@cdk8s/awscdk-resolver 0.0.28 → 0.0.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/.jsii +4 -4
  2. package/lib/resolve.js +1 -1
  3. package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/models/models_0.js +6 -2
  4. package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/protocols/Aws_query.js +6 -0
  5. package/node_modules/@aws-sdk/client-cloudformation/dist-es/models/models_0.js +4 -0
  6. package/node_modules/@aws-sdk/client-cloudformation/dist-es/protocols/Aws_query.js +6 -0
  7. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/CreateStackInstancesCommand.d.ts +1 -0
  8. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/DeleteStackInstancesCommand.d.ts +1 -0
  9. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/DescribeStackSetOperationCommand.d.ts +1 -0
  10. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/DescribeStacksCommand.d.ts +1 -1
  11. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/DetectStackSetDriftCommand.d.ts +1 -0
  12. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/ImportStacksToStackSetCommand.d.ts +1 -0
  13. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/ListStackSetOperationsCommand.d.ts +1 -0
  14. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/StopStackSetOperationCommand.d.ts +3 -2
  15. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/UpdateStackInstancesCommand.d.ts +1 -0
  16. package/node_modules/@aws-sdk/client-cloudformation/dist-types/commands/UpdateStackSetCommand.d.ts +1 -0
  17. package/node_modules/@aws-sdk/client-cloudformation/dist-types/index.d.ts +2 -0
  18. package/node_modules/@aws-sdk/client-cloudformation/dist-types/models/models_0.d.ts +452 -335
  19. package/node_modules/@aws-sdk/client-cloudformation/dist-types/ts3.4/index.d.ts +2 -0
  20. package/node_modules/@aws-sdk/client-cloudformation/dist-types/ts3.4/models/models_0.d.ts +7 -0
  21. package/node_modules/@aws-sdk/client-cloudformation/package.json +4 -4
  22. package/node_modules/@aws-sdk/client-sso/dist-types/index.d.ts +2 -0
  23. package/node_modules/@aws-sdk/client-sso/dist-types/ts3.4/index.d.ts +2 -0
  24. package/node_modules/@aws-sdk/client-sso/package.json +2 -2
  25. package/node_modules/@aws-sdk/client-sts/dist-types/index.d.ts +2 -0
  26. package/node_modules/@aws-sdk/client-sts/dist-types/ts3.4/index.d.ts +2 -0
  27. package/node_modules/@aws-sdk/client-sts/package.json +3 -3
  28. package/node_modules/@aws-sdk/core/CHANGELOG.md +11 -0
  29. package/node_modules/@aws-sdk/core/package.json +3 -2
  30. package/node_modules/@aws-sdk/credential-provider-ini/package.json +2 -2
  31. package/node_modules/@aws-sdk/credential-provider-node/package.json +3 -3
  32. package/node_modules/@aws-sdk/credential-provider-sso/package.json +2 -2
  33. package/node_modules/@smithy/config-resolver/package.json +2 -2
  34. package/node_modules/@smithy/credential-provider-imds/dist-cjs/error/InstanceMetadataV1FallbackError.js +13 -0
  35. package/node_modules/@smithy/credential-provider-imds/dist-cjs/fromInstanceMetadata.js +45 -3
  36. package/node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js +9 -0
  37. package/node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js +44 -3
  38. package/node_modules/@smithy/credential-provider-imds/dist-types/error/InstanceMetadataV1FallbackError.d.ts +12 -0
  39. package/node_modules/@smithy/credential-provider-imds/dist-types/remoteProvider/RemoteProviderInit.d.ts +10 -2
  40. package/node_modules/@smithy/credential-provider-imds/dist-types/ts3.4/error/InstanceMetadataV1FallbackError.d.ts +12 -0
  41. package/node_modules/@smithy/credential-provider-imds/dist-types/ts3.4/remoteProvider/RemoteProviderInit.d.ts +10 -2
  42. package/node_modules/@smithy/credential-provider-imds/package.json +2 -2
  43. package/node_modules/@smithy/middleware-endpoint/package.json +3 -3
  44. package/node_modules/@smithy/middleware-retry/package.json +2 -2
  45. package/node_modules/@smithy/node-config-provider/package.json +2 -2
  46. package/node_modules/@smithy/shared-ini-file-loader/dist-cjs/parseIni.js +1 -1
  47. package/node_modules/@smithy/shared-ini-file-loader/dist-es/parseIni.js +1 -1
  48. package/node_modules/@smithy/shared-ini-file-loader/package.json +1 -1
  49. package/node_modules/@smithy/util-defaults-mode-node/package.json +4 -4
  50. package/node_modules/@smithy/util-endpoints/package.json +2 -2
  51. package/package.json +9 -9
@@ -1,6 +1,8 @@
1
1
  export * from "./CloudFormationClient";
2
2
  export * from "./CloudFormation";
3
3
  export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
4
+ export { RuntimeExtension } from "./runtimeExtensions";
5
+ export { CloudFormationExtensionConfiguration } from "./extensionConfiguration";
4
6
  export * from "./commands";
5
7
  export * from "./pagination";
6
8
  export * from "./waiters";
@@ -456,6 +456,12 @@ export interface DeploymentTargets {
456
456
  OrganizationalUnitIds?: string[];
457
457
  AccountFilterType?: AccountFilterType;
458
458
  }
459
+ export declare const ConcurrencyMode: {
460
+ readonly SOFT_FAILURE_TOLERANCE: "SOFT_FAILURE_TOLERANCE";
461
+ readonly STRICT_FAILURE_TOLERANCE: "STRICT_FAILURE_TOLERANCE";
462
+ };
463
+ export type ConcurrencyMode =
464
+ (typeof ConcurrencyMode)[keyof typeof ConcurrencyMode];
459
465
  export declare const RegionConcurrencyType: {
460
466
  readonly PARALLEL: "PARALLEL";
461
467
  readonly SEQUENTIAL: "SEQUENTIAL";
@@ -469,6 +475,7 @@ export interface StackSetOperationPreferences {
469
475
  FailureTolerancePercentage?: number;
470
476
  MaxConcurrentCount?: number;
471
477
  MaxConcurrentPercentage?: number;
478
+ ConcurrencyMode?: ConcurrencyMode;
472
479
  }
473
480
  export interface CreateStackInstancesInput {
474
481
  StackSetName: string | undefined;
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@aws-sdk/client-cloudformation",
3
3
  "description": "AWS SDK for JavaScript Cloudformation Client for Node.js, Browser and React Native",
4
- "version": "3.441.0",
4
+ "version": "3.448.0",
5
5
  "scripts": {
6
6
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
7
7
  "build:cjs": "tsc -p tsconfig.cjs.json",
@@ -21,9 +21,9 @@
21
21
  "dependencies": {
22
22
  "@aws-crypto/sha256-browser": "3.0.0",
23
23
  "@aws-crypto/sha256-js": "3.0.0",
24
- "@aws-sdk/client-sts": "3.441.0",
25
- "@aws-sdk/core": "3.441.0",
26
- "@aws-sdk/credential-provider-node": "3.441.0",
24
+ "@aws-sdk/client-sts": "3.445.0",
25
+ "@aws-sdk/core": "3.445.0",
26
+ "@aws-sdk/credential-provider-node": "3.445.0",
27
27
  "@aws-sdk/middleware-host-header": "3.433.0",
28
28
  "@aws-sdk/middleware-logger": "3.433.0",
29
29
  "@aws-sdk/middleware-recursion-detection": "3.433.0",
@@ -21,6 +21,8 @@
21
21
  export * from "./SSOClient";
22
22
  export * from "./SSO";
23
23
  export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
24
+ export { RuntimeExtension } from "./runtimeExtensions";
25
+ export { SSOExtensionConfiguration } from "./extensionConfiguration";
24
26
  export * from "./commands";
25
27
  export * from "./pagination";
26
28
  export * from "./models";
@@ -1,6 +1,8 @@
1
1
  export * from "./SSOClient";
2
2
  export * from "./SSO";
3
3
  export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
4
+ export { RuntimeExtension } from "./runtimeExtensions";
5
+ export { SSOExtensionConfiguration } from "./extensionConfiguration";
4
6
  export * from "./commands";
5
7
  export * from "./pagination";
6
8
  export * from "./models";
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@aws-sdk/client-sso",
3
3
  "description": "AWS SDK for JavaScript Sso Client for Node.js, Browser and React Native",
4
- "version": "3.441.0",
4
+ "version": "3.445.0",
5
5
  "scripts": {
6
6
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
7
7
  "build:cjs": "tsc -p tsconfig.cjs.json",
@@ -21,7 +21,7 @@
21
21
  "dependencies": {
22
22
  "@aws-crypto/sha256-browser": "3.0.0",
23
23
  "@aws-crypto/sha256-js": "3.0.0",
24
- "@aws-sdk/core": "3.441.0",
24
+ "@aws-sdk/core": "3.445.0",
25
25
  "@aws-sdk/middleware-host-header": "3.433.0",
26
26
  "@aws-sdk/middleware-logger": "3.433.0",
27
27
  "@aws-sdk/middleware-recursion-detection": "3.433.0",
@@ -9,6 +9,8 @@
9
9
  export * from "./STSClient";
10
10
  export * from "./STS";
11
11
  export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
12
+ export { RuntimeExtension } from "./runtimeExtensions";
13
+ export { STSExtensionConfiguration } from "./extensionConfiguration";
12
14
  export * from "./commands";
13
15
  export * from "./models";
14
16
  export * from "./defaultRoleAssumers";
@@ -1,6 +1,8 @@
1
1
  export * from "./STSClient";
2
2
  export * from "./STS";
3
3
  export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
4
+ export { RuntimeExtension } from "./runtimeExtensions";
5
+ export { STSExtensionConfiguration } from "./extensionConfiguration";
4
6
  export * from "./commands";
5
7
  export * from "./models";
6
8
  export * from "./defaultRoleAssumers";
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@aws-sdk/client-sts",
3
3
  "description": "AWS SDK for JavaScript Sts Client for Node.js, Browser and React Native",
4
- "version": "3.441.0",
4
+ "version": "3.445.0",
5
5
  "scripts": {
6
6
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
7
7
  "build:cjs": "tsc -p tsconfig.cjs.json",
@@ -23,8 +23,8 @@
23
23
  "dependencies": {
24
24
  "@aws-crypto/sha256-browser": "3.0.0",
25
25
  "@aws-crypto/sha256-js": "3.0.0",
26
- "@aws-sdk/core": "3.441.0",
27
- "@aws-sdk/credential-provider-node": "3.441.0",
26
+ "@aws-sdk/core": "3.445.0",
27
+ "@aws-sdk/credential-provider-node": "3.445.0",
28
28
  "@aws-sdk/middleware-host-header": "3.433.0",
29
29
  "@aws-sdk/middleware-logger": "3.433.0",
30
30
  "@aws-sdk/middleware-recursion-detection": "3.433.0",
@@ -3,6 +3,17 @@
3
3
  All notable changes to this project will be documented in this file.
4
4
  See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
5
5
 
6
+ # [3.445.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.444.0...v3.445.0) (2023-11-07)
7
+
8
+
9
+ ### Bug Fixes
10
+
11
+ * **core:** add tslib ([#5459](https://github.com/aws/aws-sdk-js-v3/issues/5459)) ([35a1aed](https://github.com/aws/aws-sdk-js-v3/commit/35a1aed1f0d2d6fb33c24232cb24268a1f8c1b05))
12
+
13
+
14
+
15
+
16
+
6
17
  # [3.441.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.440.0...v3.441.0) (2023-11-01)
7
18
 
8
19
  **Note:** Version bump only for package @aws-sdk/core
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@aws-sdk/core",
3
- "version": "3.441.0",
3
+ "version": "3.445.0",
4
4
  "description": "Core functions & classes shared by multiple AWS SDK clients",
5
5
  "scripts": {
6
6
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
@@ -24,7 +24,8 @@
24
24
  },
25
25
  "license": "Apache-2.0",
26
26
  "dependencies": {
27
- "@smithy/smithy-client": "^2.1.12"
27
+ "@smithy/smithy-client": "^2.1.12",
28
+ "tslib": "^2.5.0"
28
29
  },
29
30
  "devDependencies": {
30
31
  "@tsconfig/recommended": "1.0.1",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@aws-sdk/credential-provider-ini",
3
- "version": "3.441.0",
3
+ "version": "3.445.0",
4
4
  "description": "AWS credential provider that sources credentials from ~/.aws/credentials and ~/.aws/config",
5
5
  "main": "./dist-cjs/index.js",
6
6
  "module": "./dist-es/index.js",
@@ -26,7 +26,7 @@
26
26
  "dependencies": {
27
27
  "@aws-sdk/credential-provider-env": "3.433.0",
28
28
  "@aws-sdk/credential-provider-process": "3.433.0",
29
- "@aws-sdk/credential-provider-sso": "3.441.0",
29
+ "@aws-sdk/credential-provider-sso": "3.445.0",
30
30
  "@aws-sdk/credential-provider-web-identity": "3.433.0",
31
31
  "@aws-sdk/types": "3.433.0",
32
32
  "@smithy/credential-provider-imds": "^2.0.0",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@aws-sdk/credential-provider-node",
3
- "version": "3.441.0",
3
+ "version": "3.445.0",
4
4
  "description": "AWS credential provider that sources credentials from a Node.JS environment. ",
5
5
  "engines": {
6
6
  "node": ">=14.0.0"
@@ -28,9 +28,9 @@
28
28
  "license": "Apache-2.0",
29
29
  "dependencies": {
30
30
  "@aws-sdk/credential-provider-env": "3.433.0",
31
- "@aws-sdk/credential-provider-ini": "3.441.0",
31
+ "@aws-sdk/credential-provider-ini": "3.445.0",
32
32
  "@aws-sdk/credential-provider-process": "3.433.0",
33
- "@aws-sdk/credential-provider-sso": "3.441.0",
33
+ "@aws-sdk/credential-provider-sso": "3.445.0",
34
34
  "@aws-sdk/credential-provider-web-identity": "3.433.0",
35
35
  "@aws-sdk/types": "3.433.0",
36
36
  "@smithy/credential-provider-imds": "^2.0.0",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@aws-sdk/credential-provider-sso",
3
- "version": "3.441.0",
3
+ "version": "3.445.0",
4
4
  "description": "AWS credential provider that exchanges a resolved SSO login token file for temporary AWS credentials",
5
5
  "main": "./dist-cjs/index.js",
6
6
  "module": "./dist-es/index.js",
@@ -24,7 +24,7 @@
24
24
  },
25
25
  "license": "Apache-2.0",
26
26
  "dependencies": {
27
- "@aws-sdk/client-sso": "3.441.0",
27
+ "@aws-sdk/client-sso": "3.445.0",
28
28
  "@aws-sdk/token-providers": "3.438.0",
29
29
  "@aws-sdk/types": "3.433.0",
30
30
  "@smithy/property-provider": "^2.0.0",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@smithy/config-resolver",
3
- "version": "2.0.16",
3
+ "version": "2.0.17",
4
4
  "scripts": {
5
5
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
6
6
  "build:cjs": "yarn g:tsc -p tsconfig.cjs.json",
@@ -23,7 +23,7 @@
23
23
  },
24
24
  "license": "Apache-2.0",
25
25
  "dependencies": {
26
- "@smithy/node-config-provider": "^2.1.3",
26
+ "@smithy/node-config-provider": "^2.1.4",
27
27
  "@smithy/types": "^2.4.0",
28
28
  "@smithy/util-config-provider": "^2.0.0",
29
29
  "@smithy/util-middleware": "^2.0.5",
@@ -0,0 +1,13 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.InstanceMetadataV1FallbackError = void 0;
4
+ const property_provider_1 = require("@smithy/property-provider");
5
+ class InstanceMetadataV1FallbackError extends property_provider_1.CredentialsProviderError {
6
+ constructor(message, tryNextLink = true) {
7
+ super(message, tryNextLink);
8
+ this.tryNextLink = tryNextLink;
9
+ this.name = "InstanceMetadataV1FallbackError";
10
+ Object.setPrototypeOf(this, InstanceMetadataV1FallbackError.prototype);
11
+ }
12
+ }
13
+ exports.InstanceMetadataV1FallbackError = InstanceMetadataV1FallbackError;
@@ -1,7 +1,9 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.fromInstanceMetadata = void 0;
4
+ const node_config_provider_1 = require("@smithy/node-config-provider");
4
5
  const property_provider_1 = require("@smithy/property-provider");
6
+ const InstanceMetadataV1FallbackError_1 = require("./error/InstanceMetadataV1FallbackError");
5
7
  const httpRequest_1 = require("./remoteProvider/httpRequest");
6
8
  const ImdsCredentials_1 = require("./remoteProvider/ImdsCredentials");
7
9
  const RemoteProviderInit_1 = require("./remoteProvider/RemoteProviderInit");
@@ -10,13 +12,51 @@ const getInstanceMetadataEndpoint_1 = require("./utils/getInstanceMetadataEndpoi
10
12
  const staticStabilityProvider_1 = require("./utils/staticStabilityProvider");
11
13
  const IMDS_PATH = "/latest/meta-data/iam/security-credentials/";
12
14
  const IMDS_TOKEN_PATH = "/latest/api/token";
15
+ const AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED";
16
+ const PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled";
17
+ const X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token";
13
18
  const fromInstanceMetadata = (init = {}) => (0, staticStabilityProvider_1.staticStabilityProvider)(getInstanceImdsProvider(init), { logger: init.logger });
14
19
  exports.fromInstanceMetadata = fromInstanceMetadata;
15
20
  const getInstanceImdsProvider = (init) => {
16
21
  let disableFetchToken = false;
22
+ const { logger, profile } = init;
17
23
  const { timeout, maxRetries } = (0, RemoteProviderInit_1.providerConfigFromInit)(init);
18
24
  const getCredentials = async (maxRetries, options) => {
19
- const profile = (await (0, retry_1.retry)(async () => {
25
+ var _a;
26
+ const isImdsV1Fallback = disableFetchToken || ((_a = options.headers) === null || _a === void 0 ? void 0 : _a[X_AWS_EC2_METADATA_TOKEN]) == null;
27
+ if (isImdsV1Fallback) {
28
+ let fallbackBlockedFromProfile = false;
29
+ let fallbackBlockedFromProcessEnv = false;
30
+ const configValue = await (0, node_config_provider_1.loadConfig)({
31
+ environmentVariableSelector: (env) => {
32
+ const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
33
+ fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
34
+ if (envValue === undefined) {
35
+ throw new property_provider_1.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`);
36
+ }
37
+ return fallbackBlockedFromProcessEnv;
38
+ },
39
+ configFileSelector: (profile) => {
40
+ const profileValue = profile[PROFILE_AWS_EC2_METADATA_V1_DISABLED];
41
+ fallbackBlockedFromProfile = !!profileValue && profileValue !== "false";
42
+ return fallbackBlockedFromProfile;
43
+ },
44
+ default: false,
45
+ }, {
46
+ profile,
47
+ })();
48
+ if (init.ec2MetadataV1Disabled || configValue) {
49
+ const causes = [];
50
+ if (init.ec2MetadataV1Disabled)
51
+ causes.push("credential provider initialization (runtime option ec2MetadataV1Disabled)");
52
+ if (fallbackBlockedFromProfile)
53
+ causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);
54
+ if (fallbackBlockedFromProcessEnv)
55
+ causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);
56
+ throw new InstanceMetadataV1FallbackError_1.InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(", ")}].`);
57
+ }
58
+ }
59
+ const imdsProfile = (await (0, retry_1.retry)(async () => {
20
60
  let profile;
21
61
  try {
22
62
  profile = await getProfile(options);
@@ -32,7 +72,7 @@ const getInstanceImdsProvider = (init) => {
32
72
  return (0, retry_1.retry)(async () => {
33
73
  let creds;
34
74
  try {
35
- creds = await getCredentialsFromProfile(profile, options);
75
+ creds = await getCredentialsFromProfile(imdsProfile, options);
36
76
  }
37
77
  catch (err) {
38
78
  if (err.statusCode === 401) {
@@ -46,6 +86,7 @@ const getInstanceImdsProvider = (init) => {
46
86
  return async () => {
47
87
  const endpoint = await (0, getInstanceMetadataEndpoint_1.getInstanceMetadataEndpoint)();
48
88
  if (disableFetchToken) {
89
+ logger === null || logger === void 0 ? void 0 : logger.debug("AWS SDK Instance Metadata", "using v1 fallback (no token fetch)");
49
90
  return getCredentials(maxRetries, { ...endpoint, timeout });
50
91
  }
51
92
  else {
@@ -62,12 +103,13 @@ const getInstanceImdsProvider = (init) => {
62
103
  else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
63
104
  disableFetchToken = true;
64
105
  }
106
+ logger === null || logger === void 0 ? void 0 : logger.debug("AWS SDK Instance Metadata", "using v1 fallback (initial)");
65
107
  return getCredentials(maxRetries, { ...endpoint, timeout });
66
108
  }
67
109
  return getCredentials(maxRetries, {
68
110
  ...endpoint,
69
111
  headers: {
70
- "x-aws-ec2-metadata-token": token,
112
+ [X_AWS_EC2_METADATA_TOKEN]: token,
71
113
  },
72
114
  timeout,
73
115
  });
@@ -0,0 +1,9 @@
1
+ import { CredentialsProviderError } from "@smithy/property-provider";
2
+ export class InstanceMetadataV1FallbackError extends CredentialsProviderError {
3
+ constructor(message, tryNextLink = true) {
4
+ super(message, tryNextLink);
5
+ this.tryNextLink = tryNextLink;
6
+ this.name = "InstanceMetadataV1FallbackError";
7
+ Object.setPrototypeOf(this, InstanceMetadataV1FallbackError.prototype);
8
+ }
9
+ }
@@ -1,4 +1,6 @@
1
+ import { loadConfig } from "@smithy/node-config-provider";
1
2
  import { CredentialsProviderError } from "@smithy/property-provider";
3
+ import { InstanceMetadataV1FallbackError } from "./error/InstanceMetadataV1FallbackError";
2
4
  import { httpRequest } from "./remoteProvider/httpRequest";
3
5
  import { fromImdsCredentials, isImdsCredentials } from "./remoteProvider/ImdsCredentials";
4
6
  import { providerConfigFromInit } from "./remoteProvider/RemoteProviderInit";
@@ -7,12 +9,49 @@ import { getInstanceMetadataEndpoint } from "./utils/getInstanceMetadataEndpoint
7
9
  import { staticStabilityProvider } from "./utils/staticStabilityProvider";
8
10
  const IMDS_PATH = "/latest/meta-data/iam/security-credentials/";
9
11
  const IMDS_TOKEN_PATH = "/latest/api/token";
12
+ const AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED";
13
+ const PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled";
14
+ const X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token";
10
15
  export const fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceImdsProvider(init), { logger: init.logger });
11
16
  const getInstanceImdsProvider = (init) => {
12
17
  let disableFetchToken = false;
18
+ const { logger, profile } = init;
13
19
  const { timeout, maxRetries } = providerConfigFromInit(init);
14
20
  const getCredentials = async (maxRetries, options) => {
15
- const profile = (await retry(async () => {
21
+ const isImdsV1Fallback = disableFetchToken || options.headers?.[X_AWS_EC2_METADATA_TOKEN] == null;
22
+ if (isImdsV1Fallback) {
23
+ let fallbackBlockedFromProfile = false;
24
+ let fallbackBlockedFromProcessEnv = false;
25
+ const configValue = await loadConfig({
26
+ environmentVariableSelector: (env) => {
27
+ const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
28
+ fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
29
+ if (envValue === undefined) {
30
+ throw new CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`);
31
+ }
32
+ return fallbackBlockedFromProcessEnv;
33
+ },
34
+ configFileSelector: (profile) => {
35
+ const profileValue = profile[PROFILE_AWS_EC2_METADATA_V1_DISABLED];
36
+ fallbackBlockedFromProfile = !!profileValue && profileValue !== "false";
37
+ return fallbackBlockedFromProfile;
38
+ },
39
+ default: false,
40
+ }, {
41
+ profile,
42
+ })();
43
+ if (init.ec2MetadataV1Disabled || configValue) {
44
+ const causes = [];
45
+ if (init.ec2MetadataV1Disabled)
46
+ causes.push("credential provider initialization (runtime option ec2MetadataV1Disabled)");
47
+ if (fallbackBlockedFromProfile)
48
+ causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);
49
+ if (fallbackBlockedFromProcessEnv)
50
+ causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);
51
+ throw new InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(", ")}].`);
52
+ }
53
+ }
54
+ const imdsProfile = (await retry(async () => {
16
55
  let profile;
17
56
  try {
18
57
  profile = await getProfile(options);
@@ -28,7 +67,7 @@ const getInstanceImdsProvider = (init) => {
28
67
  return retry(async () => {
29
68
  let creds;
30
69
  try {
31
- creds = await getCredentialsFromProfile(profile, options);
70
+ creds = await getCredentialsFromProfile(imdsProfile, options);
32
71
  }
33
72
  catch (err) {
34
73
  if (err.statusCode === 401) {
@@ -42,6 +81,7 @@ const getInstanceImdsProvider = (init) => {
42
81
  return async () => {
43
82
  const endpoint = await getInstanceMetadataEndpoint();
44
83
  if (disableFetchToken) {
84
+ logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (no token fetch)");
45
85
  return getCredentials(maxRetries, { ...endpoint, timeout });
46
86
  }
47
87
  else {
@@ -58,12 +98,13 @@ const getInstanceImdsProvider = (init) => {
58
98
  else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
59
99
  disableFetchToken = true;
60
100
  }
101
+ logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (initial)");
61
102
  return getCredentials(maxRetries, { ...endpoint, timeout });
62
103
  }
63
104
  return getCredentials(maxRetries, {
64
105
  ...endpoint,
65
106
  headers: {
66
- "x-aws-ec2-metadata-token": token,
107
+ [X_AWS_EC2_METADATA_TOKEN]: token,
67
108
  },
68
109
  timeout,
69
110
  });
@@ -0,0 +1,12 @@
1
+ import { CredentialsProviderError } from "@smithy/property-provider";
2
+ /**
3
+ * @public
4
+ *
5
+ * A specific sub-case of CredentialsProviderError, when the IMDSv1 fallback
6
+ * has been attempted but shut off by SDK configuration.
7
+ */
8
+ export declare class InstanceMetadataV1FallbackError extends CredentialsProviderError {
9
+ readonly tryNextLink: boolean;
10
+ name: string;
11
+ constructor(message: string, tryNextLink?: boolean);
12
+ }
@@ -8,7 +8,7 @@ export declare const DEFAULT_TIMEOUT = 1000;
8
8
  */
9
9
  export declare const DEFAULT_MAX_RETRIES = 0;
10
10
  /**
11
- * @internal
11
+ * @public
12
12
  */
13
13
  export interface RemoteProviderConfig {
14
14
  /**
@@ -21,10 +21,18 @@ export interface RemoteProviderConfig {
21
21
  maxRetries: number;
22
22
  }
23
23
  /**
24
- * @internal
24
+ * @public
25
25
  */
26
26
  export interface RemoteProviderInit extends Partial<RemoteProviderConfig> {
27
27
  logger?: Logger;
28
+ /**
29
+ * Only used in the IMDS credential provider.
30
+ */
31
+ ec2MetadataV1Disabled?: boolean;
32
+ /**
33
+ * AWS_PROFILE.
34
+ */
35
+ profile?: string;
28
36
  }
29
37
  /**
30
38
  * @internal
@@ -0,0 +1,12 @@
1
+ import { CredentialsProviderError } from "@smithy/property-provider";
2
+ /**
3
+ * @public
4
+ *
5
+ * A specific sub-case of CredentialsProviderError, when the IMDSv1 fallback
6
+ * has been attempted but shut off by SDK configuration.
7
+ */
8
+ export declare class InstanceMetadataV1FallbackError extends CredentialsProviderError {
9
+ readonly tryNextLink: boolean;
10
+ name: string;
11
+ constructor(message: string, tryNextLink?: boolean);
12
+ }
@@ -8,7 +8,7 @@ export declare const DEFAULT_TIMEOUT = 1000;
8
8
  */
9
9
  export declare const DEFAULT_MAX_RETRIES = 0;
10
10
  /**
11
- * @internal
11
+ * @public
12
12
  */
13
13
  export interface RemoteProviderConfig {
14
14
  /**
@@ -21,10 +21,18 @@ export interface RemoteProviderConfig {
21
21
  maxRetries: number;
22
22
  }
23
23
  /**
24
- * @internal
24
+ * @public
25
25
  */
26
26
  export interface RemoteProviderInit extends Partial<RemoteProviderConfig> {
27
27
  logger?: Logger;
28
+ /**
29
+ * Only used in the IMDS credential provider.
30
+ */
31
+ ec2MetadataV1Disabled?: boolean;
32
+ /**
33
+ * AWS_PROFILE.
34
+ */
35
+ profile?: string;
28
36
  }
29
37
  /**
30
38
  * @internal
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@smithy/credential-provider-imds",
3
- "version": "2.0.18",
3
+ "version": "2.1.0",
4
4
  "description": "AWS credential provider that sources credentials from the EC2 instance metadata service and ECS container metadata service",
5
5
  "main": "./dist-cjs/index.js",
6
6
  "module": "./dist-es/index.js",
@@ -26,7 +26,7 @@
26
26
  },
27
27
  "license": "Apache-2.0",
28
28
  "dependencies": {
29
- "@smithy/node-config-provider": "^2.1.3",
29
+ "@smithy/node-config-provider": "^2.1.4",
30
30
  "@smithy/property-provider": "^2.0.13",
31
31
  "@smithy/types": "^2.4.0",
32
32
  "@smithy/url-parser": "^2.0.12",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@smithy/middleware-endpoint",
3
- "version": "2.1.3",
3
+ "version": "2.1.4",
4
4
  "scripts": {
5
5
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
6
6
  "build:cjs": "yarn g:tsc -p tsconfig.cjs.json",
@@ -24,8 +24,8 @@
24
24
  "license": "Apache-2.0",
25
25
  "dependencies": {
26
26
  "@smithy/middleware-serde": "^2.0.12",
27
- "@smithy/node-config-provider": "^2.1.3",
28
- "@smithy/shared-ini-file-loader": "^2.2.2",
27
+ "@smithy/node-config-provider": "^2.1.4",
28
+ "@smithy/shared-ini-file-loader": "^2.2.3",
29
29
  "@smithy/types": "^2.4.0",
30
30
  "@smithy/url-parser": "^2.0.12",
31
31
  "@smithy/util-middleware": "^2.0.5",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@smithy/middleware-retry",
3
- "version": "2.0.18",
3
+ "version": "2.0.19",
4
4
  "scripts": {
5
5
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
6
6
  "build:cjs": "yarn g:tsc -p tsconfig.cjs.json",
@@ -24,7 +24,7 @@
24
24
  },
25
25
  "license": "Apache-2.0",
26
26
  "dependencies": {
27
- "@smithy/node-config-provider": "^2.1.3",
27
+ "@smithy/node-config-provider": "^2.1.4",
28
28
  "@smithy/protocol-http": "^3.0.8",
29
29
  "@smithy/service-error-classification": "^2.0.5",
30
30
  "@smithy/types": "^2.4.0",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@smithy/node-config-provider",
3
- "version": "2.1.3",
3
+ "version": "2.1.4",
4
4
  "description": "Load config default values from ini config files and environmental variable",
5
5
  "scripts": {
6
6
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
@@ -25,7 +25,7 @@
25
25
  "types": "./dist-types/index.d.ts",
26
26
  "dependencies": {
27
27
  "@smithy/property-provider": "^2.0.13",
28
- "@smithy/shared-ini-file-loader": "^2.2.2",
28
+ "@smithy/shared-ini-file-loader": "^2.2.3",
29
29
  "@smithy/types": "^2.4.0",
30
30
  "tslib": "^2.5.0"
31
31
  },
@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.parseIni = void 0;
4
4
  const types_1 = require("@smithy/types");
5
5
  const loadSharedConfigFiles_1 = require("./loadSharedConfigFiles");
6
- const prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+]+)\2$/;
6
+ const prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/;
7
7
  const profileNameBlockList = ["__proto__", "profile __proto__"];
8
8
  const parseIni = (iniData) => {
9
9
  const map = {};
@@ -1,6 +1,6 @@
1
1
  import { IniSectionType } from "@smithy/types";
2
2
  import { CONFIG_PREFIX_SEPARATOR } from "./loadSharedConfigFiles";
3
- const prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+]+)\2$/;
3
+ const prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/;
4
4
  const profileNameBlockList = ["__proto__", "profile __proto__"];
5
5
  export const parseIni = (iniData) => {
6
6
  const map = {};
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@smithy/shared-ini-file-loader",
3
- "version": "2.2.2",
3
+ "version": "2.2.3",
4
4
  "dependencies": {
5
5
  "@smithy/types": "^2.4.0",
6
6
  "tslib": "^2.5.0"