@aws-sdk/credential-provider-ini 3.650.0 → 3.651.1

package/dist-cjs/index.js

@@ -123,42 +123,41 @@ var resolveAssumeRoleCredentials = /* @__PURE__ */ __name(async (profileName, pr
   );
   const sourceCredsProvider = source_profile ? resolveProfileData(
     source_profile,
-    {
-      ...profiles,
-      [source_profile]: {
-        ...profiles[source_profile],
-        // This assigns the role_arn of the "root" profile
-        // to the credential_source profile so this recursive call knows
-        // what role to assume.
-        role_arn: data.role_arn ?? profiles[source_profile].role_arn
-      }
-    },
+    profiles,
     options,
     {
       ...visitedProfiles,
       [source_profile]: true
-    }
+    },
+    isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {})
   ) : (await resolveCredentialSource(data.credential_source, profileName, options.logger)(options))();
-  const params = {
-    RoleArn: data.role_arn,
-    RoleSessionName: data.role_session_name || `aws-sdk-js-${Date.now()}`,
-    ExternalId: data.external_id,
-    DurationSeconds: parseInt(data.duration_seconds || "3600", 10)
-  };
-  const { mfa_serial } = data;
-  if (mfa_serial) {
-    if (!options.mfaCodeProvider) {
-      throw new import_property_provider.CredentialsProviderError(
-        `Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`,
-        { logger: options.logger, tryNextLink: false }
-      );
+  if (isCredentialSourceWithoutRoleArn(data)) {
+    return sourceCredsProvider;
+  } else {
+    const params = {
+      RoleArn: data.role_arn,
+      RoleSessionName: data.role_session_name || `aws-sdk-js-${Date.now()}`,
+      ExternalId: data.external_id,
+      DurationSeconds: parseInt(data.duration_seconds || "3600", 10)
+    };
+    const { mfa_serial } = data;
+    if (mfa_serial) {
+      if (!options.mfaCodeProvider) {
+        throw new import_property_provider.CredentialsProviderError(
+          `Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`,
+          { logger: options.logger, tryNextLink: false }
+        );
+      }
+      params.SerialNumber = mfa_serial;
+      params.TokenCode = await options.mfaCodeProvider(mfa_serial);
     }
-    params.SerialNumber = mfa_serial;
-    params.TokenCode = await options.mfaCodeProvider(mfa_serial);
+    const sourceCreds = await sourceCredsProvider;
+    return options.roleAssumer(sourceCreds, params);
   }
-  const sourceCreds = await sourceCredsProvider;
-  return options.roleAssumer(sourceCreds, params);
 }, "resolveAssumeRoleCredentials");
+var isCredentialSourceWithoutRoleArn = /* @__PURE__ */ __name((section) => {
+  return !section.role_arn && !!section.credential_source;
+}, "isCredentialSourceWithoutRoleArn");
 
 // src/resolveProcessCredentials.ts
 var isProcessProfile = /* @__PURE__ */ __name((arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", "isProcessProfile");
@@ -207,12 +206,12 @@ var resolveWebIdentityCredentials = /* @__PURE__ */ __name(async (profile, optio
 ), "resolveWebIdentityCredentials");
 
 // src/resolveProfileData.ts
-var resolveProfileData = /* @__PURE__ */ __name(async (profileName, profiles, options, visitedProfiles = {}) => {
+var resolveProfileData = /* @__PURE__ */ __name(async (profileName, profiles, options, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
   const data = profiles[profileName];
   if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) {
     return resolveStaticCredentials(data, options);
   }
-  if (isAssumeRoleProfile(data, { profile: profileName, logger: options.logger })) {
+  if (isAssumeRoleRecursiveCall || isAssumeRoleProfile(data, { profile: profileName, logger: options.logger })) {
     return resolveAssumeRoleCredentials(profileName, profiles, options, visitedProfiles);
   }
   if (isStaticCredsProfile(data)) {

package/dist-es/resolveAssumeRoleCredentials.js

@@ -44,31 +44,33 @@ export const resolveAssumeRoleCredentials = async (profileName, profiles, option
     }
     options.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${source_profile ? `source_profile=[${source_profile}]` : `profile=[${profileName}]`}`);
     const sourceCredsProvider = source_profile
-        ? resolveProfileData(source_profile, {
-            ...profiles,
-            [source_profile]: {
-                ...profiles[source_profile],
-                role_arn: data.role_arn ?? profiles[source_profile].role_arn,
-            },
-        }, options, {
+        ? resolveProfileData(source_profile, profiles, options, {
             ...visitedProfiles,
             [source_profile]: true,
-        })
+        }, isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {}))
         : (await resolveCredentialSource(data.credential_source, profileName, options.logger)(options))();
-    const params = {
-        RoleArn: data.role_arn,
-        RoleSessionName: data.role_session_name || `aws-sdk-js-${Date.now()}`,
-        ExternalId: data.external_id,
-        DurationSeconds: parseInt(data.duration_seconds || "3600", 10),
-    };
-    const { mfa_serial } = data;
-    if (mfa_serial) {
-        if (!options.mfaCodeProvider) {
-            throw new CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
+    if (isCredentialSourceWithoutRoleArn(data)) {
+        return sourceCredsProvider;
+    }
+    else {
+        const params = {
+            RoleArn: data.role_arn,
+            RoleSessionName: data.role_session_name || `aws-sdk-js-${Date.now()}`,
+            ExternalId: data.external_id,
+            DurationSeconds: parseInt(data.duration_seconds || "3600", 10),
+        };
+        const { mfa_serial } = data;
+        if (mfa_serial) {
+            if (!options.mfaCodeProvider) {
+                throw new CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
+            }
+            params.SerialNumber = mfa_serial;
+            params.TokenCode = await options.mfaCodeProvider(mfa_serial);
         }
-        params.SerialNumber = mfa_serial;
-        params.TokenCode = await options.mfaCodeProvider(mfa_serial);
+        const sourceCreds = await sourceCredsProvider;
+        return options.roleAssumer(sourceCreds, params);
     }
-    const sourceCreds = await sourceCredsProvider;
-    return options.roleAssumer(sourceCreds, params);
+};
+const isCredentialSourceWithoutRoleArn = (section) => {
+    return !section.role_arn && !!section.credential_source;
 };

package/dist-es/resolveProfileData.js

@@ -4,12 +4,12 @@ import { isProcessProfile, resolveProcessCredentials } from "./resolveProcessCre
 import { isSsoProfile, resolveSsoCredentials } from "./resolveSsoCredentials";
 import { isStaticCredsProfile, resolveStaticCredentials } from "./resolveStaticCredentials";
 import { isWebIdentityProfile, resolveWebIdentityCredentials } from "./resolveWebIdentityCredentials";
-export const resolveProfileData = async (profileName, profiles, options, visitedProfiles = {}) => {
+export const resolveProfileData = async (profileName, profiles, options, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
     const data = profiles[profileName];
     if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) {
         return resolveStaticCredentials(data, options);
     }
-    if (isAssumeRoleProfile(data, { profile: profileName, logger: options.logger })) {
+    if (isAssumeRoleRecursiveCall || isAssumeRoleProfile(data, { profile: profileName, logger: options.logger })) {
         return resolveAssumeRoleCredentials(profileName, profiles, options, visitedProfiles);
     }
     if (isStaticCredsProfile(data)) {

package/dist-types/resolveProfileData.d.ts

@@ -3,4 +3,4 @@ import { FromIniInit } from "./fromIni";
 /**
  * @internal
  */
-export declare const resolveProfileData: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>) => Promise<AwsCredentialIdentity>;
+export declare const resolveProfileData: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>, isAssumeRoleRecursiveCall?: boolean) => Promise<AwsCredentialIdentity>;

package/dist-types/ts3.4/resolveProfileData.d.ts

@@ -4,5 +4,6 @@ export declare const resolveProfileData: (
   profileName: string,
   profiles: ParsedIniData,
   options: FromIniInit,
-  visitedProfiles?: Record<string, true>
+  visitedProfiles?: Record<string, true>,
+  isAssumeRoleRecursiveCall?: boolean
 ) => Promise<AwsCredentialIdentity>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-ini",
-  "version": "3.650.0",
+  "version": "3.651.1",
   "description": "AWS credential provider that sources credentials from ~/.aws/credentials and ~/.aws/config",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -27,7 +27,7 @@
     "@aws-sdk/credential-provider-env": "3.649.0",
     "@aws-sdk/credential-provider-http": "3.649.0",
     "@aws-sdk/credential-provider-process": "3.649.0",
-    "@aws-sdk/credential-provider-sso": "3.650.0",
+    "@aws-sdk/credential-provider-sso": "3.651.1",
     "@aws-sdk/credential-provider-web-identity": "3.649.0",
     "@aws-sdk/types": "3.649.0",
     "@smithy/credential-provider-imds": "^3.2.1",
@@ -45,7 +45,7 @@
     "typescript": "~4.9.5"
   },
   "peerDependencies": {
-    "@aws-sdk/client-sts": "^3.650.0"
+    "@aws-sdk/client-sts": "^3.651.1"
   },
   "types": "./dist-types/index.d.ts",
   "engines": {