/lib/seahorse/client/plugins/operation_methods.rb +2 -0
- data/lib/seahorse/client/plugins/raise_response_errors.rb +2 -0
- data/lib/seahorse/client/plugins/request_callback.rb +110 -0
- data/lib/seahorse/client/plugins/response_target.rb +23 -14
- data/lib/seahorse/client/request.rb +2 -0
- data/lib/seahorse/client/request_context.rb +2 -0
- data/lib/seahorse/client/response.rb +5 -5
- data/lib/seahorse/model/api.rb +14 -0
- data/lib/seahorse/model/authorizer.rb +2 -0
- data/lib/seahorse/model/operation.rb +21 -0
- data/lib/seahorse/model/shapes.rb +29 -2
- data/lib/seahorse/util.rb +12 -1
- data/lib/seahorse/version.rb +2 -0
- data/lib/seahorse.rb +12 -0
- metadata +117 -16
@@ -0,0 +1,200 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
require 'aws-sigv4'
|
4
|
+
|
5
|
+
module Aws
|
6
|
+
module Plugins
|
7
|
+
# @api private
|
8
|
+
class Sign < Seahorse::Client::Plugin
|
9
|
+
# These once had defaults. But now they are used as overrides to
|
10
|
+
# new endpoint and auth resolution.
|
11
|
+
option(:sigv4_signer)
|
12
|
+
option(:sigv4_name)
|
13
|
+
option(:sigv4_region)
|
14
|
+
option(:unsigned_operations, default: [])
|
15
|
+
|
16
|
+
supported_auth_types = %w[sigv4 bearer none]
|
17
|
+
supported_auth_types += ['sigv4a'] if Aws::Sigv4::Signer.use_crt?
|
18
|
+
SUPPORTED_AUTH_TYPES = supported_auth_types.freeze
|
19
|
+
|
20
|
+
def add_handlers(handlers, cfg)
|
21
|
+
operations = cfg.api.operation_names - cfg.unsigned_operations
|
22
|
+
handlers.add(Handler, step: :sign, operations: operations)
|
23
|
+
end
|
24
|
+
|
25
|
+
# @api private
|
26
|
+
# Return a signer with the `sign(context)` method
|
27
|
+
def self.signer_for(auth_scheme, config, region_override = nil)
|
28
|
+
case auth_scheme['name']
|
29
|
+
when 'sigv4', 'sigv4a'
|
30
|
+
SignatureV4.new(auth_scheme, config, region_override)
|
31
|
+
when 'bearer'
|
32
|
+
Bearer.new
|
33
|
+
else
|
34
|
+
NullSigner.new
|
35
|
+
end
|
36
|
+
end
|
37
|
+
|
38
|
+
class Handler < Seahorse::Client::Handler
|
39
|
+
def call(context)
|
40
|
+
# Skip signing if using sigv2 signing from s3_signer in S3
|
41
|
+
unless v2_signing?(context.config)
|
42
|
+
signer = Sign.signer_for(
|
43
|
+
context[:auth_scheme],
|
44
|
+
context.config,
|
45
|
+
context[:sigv4_region]
|
46
|
+
)
|
47
|
+
signer.sign(context)
|
48
|
+
end
|
49
|
+
@handler.call(context)
|
50
|
+
end
|
51
|
+
|
52
|
+
private
|
53
|
+
|
54
|
+
def v2_signing?(config)
|
55
|
+
# 's3' is legacy signing, 'v4' is default
|
56
|
+
config.respond_to?(:signature_version) &&
|
57
|
+
config.signature_version == 's3'
|
58
|
+
end
|
59
|
+
end
|
60
|
+
|
61
|
+
# @api private
|
62
|
+
class Bearer
|
63
|
+
def initialize
|
64
|
+
end
|
65
|
+
|
66
|
+
def sign(context)
|
67
|
+
if context.http_request.endpoint.scheme != 'https'
|
68
|
+
raise ArgumentError,
|
69
|
+
'Unable to use bearer authorization on non https endpoint.'
|
70
|
+
end
|
71
|
+
|
72
|
+
token_provider = context.config.token_provider
|
73
|
+
|
74
|
+
raise Errors::MissingBearerTokenError unless token_provider&.set?
|
75
|
+
|
76
|
+
context.http_request.headers['Authorization'] =
|
77
|
+
"Bearer #{token_provider.token.token}"
|
78
|
+
end
|
79
|
+
|
80
|
+
def presign_url(*args)
|
81
|
+
raise ArgumentError, 'Bearer auth does not support presigned urls'
|
82
|
+
end
|
83
|
+
|
84
|
+
def sign_event(*args)
|
85
|
+
raise ArgumentError, 'Bearer auth does not support event signing'
|
86
|
+
end
|
87
|
+
end
|
88
|
+
|
89
|
+
# @api private
|
90
|
+
class SignatureV4
|
91
|
+
def initialize(auth_scheme, config, region_override = nil)
|
92
|
+
scheme_name = auth_scheme['name']
|
93
|
+
|
94
|
+
unless %w[sigv4 sigv4a].include?(scheme_name)
|
95
|
+
raise ArgumentError,
|
96
|
+
"Expected sigv4 or sigv4a auth scheme, got #{scheme_name}"
|
97
|
+
end
|
98
|
+
|
99
|
+
region = if scheme_name == 'sigv4a'
|
100
|
+
auth_scheme['signingRegionSet'].first
|
101
|
+
else
|
102
|
+
auth_scheme['signingRegion']
|
103
|
+
end
|
104
|
+
begin
|
105
|
+
@signer = Aws::Sigv4::Signer.new(
|
106
|
+
service: config.sigv4_name || auth_scheme['signingName'],
|
107
|
+
region: region_override || config.sigv4_region || region,
|
108
|
+
credentials_provider: config.credentials,
|
109
|
+
signing_algorithm: scheme_name.to_sym,
|
110
|
+
uri_escape_path: !!!auth_scheme['disableDoubleEncoding'],
|
111
|
+
unsigned_headers: %w[content-length user-agent x-amzn-trace-id]
|
112
|
+
)
|
113
|
+
rescue Aws::Sigv4::Errors::MissingCredentialsError
|
114
|
+
raise Aws::Errors::MissingCredentialsError
|
115
|
+
end
|
116
|
+
end
|
117
|
+
|
118
|
+
def sign(context)
|
119
|
+
req = context.http_request
|
120
|
+
|
121
|
+
apply_authtype(context, req)
|
122
|
+
reset_signature(req)
|
123
|
+
apply_clock_skew(context, req)
|
124
|
+
|
125
|
+
# compute the signature
|
126
|
+
begin
|
127
|
+
signature = @signer.sign_request(
|
128
|
+
http_method: req.http_method,
|
129
|
+
url: req.endpoint,
|
130
|
+
headers: req.headers,
|
131
|
+
body: req.body
|
132
|
+
)
|
133
|
+
rescue Aws::Sigv4::Errors::MissingCredentialsError
|
134
|
+
# Necessary for when credentials is explicitly set to nil
|
135
|
+
raise Aws::Errors::MissingCredentialsError
|
136
|
+
end
|
137
|
+
# apply signature headers
|
138
|
+
req.headers.update(signature.headers)
|
139
|
+
|
140
|
+
# add request metadata with signature components for debugging
|
141
|
+
context[:canonical_request] = signature.canonical_request
|
142
|
+
context[:string_to_sign] = signature.string_to_sign
|
143
|
+
end
|
144
|
+
|
145
|
+
def presign_url(*args)
|
146
|
+
@signer.presign_url(*args)
|
147
|
+
end
|
148
|
+
|
149
|
+
def sign_event(*args)
|
150
|
+
@signer.sign_event(*args)
|
151
|
+
end
|
152
|
+
|
153
|
+
private
|
154
|
+
|
155
|
+
def apply_authtype(context, req)
|
156
|
+
if context.operation['authtype'].eql?('v4-unsigned-body') &&
|
157
|
+
req.endpoint.scheme.eql?('https')
|
158
|
+
req.headers['X-Amz-Content-Sha256'] ||= 'UNSIGNED-PAYLOAD'
|
159
|
+
end
|
160
|
+
end
|
161
|
+
|
162
|
+
def reset_signature(req)
|
163
|
+
# in case this request is being re-signed
|
164
|
+
req.headers.delete('Authorization')
|
165
|
+
req.headers.delete('X-Amz-Security-Token')
|
166
|
+
req.headers.delete('X-Amz-Date')
|
167
|
+
req.headers.delete('x-Amz-Region-Set')
|
168
|
+
end
|
169
|
+
|
170
|
+
def apply_clock_skew(context, req)
|
171
|
+
if context.config.respond_to?(:clock_skew) &&
|
172
|
+
context.config.clock_skew &&
|
173
|
+
context.config.correct_clock_skew
|
174
|
+
|
175
|
+
endpoint = context.http_request.endpoint
|
176
|
+
skew = context.config.clock_skew.clock_correction(endpoint)
|
177
|
+
if skew.abs.positive?
|
178
|
+
req.headers['X-Amz-Date'] =
|
179
|
+
(Time.now.utc + skew).strftime('%Y%m%dT%H%M%SZ')
|
180
|
+
end
|
181
|
+
end
|
182
|
+
end
|
183
|
+
|
184
|
+
end
|
185
|
+
|
186
|
+
# @api private
|
187
|
+
class NullSigner
|
188
|
+
|
189
|
+
def sign(context)
|
190
|
+
end
|
191
|
+
|
192
|
+
def presign_url(*args)
|
193
|
+
end
|
194
|
+
|
195
|
+
def sign_event(*args)
|
196
|
+
end
|
197
|
+
end
|
198
|
+
end
|
199
|
+
end
|
200
|
+
end
|
@@ -1,52 +1,50 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require 'aws-sigv4'
|
2
4
|
|
3
5
|
module Aws
|
4
6
|
module Plugins
|
5
7
|
# @api private
|
8
|
+
# Necessary to exist after endpoints 2.0
|
6
9
|
class SignatureV4 < Seahorse::Client::Plugin
|
7
10
|
|
11
|
+
V4_AUTH = %w[v4 v4-unsigned-payload v4-unsigned-body]
|
12
|
+
|
8
13
|
option(:sigv4_signer) do |cfg|
|
9
14
|
SignatureV4.build_signer(cfg)
|
10
15
|
end
|
11
16
|
|
12
17
|
option(:sigv4_name) do |cfg|
|
13
|
-
|
18
|
+
signingName = if cfg.region
|
19
|
+
Aws::Partitions::EndpointProvider.signing_service(
|
20
|
+
cfg.region, cfg.api.metadata['endpointPrefix']
|
21
|
+
)
|
22
|
+
end
|
23
|
+
signingName || cfg.api.metadata['signingName'] || cfg.api.metadata['endpointPrefix']
|
14
24
|
end
|
15
25
|
|
16
26
|
option(:sigv4_region) do |cfg|
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
# client for a region like "us-west-2", we will
|
25
|
-
# always use "route53.amazonaws.com". This endpoint
|
26
|
-
# is actually global to the entire partition,
|
27
|
-
# and must be signed as "us-east-1".
|
28
|
-
#
|
29
|
-
# * When the region is configured, but it is configured
|
30
|
-
# to a non region, such as "aws-global". This is similar
|
31
|
-
# to the previous case. We use the Aws::Partitions::EndpointProvider
|
32
|
-
# to resolve to the actual signing region.
|
33
|
-
#
|
34
|
-
prefix = cfg.api.metadata['endpointPrefix']
|
35
|
-
if prefix && cfg.endpoint.to_s.match(/#{prefix}\.amazonaws\.com/)
|
36
|
-
'us-east-1'
|
37
|
-
elsif cfg.region
|
38
|
-
Aws::Partitions::EndpointProvider.signing_region(cfg.region, cfg.sigv4_name)
|
27
|
+
if cfg.region
|
28
|
+
if cfg.respond_to?(:sts_regional_endpoints)
|
29
|
+
sts_regional = cfg.sts_regional_endpoints
|
30
|
+
end
|
31
|
+
Aws::Partitions::EndpointProvider.signing_region(
|
32
|
+
cfg.region, cfg.api.metadata['endpointPrefix'], sts_regional
|
33
|
+
)
|
39
34
|
end
|
40
35
|
end
|
41
36
|
|
42
37
|
option(:unsigned_operations) do |cfg|
|
43
|
-
cfg.api.
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
38
|
+
if cfg.api.metadata['signatureVersion'] == 'v4'
|
39
|
+
# select operations where authtype is set and is not v4
|
40
|
+
cfg.api.operation_names.select do |o|
|
41
|
+
cfg.api.operation(o)['authtype'] && !V4_AUTH.include?(cfg.api.operation(o)['authtype'])
|
42
|
+
end
|
43
|
+
else # service is not v4 auth
|
44
|
+
# select all operations where authtype is not v4
|
45
|
+
# (includes operations with no explicit authtype)
|
46
|
+
cfg.api.operation_names.select do |o|
|
47
|
+
!V4_AUTH.include?(cfg.api.operation(o)['authtype'])
|
50
48
|
end
|
51
49
|
end
|
52
50
|
end
|
@@ -106,6 +104,18 @@ module Aws
|
|
106
104
|
req.headers.delete('Authorization')
|
107
105
|
req.headers.delete('X-Amz-Security-Token')
|
108
106
|
req.headers.delete('X-Amz-Date')
|
107
|
+
req.headers.delete('x-Amz-Region-Set')
|
108
|
+
|
109
|
+
if context.config.respond_to?(:clock_skew) &&
|
110
|
+
context.config.clock_skew &&
|
111
|
+
context.config.correct_clock_skew
|
112
|
+
|
113
|
+
endpoint = context.http_request.endpoint
|
114
|
+
skew = context.config.clock_skew.clock_correction(endpoint)
|
115
|
+
if skew.abs > 0
|
116
|
+
req.headers['X-Amz-Date'] = (Time.now.utc + skew).strftime("%Y%m%dT%H%M%SZ")
|
117
|
+
end
|
118
|
+
end
|
109
119
|
|
110
120
|
# compute the signature
|
111
121
|
begin
|
@@ -130,8 +140,8 @@ module Aws
|
|
130
140
|
# @api private
|
131
141
|
def apply_authtype(context)
|
132
142
|
if context.operation['authtype'].eql?('v4-unsigned-body') &&
|
133
|
-
|
134
|
-
context.http_request.headers['X-Amz-Content-Sha256']
|
143
|
+
context.http_request.endpoint.scheme.eql?('https')
|
144
|
+
context.http_request.headers['X-Amz-Content-Sha256'] ||= 'UNSIGNED-PAYLOAD'
|
135
145
|
end
|
136
146
|
context
|
137
147
|
end
|
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module Aws
|
2
4
|
module Plugins
|
3
5
|
# @api private
|
@@ -34,9 +36,12 @@ requests are made, and retries are disabled.
|
|
34
36
|
if client.config.stub_responses
|
35
37
|
client.setup_stubbing
|
36
38
|
client.handlers.remove(RetryErrors::Handler)
|
39
|
+
client.handlers.remove(RetryErrors::LegacyHandler)
|
37
40
|
client.handlers.remove(ClientMetricsPlugin::Handler)
|
38
41
|
client.handlers.remove(ClientMetricsSendPlugin::LatencyHandler)
|
39
42
|
client.handlers.remove(ClientMetricsSendPlugin::AttemptHandler)
|
43
|
+
client.handlers.remove(Seahorse::Client::Plugins::RequestCallback::OptionHandler)
|
44
|
+
client.handlers.remove(Seahorse::Client::Plugins::RequestCallback::ReadCallbackHandler)
|
40
45
|
end
|
41
46
|
end
|
42
47
|
|
@@ -45,15 +50,22 @@ requests are made, and retries are disabled.
|
|
45
50
|
def call(context)
|
46
51
|
stub = context.client.next_stub(context)
|
47
52
|
resp = Seahorse::Client::Response.new(context: context)
|
48
|
-
|
49
|
-
|
53
|
+
async_mode = context.client.is_a? Seahorse::Client::AsyncBase
|
54
|
+
if Hash === stub && stub[:mutex]
|
55
|
+
stub[:mutex].synchronize { apply_stub(stub, resp, async_mode) }
|
56
|
+
else
|
57
|
+
apply_stub(stub, resp, async_mode)
|
58
|
+
end
|
59
|
+
|
60
|
+
async_mode ? Seahorse::Client::AsyncResponse.new(
|
61
|
+
context: context, stream: context[:input_event_stream_handler].event_emitter.stream, sync_queue: Queue.new) : resp
|
50
62
|
end
|
51
63
|
|
52
|
-
def apply_stub(stub, response)
|
64
|
+
def apply_stub(stub, response, async_mode = false)
|
53
65
|
http_resp = response.context.http_response
|
54
66
|
case
|
55
67
|
when stub[:error] then signal_error(stub[:error], http_resp)
|
56
|
-
when stub[:http] then signal_http(stub[:http], http_resp)
|
68
|
+
when stub[:http] then signal_http(stub[:http], http_resp, async_mode)
|
57
69
|
when stub[:data] then response.data = stub[:data]
|
58
70
|
end
|
59
71
|
end
|
@@ -67,9 +79,18 @@ requests are made, and retries are disabled.
|
|
67
79
|
end
|
68
80
|
|
69
81
|
# @param [Seahorse::Client::Http::Response] stub
|
70
|
-
# @param [Seahorse::Client::Http::Response] http_resp
|
71
|
-
|
72
|
-
|
82
|
+
# @param [Seahorse::Client::Http::Response | Seahorse::Client::Http::AsyncResponse] http_resp
|
83
|
+
# @param [Boolean] async_mode
|
84
|
+
def signal_http(stub, http_resp, async_mode = false)
|
85
|
+
if async_mode
|
86
|
+
h2_headers = stub.headers.to_h.inject([]) do |arr, (k, v)|
|
87
|
+
arr << [k, v]
|
88
|
+
end
|
89
|
+
h2_headers << [":status", stub.status_code]
|
90
|
+
http_resp.signal_headers(h2_headers)
|
91
|
+
else
|
92
|
+
http_resp.signal_headers(stub.status_code, stub.headers.to_h)
|
93
|
+
end
|
73
94
|
while chunk = stub.body.read(1024 * 1024)
|
74
95
|
http_resp.signal_data(chunk)
|
75
96
|
end
|
@@ -0,0 +1,53 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Aws
|
4
|
+
module Plugins
|
5
|
+
|
6
|
+
# For Streaming Input Operations, when `requiresLength` is enabled
|
7
|
+
# checking whether `Content-Length` header can be set,
|
8
|
+
# for `v4-unsigned-body` operations, set `Transfer-Encoding` header
|
9
|
+
class TransferEncoding < Seahorse::Client::Plugin
|
10
|
+
|
11
|
+
# @api private
|
12
|
+
class Handler < Seahorse::Client::Handler
|
13
|
+
def call(context)
|
14
|
+
if streaming?(context.operation.input)
|
15
|
+
# If it's an IO object and not a File / String / String IO
|
16
|
+
unless context.http_request.body.respond_to?(:size)
|
17
|
+
if requires_length?(context.operation.input)
|
18
|
+
# if size of the IO is not available but required
|
19
|
+
raise Aws::Errors::MissingContentLength.new
|
20
|
+
elsif context.operation['authtype'] == "v4-unsigned-body"
|
21
|
+
context.http_request.headers['Transfer-Encoding'] = 'chunked'
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
25
|
+
|
26
|
+
@handler.call(context)
|
27
|
+
end
|
28
|
+
|
29
|
+
private
|
30
|
+
|
31
|
+
def streaming?(ref)
|
32
|
+
if payload = ref[:payload_member]
|
33
|
+
payload["streaming"] || # checking ref and shape
|
34
|
+
payload.shape["streaming"]
|
35
|
+
else
|
36
|
+
false
|
37
|
+
end
|
38
|
+
end
|
39
|
+
|
40
|
+
def requires_length?(ref)
|
41
|
+
payload = ref[:payload_member]
|
42
|
+
payload["requiresLength"] || # checking ref and shape
|
43
|
+
payload.shape["requiresLength"]
|
44
|
+
end
|
45
|
+
|
46
|
+
end
|
47
|
+
|
48
|
+
handler(Handler, step: :sign)
|
49
|
+
|
50
|
+
end
|
51
|
+
|
52
|
+
end
|
53
|
+
end
|
@@ -1,13 +1,13 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module Aws
|
2
4
|
module Plugins
|
3
5
|
# @api private
|
4
6
|
class UserAgent < Seahorse::Client::Plugin
|
5
|
-
|
6
7
|
option(:user_agent_suffix)
|
7
8
|
|
8
9
|
# @api private
|
9
10
|
class Handler < Seahorse::Client::Handler
|
10
|
-
|
11
11
|
def call(context)
|
12
12
|
set_user_agent(context)
|
13
13
|
@handler.call(context)
|
@@ -28,15 +28,19 @@ module Aws
|
|
28
28
|
ua += " #{context[:gem_name]}/#{context[:gem_version]}"
|
29
29
|
end
|
30
30
|
|
31
|
-
|
31
|
+
if (execution_env = ENV['AWS_EXECUTION_ENV'])
|
32
|
+
ua += " exec-env/#{execution_env}"
|
33
|
+
end
|
34
|
+
|
35
|
+
if context.config.user_agent_suffix
|
36
|
+
ua += " #{context.config.user_agent_suffix}"
|
37
|
+
end
|
32
38
|
|
33
39
|
context.http_request.headers['User-Agent'] = ua.strip
|
34
40
|
end
|
35
|
-
|
36
41
|
end
|
37
42
|
|
38
43
|
handler(Handler)
|
39
|
-
|
40
44
|
end
|
41
45
|
end
|
42
46
|
end
|
@@ -1,19 +1,16 @@
|
|
1
|
-
|
1
|
+
# frozen_string_literal: true
|
2
2
|
|
3
3
|
module Aws
|
4
|
-
|
5
4
|
# A credential provider that executes a given process and attempts
|
6
|
-
# to read its stdout to recieve a JSON payload containing the credentials
|
7
|
-
#
|
8
|
-
# Automatically handles refreshing credentials if an Expiration time is
|
9
|
-
# provided in the credentials payload
|
10
|
-
#
|
11
|
-
# credentials = Aws::ProcessCredentials.new('/usr/bin/credential_proc').credentials
|
5
|
+
# to read its stdout to recieve a JSON payload containing the credentials.
|
12
6
|
#
|
7
|
+
# credentials = Aws::ProcessCredentials.new('/usr/bin/credential_proc')
|
13
8
|
# ec2 = Aws::EC2::Client.new(credentials: credentials)
|
14
9
|
#
|
15
|
-
#
|
16
|
-
#
|
10
|
+
# Automatically handles refreshing credentials if an Expiration time is
|
11
|
+
# provided in the credentials payload.
|
12
|
+
#
|
13
|
+
# @see https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#sourcing-credentials-from-external-processes
|
17
14
|
class ProcessCredentials
|
18
15
|
|
19
16
|
include CredentialProvider
|
@@ -23,22 +20,30 @@ module Aws
|
|
23
20
|
# external process to be used as a credential provider.
|
24
21
|
#
|
25
22
|
# @param [String] process Invocation string for process
|
26
|
-
# credentials provider.
|
23
|
+
# credentials provider.
|
27
24
|
def initialize(process)
|
28
25
|
@process = process
|
29
26
|
@credentials = credentials_from_process(@process)
|
27
|
+
@async_refresh = false
|
28
|
+
|
29
|
+
super
|
30
30
|
end
|
31
31
|
|
32
32
|
private
|
33
33
|
def credentials_from_process(proc_invocation)
|
34
34
|
begin
|
35
|
-
raw_out
|
35
|
+
raw_out = `#{proc_invocation}`
|
36
|
+
process_status = $?
|
36
37
|
rescue Errno::ENOENT
|
37
38
|
raise Errors::InvalidProcessCredentialsPayload.new("Could not find process #{proc_invocation}")
|
38
39
|
end
|
39
40
|
|
40
41
|
if process_status.success?
|
41
|
-
|
42
|
+
begin
|
43
|
+
creds_json = Aws::Json.load(raw_out)
|
44
|
+
rescue Aws::Json::ParseError
|
45
|
+
raise Errors::InvalidProcessCredentialsPayload.new("Invalid JSON response")
|
46
|
+
end
|
42
47
|
payload_version = creds_json['Version']
|
43
48
|
if payload_version == 1
|
44
49
|
_parse_payload_format_v1(creds_json)
|
@@ -66,9 +71,9 @@ module Aws
|
|
66
71
|
@credentials = credentials_from_process(@process)
|
67
72
|
end
|
68
73
|
|
69
|
-
def near_expiration?
|
74
|
+
def near_expiration?(expiration_length)
|
70
75
|
# are we within 5 minutes of expiration?
|
71
|
-
@expiration && (Time.now.to_i +
|
76
|
+
@expiration && (Time.now.to_i + expiration_length) > @expiration.to_i
|
72
77
|
end
|
73
78
|
end
|
74
79
|
end
|
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module Aws
|
2
4
|
# @api private
|
3
5
|
module Query
|
@@ -27,7 +29,12 @@ module Aws
|
|
27
29
|
build_request(context)
|
28
30
|
@handler.call(context).on_success do |response|
|
29
31
|
response.error = nil
|
30
|
-
|
32
|
+
parsed = parse_xml(context)
|
33
|
+
if parsed.nil? || parsed == EmptyStructure
|
34
|
+
response.data = EmptyStructure.new
|
35
|
+
else
|
36
|
+
response.data = parsed
|
37
|
+
end
|
31
38
|
end
|
32
39
|
end
|
33
40
|
|