@cdk8s/awscdk-resolver 0.0.600 → 0.0.602
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.jsii +3 -3
- package/lib/resolve.js +1 -1
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/auth/httpAuthSchemeProvider.js +9 -15
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/endpoint/bdd.js +2 -5
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/endpoint/endpointResolver.js +7 -11
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/index.js +449 -469
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/models/CloudFormationServiceException.js +4 -8
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/models/errors.js +59 -91
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/runtimeConfig.browser.js +22 -26
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/runtimeConfig.js +30 -34
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/runtimeConfig.native.js +4 -7
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/runtimeConfig.shared.js +20 -24
- package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/schemas/schemas_0.js +814 -533
- package/node_modules/@aws-sdk/client-cloudformation/package.json +8 -8
- package/node_modules/@aws-sdk/core/dist-cjs/index.js +45 -50
- package/node_modules/@aws-sdk/core/dist-cjs/submodules/account-id-endpoint/index.js +2 -4
- package/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.browser.js +21 -22
- package/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js +51 -51
- package/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.native.js +21 -22
- package/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js +19 -21
- package/node_modules/@aws-sdk/core/dist-cjs/submodules/protocols/index.js +107 -109
- package/node_modules/@aws-sdk/core/dist-cjs/submodules/util/index.js +2 -4
- package/node_modules/@aws-sdk/core/package.json +8 -8
- package/node_modules/@aws-sdk/credential-provider-env/dist-cjs/index.js +4 -6
- package/node_modules/@aws-sdk/credential-provider-env/package.json +6 -6
- package/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/checkUrl.js +3 -7
- package/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/fromHttp.browser.js +12 -16
- package/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/fromHttp.js +16 -21
- package/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/requestHelpers.js +14 -18
- package/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/retry-wrapper.js +1 -5
- package/node_modules/@aws-sdk/credential-provider-http/dist-cjs/index.browser.js +2 -5
- package/node_modules/@aws-sdk/credential-provider-http/dist-cjs/index.js +2 -7
- package/node_modules/@aws-sdk/credential-provider-http/package.json +6 -6
- package/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/index.js +47 -41
- package/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js +8 -4
- package/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js +14 -10
- package/node_modules/@aws-sdk/credential-provider-ini/package.json +13 -13
- package/node_modules/@aws-sdk/credential-provider-login/dist-cjs/index.js +31 -33
- package/node_modules/@aws-sdk/credential-provider-login/package.json +7 -7
- package/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js +16 -18
- package/node_modules/@aws-sdk/credential-provider-node/package.json +11 -11
- package/node_modules/@aws-sdk/credential-provider-process/dist-cjs/index.js +11 -13
- package/node_modules/@aws-sdk/credential-provider-process/package.json +6 -6
- package/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/index.js +22 -24
- package/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/loadSso-BGYXHf8s.js +3 -0
- package/node_modules/@aws-sdk/credential-provider-sso/package.json +8 -8
- package/node_modules/@aws-sdk/credential-provider-web-identity/dist-cjs/fromTokenFile.js +10 -14
- package/node_modules/@aws-sdk/credential-provider-web-identity/dist-cjs/fromWebToken.js +2 -6
- package/node_modules/@aws-sdk/credential-provider-web-identity/dist-cjs/index.js +3 -27
- package/node_modules/@aws-sdk/credential-provider-web-identity/package.json +7 -7
- package/node_modules/@aws-sdk/nested-clients/dist-cjs/index.js +0 -1
- package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/cognito-identity/index.js +82 -84
- package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js +158 -119
- package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso/index.js +80 -82
- package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso-oidc/index.js +80 -82
- package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js +99 -101
- package/node_modules/@aws-sdk/nested-clients/dist-es/submodules/signin/commands/CreateOAuth2TokenCommand.js +4 -1
- package/node_modules/@aws-sdk/nested-clients/dist-es/submodules/signin/endpoint/bdd.js +70 -35
- package/node_modules/@aws-sdk/nested-clients/dist-es/submodules/signin/endpoint/endpointResolver.js +1 -1
- package/node_modules/@aws-sdk/nested-clients/dist-es/submodules/signin/models/enums.js +3 -0
- package/node_modules/@aws-sdk/nested-clients/dist-types/submodules/signin/endpoint/EndpointParameters.d.ts +1 -0
- package/node_modules/@aws-sdk/nested-clients/dist-types/submodules/signin/models/enums.d.ts +12 -0
- package/node_modules/@aws-sdk/nested-clients/dist-types/ts3.4/submodules/signin/endpoint/EndpointParameters.d.ts +1 -0
- package/node_modules/@aws-sdk/nested-clients/dist-types/ts3.4/submodules/signin/models/enums.d.ts +3 -0
- package/node_modules/@aws-sdk/nested-clients/package.json +9 -8
- package/node_modules/@aws-sdk/signature-v4-multi-region/dist-cjs/index.js +4 -6
- package/node_modules/@aws-sdk/signature-v4-multi-region/package.json +5 -5
- package/node_modules/@aws-sdk/token-providers/dist-cjs/index.js +26 -28
- package/node_modules/@aws-sdk/token-providers/package.json +7 -7
- package/node_modules/@aws-sdk/types/dist-cjs/index.js +7 -8
- package/node_modules/@aws-sdk/types/package.json +4 -4
- package/node_modules/@aws-sdk/util-locate-window/dist-cjs/index.js +0 -2
- package/node_modules/@aws-sdk/util-locate-window/package.json +4 -4
- package/node_modules/@aws-sdk/xml-builder/dist-cjs/index.js +2 -4
- package/node_modules/@aws-sdk/xml-builder/dist-cjs/xml-external/nodable_entities.js +4 -7
- package/node_modules/@aws-sdk/xml-builder/dist-cjs/xml-parser.browser.js +2 -5
- package/node_modules/@aws-sdk/xml-builder/dist-cjs/xml-parser.js +7 -10
- package/node_modules/@aws-sdk/xml-builder/package.json +4 -4
- package/node_modules/@smithy/core/dist-cjs/index.js +13 -15
- package/node_modules/@smithy/core/dist-cjs/submodules/cbor/index.js +29 -31
- package/node_modules/@smithy/core/dist-cjs/submodules/checksum/index.browser.js +2 -4
- package/node_modules/@smithy/core/dist-cjs/submodules/checksum/index.js +7 -9
- package/node_modules/@smithy/core/dist-cjs/submodules/checksum/index.native.js +3 -5
- package/node_modules/@smithy/core/dist-cjs/submodules/client/index.js +22 -23
- package/node_modules/@smithy/core/dist-cjs/submodules/config/index.browser.js +10 -11
- package/node_modules/@smithy/core/dist-cjs/submodules/config/index.js +38 -39
- package/node_modules/@smithy/core/dist-cjs/submodules/config/index.native.js +10 -11
- package/node_modules/@smithy/core/dist-cjs/submodules/endpoints/index.browser.js +14 -17
- package/node_modules/@smithy/core/dist-cjs/submodules/endpoints/index.js +20 -23
- package/node_modules/@smithy/core/dist-cjs/submodules/event-streams/index.browser.js +9 -11
- package/node_modules/@smithy/core/dist-cjs/submodules/event-streams/index.js +11 -13
- package/node_modules/@smithy/core/dist-cjs/submodules/protocols/index.js +59 -60
- package/node_modules/@smithy/core/dist-cjs/submodules/retry/index.browser.js +23 -24
- package/node_modules/@smithy/core/dist-cjs/submodules/retry/index.js +25 -26
- package/node_modules/@smithy/core/dist-cjs/submodules/schema/index.js +5 -7
- package/node_modules/@smithy/core/dist-cjs/submodules/serde/index.browser.js +4 -6
- package/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js +23 -25
- package/node_modules/@smithy/core/dist-cjs/submodules/serde/index.native.js +4 -6
- package/node_modules/@smithy/core/dist-cjs/submodules/transport/index.js +2 -4
- package/node_modules/@smithy/core/dist-es/legacy-root-exports/middleware-http-auth-scheme/httpAuthSchemeMiddleware.js +1 -1
- package/node_modules/@smithy/core/dist-es/legacy-root-exports/middleware-http-signing/httpSigningMiddleware.js +1 -1
- package/node_modules/@smithy/core/dist-es/submodules/cbor/SmithyRpcV2CborProtocol.js +1 -1
- package/node_modules/@smithy/core/dist-es/submodules/endpoints/middleware-endpoint/endpointMiddleware.js +1 -1
- package/node_modules/@smithy/core/dist-types/submodules/schema/TypeRegistry.d.ts +1 -1
- package/node_modules/@smithy/core/package.json +7 -6
- package/node_modules/@smithy/credential-provider-imds/dist-cjs/index.js +23 -24
- package/node_modules/@smithy/credential-provider-imds/package.json +6 -6
- package/node_modules/@smithy/fetch-http-handler/dist-cjs/index.js +6 -8
- package/node_modules/@smithy/fetch-http-handler/package.json +7 -7
- package/node_modules/@smithy/node-http-handler/dist-cjs/index.js +11 -13
- package/node_modules/@smithy/node-http-handler/package.json +7 -7
- package/node_modules/@smithy/signature-v4/dist-cjs/index.js +27 -29
- package/node_modules/@smithy/signature-v4/package.json +6 -6
- package/node_modules/@smithy/types/dist-cjs/index.js +23 -18
- package/node_modules/@smithy/types/package.json +4 -4
- package/package.json +4 -4
- package/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/loadSso-BKDNrsal.js +0 -8
|
@@ -1,17 +1,17 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aws-sdk/credential-provider-ini",
|
|
3
|
-
"version": "3.972.
|
|
3
|
+
"version": "3.972.54",
|
|
4
4
|
"description": "AWS credential provider that sources credentials from ~/.aws/credentials and ~/.aws/config",
|
|
5
5
|
"main": "./dist-cjs/index.js",
|
|
6
6
|
"module": "./dist-es/index.js",
|
|
7
7
|
"scripts": {
|
|
8
8
|
"build": "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
|
|
9
9
|
"build:cjs": "node ../../scripts/compilation/inline",
|
|
10
|
-
"build:es": "tsc -p tsconfig.es.json",
|
|
10
|
+
"build:es": "premove dist-es && tsc -p tsconfig.es.json",
|
|
11
11
|
"build:include:deps": "yarn g:turbo run build -F=\"$npm_package_name\"",
|
|
12
|
-
"build:types": "tsc -p tsconfig.types.json",
|
|
12
|
+
"build:types": "premove dist-types && tsc -p tsconfig.types.json",
|
|
13
13
|
"build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
|
|
14
|
-
"clean": "premove dist-cjs dist-es dist-types
|
|
14
|
+
"clean": "premove dist-cjs dist-es dist-types",
|
|
15
15
|
"test": "yarn g:vitest run",
|
|
16
16
|
"test:watch": "yarn g:vitest watch",
|
|
17
17
|
"test:integration": "yarn g:vitest run -c vitest.config.integ.mts",
|
|
@@ -28,15 +28,15 @@
|
|
|
28
28
|
},
|
|
29
29
|
"license": "Apache-2.0",
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@aws-sdk/core": "^3.974.
|
|
32
|
-
"@aws-sdk/credential-provider-env": "^3.972.
|
|
33
|
-
"@aws-sdk/credential-provider-http": "^3.972.
|
|
34
|
-
"@aws-sdk/credential-provider-login": "^3.972.
|
|
35
|
-
"@aws-sdk/credential-provider-process": "^3.972.
|
|
36
|
-
"@aws-sdk/credential-provider-sso": "^3.972.
|
|
37
|
-
"@aws-sdk/credential-provider-web-identity": "^3.972.
|
|
38
|
-
"@aws-sdk/nested-clients": "^3.997.
|
|
39
|
-
"@aws-sdk/types": "^3.973.
|
|
31
|
+
"@aws-sdk/core": "^3.974.21",
|
|
32
|
+
"@aws-sdk/credential-provider-env": "^3.972.47",
|
|
33
|
+
"@aws-sdk/credential-provider-http": "^3.972.49",
|
|
34
|
+
"@aws-sdk/credential-provider-login": "^3.972.53",
|
|
35
|
+
"@aws-sdk/credential-provider-process": "^3.972.47",
|
|
36
|
+
"@aws-sdk/credential-provider-sso": "^3.972.53",
|
|
37
|
+
"@aws-sdk/credential-provider-web-identity": "^3.972.53",
|
|
38
|
+
"@aws-sdk/nested-clients": "^3.997.21",
|
|
39
|
+
"@aws-sdk/types": "^3.973.13",
|
|
40
40
|
"@smithy/core": "^3.24.6",
|
|
41
41
|
"@smithy/credential-provider-imds": "^4.3.7",
|
|
42
42
|
"@smithy/types": "^4.14.3",
|
|
@@ -1,12 +1,10 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
var node_os = require('node:os');
|
|
9
|
-
var node_path = require('node:path');
|
|
1
|
+
const { setCredentialFeature } = require("@aws-sdk/core/client");
|
|
2
|
+
const { CredentialsProviderError, readFile, parseKnownFiles, getProfileName } = require("@smithy/core/config");
|
|
3
|
+
const { HttpRequest } = require("@smithy/core/protocols");
|
|
4
|
+
const { createHash, createPrivateKey, createPublicKey, sign } = require("node:crypto");
|
|
5
|
+
const { promises } = require("node:fs");
|
|
6
|
+
const { homedir } = require("node:os");
|
|
7
|
+
const { dirname, join } = require("node:path");
|
|
10
8
|
|
|
11
9
|
class LoginCredentialsFetcher {
|
|
12
10
|
profileData;
|
|
@@ -21,7 +19,7 @@ class LoginCredentialsFetcher {
|
|
|
21
19
|
async loadCredentials() {
|
|
22
20
|
const token = await this.loadToken();
|
|
23
21
|
if (!token) {
|
|
24
|
-
throw new
|
|
22
|
+
throw new CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
|
|
25
23
|
}
|
|
26
24
|
const accessToken = token.accessToken;
|
|
27
25
|
const now = Date.now();
|
|
@@ -45,7 +43,7 @@ class LoginCredentialsFetcher {
|
|
|
45
43
|
return this.profileData.login_session;
|
|
46
44
|
}
|
|
47
45
|
async refresh(token) {
|
|
48
|
-
const { SigninClient, CreateOAuth2TokenCommand } =
|
|
46
|
+
const { SigninClient, CreateOAuth2TokenCommand } = require('@aws-sdk/nested-clients/signin');
|
|
49
47
|
const { logger, userAgentAppId } = this.callerClientConfig ?? {};
|
|
50
48
|
const isH2 = (requestHandler) => {
|
|
51
49
|
return requestHandler?.metadata?.handlerProtocol === "h2";
|
|
@@ -78,7 +76,7 @@ class LoginCredentialsFetcher {
|
|
|
78
76
|
const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
|
|
79
77
|
const { refreshToken, expiresIn } = response.tokenOutput ?? {};
|
|
80
78
|
if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {
|
|
81
|
-
throw new
|
|
79
|
+
throw new CredentialsProviderError("Token refresh response missing required fields", {
|
|
82
80
|
logger: this.logger,
|
|
83
81
|
tryNextLink: false,
|
|
84
82
|
});
|
|
@@ -125,9 +123,9 @@ class LoginCredentialsFetcher {
|
|
|
125
123
|
default:
|
|
126
124
|
message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
|
|
127
125
|
}
|
|
128
|
-
throw new
|
|
126
|
+
throw new CredentialsProviderError(message, { logger: this.logger, tryNextLink: false });
|
|
129
127
|
}
|
|
130
|
-
throw new
|
|
128
|
+
throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
|
|
131
129
|
}
|
|
132
130
|
}
|
|
133
131
|
async loadToken() {
|
|
@@ -135,10 +133,10 @@ class LoginCredentialsFetcher {
|
|
|
135
133
|
try {
|
|
136
134
|
let tokenData;
|
|
137
135
|
try {
|
|
138
|
-
tokenData = await
|
|
136
|
+
tokenData = await readFile(tokenFilePath, { ignoreCache: this.init?.ignoreCache });
|
|
139
137
|
}
|
|
140
138
|
catch {
|
|
141
|
-
tokenData = await
|
|
139
|
+
tokenData = await promises.readFile(tokenFilePath, "utf8");
|
|
142
140
|
}
|
|
143
141
|
const token = JSON.parse(tokenData);
|
|
144
142
|
const missingFields = ["accessToken", "clientId", "refreshToken", "dpopKey"].filter((k) => !token[k]);
|
|
@@ -146,7 +144,7 @@ class LoginCredentialsFetcher {
|
|
|
146
144
|
missingFields.push("accountId");
|
|
147
145
|
}
|
|
148
146
|
if (missingFields.length > 0) {
|
|
149
|
-
throw new
|
|
147
|
+
throw new CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
|
|
150
148
|
logger: this.logger,
|
|
151
149
|
tryNextLink: false,
|
|
152
150
|
});
|
|
@@ -154,7 +152,7 @@ class LoginCredentialsFetcher {
|
|
|
154
152
|
return token;
|
|
155
153
|
}
|
|
156
154
|
catch (error) {
|
|
157
|
-
throw new
|
|
155
|
+
throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
|
|
158
156
|
logger: this.logger,
|
|
159
157
|
tryNextLink: false,
|
|
160
158
|
});
|
|
@@ -162,19 +160,19 @@ class LoginCredentialsFetcher {
|
|
|
162
160
|
}
|
|
163
161
|
async saveToken(token) {
|
|
164
162
|
const tokenFilePath = this.getTokenFilePath();
|
|
165
|
-
const directory =
|
|
163
|
+
const directory = dirname(tokenFilePath);
|
|
166
164
|
try {
|
|
167
|
-
await
|
|
165
|
+
await promises.mkdir(directory, { recursive: true });
|
|
168
166
|
}
|
|
169
167
|
catch (error) {
|
|
170
168
|
}
|
|
171
|
-
await
|
|
169
|
+
await promises.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
|
|
172
170
|
}
|
|
173
171
|
getTokenFilePath() {
|
|
174
|
-
const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ??
|
|
172
|
+
const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join(homedir(), ".aws", "login", "cache");
|
|
175
173
|
const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
|
|
176
|
-
const loginSessionSha256 =
|
|
177
|
-
return
|
|
174
|
+
const loginSessionSha256 = createHash("sha256").update(loginSessionBytes).digest("hex");
|
|
175
|
+
return join(directory, `${loginSessionSha256}.json`);
|
|
178
176
|
}
|
|
179
177
|
derToRawSignature(derSignature) {
|
|
180
178
|
let offset = 2;
|
|
@@ -199,7 +197,7 @@ class LoginCredentialsFetcher {
|
|
|
199
197
|
}
|
|
200
198
|
createDPoPInterceptor(middlewareStack) {
|
|
201
199
|
middlewareStack.add((next) => async (args) => {
|
|
202
|
-
if (
|
|
200
|
+
if (HttpRequest.isInstance(args.request)) {
|
|
203
201
|
const request = args.request;
|
|
204
202
|
const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : ""}${request.path}`;
|
|
205
203
|
const dpop = await this.generateDpop(request.method, actualEndpoint);
|
|
@@ -218,12 +216,12 @@ class LoginCredentialsFetcher {
|
|
|
218
216
|
async generateDpop(method = "POST", endpoint) {
|
|
219
217
|
const token = await this.loadToken();
|
|
220
218
|
try {
|
|
221
|
-
const privateKey =
|
|
219
|
+
const privateKey = createPrivateKey({
|
|
222
220
|
key: token.dpopKey,
|
|
223
221
|
format: "pem",
|
|
224
222
|
type: "sec1",
|
|
225
223
|
});
|
|
226
|
-
const publicKey =
|
|
224
|
+
const publicKey = createPublicKey(privateKey);
|
|
227
225
|
const publicDer = publicKey.export({ format: "der", type: "spki" });
|
|
228
226
|
let pointStart = -1;
|
|
229
227
|
for (let i = 0; i < publicDer.length; i++) {
|
|
@@ -253,33 +251,33 @@ class LoginCredentialsFetcher {
|
|
|
253
251
|
const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
|
|
254
252
|
const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
|
|
255
253
|
const message = `${headerB64}.${payloadB64}`;
|
|
256
|
-
const asn1Signature =
|
|
254
|
+
const asn1Signature = sign("sha256", Buffer.from(message), privateKey);
|
|
257
255
|
const rawSignature = this.derToRawSignature(asn1Signature);
|
|
258
256
|
const signatureB64 = rawSignature.toString("base64url");
|
|
259
257
|
return `${message}.${signatureB64}`;
|
|
260
258
|
}
|
|
261
259
|
catch (error) {
|
|
262
|
-
throw new
|
|
260
|
+
throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
|
|
263
261
|
}
|
|
264
262
|
}
|
|
265
263
|
}
|
|
266
264
|
|
|
267
265
|
const fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
|
|
268
266
|
init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
|
|
269
|
-
const profiles = await
|
|
270
|
-
const profileName =
|
|
267
|
+
const profiles = await parseKnownFiles(init || {});
|
|
268
|
+
const profileName = getProfileName({
|
|
271
269
|
profile: init?.profile ?? callerClientConfig?.profile,
|
|
272
270
|
});
|
|
273
271
|
const profile = profiles[profileName];
|
|
274
272
|
if (!profile?.login_session) {
|
|
275
|
-
throw new
|
|
273
|
+
throw new CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
|
|
276
274
|
tryNextLink: true,
|
|
277
275
|
logger: init?.logger,
|
|
278
276
|
});
|
|
279
277
|
}
|
|
280
278
|
const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
|
|
281
279
|
const credentials = await fetcher.loadCredentials();
|
|
282
|
-
return
|
|
280
|
+
return setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
|
|
283
281
|
};
|
|
284
282
|
|
|
285
283
|
exports.fromLoginCredentials = fromLoginCredentials;
|
|
@@ -1,17 +1,17 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aws-sdk/credential-provider-login",
|
|
3
|
-
"version": "3.972.
|
|
3
|
+
"version": "3.972.53",
|
|
4
4
|
"description": "AWS credential provider that sources credentials from aws login cached tokens",
|
|
5
5
|
"main": "./dist-cjs/index.js",
|
|
6
6
|
"module": "./dist-es/index.js",
|
|
7
7
|
"scripts": {
|
|
8
8
|
"build": "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
|
|
9
9
|
"build:cjs": "node ../../scripts/compilation/inline",
|
|
10
|
-
"build:es": "tsc -p tsconfig.es.json",
|
|
10
|
+
"build:es": "premove dist-es && tsc -p tsconfig.es.json",
|
|
11
11
|
"build:include:deps": "yarn g:turbo run build -F=\"$npm_package_name\"",
|
|
12
|
-
"build:types": "tsc -p tsconfig.types.json",
|
|
12
|
+
"build:types": "premove dist-types && tsc -p tsconfig.types.json",
|
|
13
13
|
"build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
|
|
14
|
-
"clean": "premove dist-cjs dist-es dist-types
|
|
14
|
+
"clean": "premove dist-cjs dist-es dist-types",
|
|
15
15
|
"test": "yarn g:vitest run",
|
|
16
16
|
"test:watch": "yarn g:vitest watch"
|
|
17
17
|
},
|
|
@@ -28,9 +28,9 @@
|
|
|
28
28
|
},
|
|
29
29
|
"license": "Apache-2.0",
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@aws-sdk/core": "^3.974.
|
|
32
|
-
"@aws-sdk/nested-clients": "^3.997.
|
|
33
|
-
"@aws-sdk/types": "^3.973.
|
|
31
|
+
"@aws-sdk/core": "^3.974.21",
|
|
32
|
+
"@aws-sdk/nested-clients": "^3.997.21",
|
|
33
|
+
"@aws-sdk/types": "^3.973.13",
|
|
34
34
|
"@smithy/core": "^3.24.6",
|
|
35
35
|
"@smithy/types": "^4.14.3",
|
|
36
36
|
"tslib": "^2.6.2"
|
|
@@ -1,19 +1,17 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
var credentialProviderEnv = require('@aws-sdk/credential-provider-env');
|
|
4
|
-
var config = require('@smithy/core/config');
|
|
1
|
+
const { ENV_KEY, ENV_SECRET, fromEnv } = require("@aws-sdk/credential-provider-env");
|
|
2
|
+
const { chain, CredentialsProviderError, ENV_PROFILE } = require("@smithy/core/config");
|
|
5
3
|
|
|
6
4
|
const ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
|
|
7
5
|
const remoteProvider = async (init) => {
|
|
8
|
-
const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } =
|
|
6
|
+
const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = require('@smithy/credential-provider-imds');
|
|
9
7
|
if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
|
|
10
8
|
init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
|
|
11
|
-
const { fromHttp } =
|
|
12
|
-
return
|
|
9
|
+
const { fromHttp } = require('@aws-sdk/credential-provider-http');
|
|
10
|
+
return chain(fromHttp(init), fromContainerMetadata(init));
|
|
13
11
|
}
|
|
14
12
|
if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
|
|
15
13
|
return async () => {
|
|
16
|
-
throw new
|
|
14
|
+
throw new CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
|
|
17
15
|
};
|
|
18
16
|
}
|
|
19
17
|
init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
|
|
@@ -95,9 +93,9 @@ const internalCreateChain = (providers) => async (awsIdentityProperties) => {
|
|
|
95
93
|
let multipleCredentialSourceWarningEmitted = false;
|
|
96
94
|
const defaultProvider = (init = {}) => memoizeChain([
|
|
97
95
|
async () => {
|
|
98
|
-
const profile = init.profile ?? process.env[
|
|
96
|
+
const profile = init.profile ?? process.env[ENV_PROFILE];
|
|
99
97
|
if (profile) {
|
|
100
|
-
const envStaticCredentialsAreSet = process.env[
|
|
98
|
+
const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
|
|
101
99
|
if (envStaticCredentialsAreSet) {
|
|
102
100
|
if (!multipleCredentialSourceWarningEmitted) {
|
|
103
101
|
const warnFn = init.logger?.warn && init.logger?.constructor?.name !== "NoOpLogger"
|
|
@@ -115,36 +113,36 @@ const defaultProvider = (init = {}) => memoizeChain([
|
|
|
115
113
|
multipleCredentialSourceWarningEmitted = true;
|
|
116
114
|
}
|
|
117
115
|
}
|
|
118
|
-
throw new
|
|
116
|
+
throw new CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
|
|
119
117
|
logger: init.logger,
|
|
120
118
|
tryNextLink: true,
|
|
121
119
|
});
|
|
122
120
|
}
|
|
123
121
|
init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
|
|
124
|
-
return
|
|
122
|
+
return fromEnv(init)();
|
|
125
123
|
},
|
|
126
124
|
async (awsIdentityProperties) => {
|
|
127
125
|
init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
|
|
128
126
|
const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
|
|
129
127
|
if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
|
|
130
|
-
throw new
|
|
128
|
+
throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
|
|
131
129
|
}
|
|
132
|
-
const { fromSSO } =
|
|
130
|
+
const { fromSSO } = require('@aws-sdk/credential-provider-sso');
|
|
133
131
|
return fromSSO(init)(awsIdentityProperties);
|
|
134
132
|
},
|
|
135
133
|
async (awsIdentityProperties) => {
|
|
136
134
|
init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
|
|
137
|
-
const { fromIni } =
|
|
135
|
+
const { fromIni } = require('@aws-sdk/credential-provider-ini');
|
|
138
136
|
return fromIni(init)(awsIdentityProperties);
|
|
139
137
|
},
|
|
140
138
|
async (awsIdentityProperties) => {
|
|
141
139
|
init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
|
|
142
|
-
const { fromProcess } =
|
|
140
|
+
const { fromProcess } = require('@aws-sdk/credential-provider-process');
|
|
143
141
|
return fromProcess(init)(awsIdentityProperties);
|
|
144
142
|
},
|
|
145
143
|
async (awsIdentityProperties) => {
|
|
146
144
|
init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
|
|
147
|
-
const { fromTokenFile } =
|
|
145
|
+
const { fromTokenFile } = require('@aws-sdk/credential-provider-web-identity');
|
|
148
146
|
return fromTokenFile(init)(awsIdentityProperties);
|
|
149
147
|
},
|
|
150
148
|
async () => {
|
|
@@ -152,7 +150,7 @@ const defaultProvider = (init = {}) => memoizeChain([
|
|
|
152
150
|
return (await remoteProvider(init))();
|
|
153
151
|
},
|
|
154
152
|
async () => {
|
|
155
|
-
throw new
|
|
153
|
+
throw new CredentialsProviderError("Could not load credentials from any providers", {
|
|
156
154
|
tryNextLink: false,
|
|
157
155
|
logger: init.logger,
|
|
158
156
|
});
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aws-sdk/credential-provider-node",
|
|
3
|
-
"version": "3.972.
|
|
3
|
+
"version": "3.972.56",
|
|
4
4
|
"description": "AWS credential provider that sources credentials from a Node.JS environment. ",
|
|
5
5
|
"engines": {
|
|
6
6
|
"node": ">=20.0.0"
|
|
@@ -10,11 +10,11 @@
|
|
|
10
10
|
"scripts": {
|
|
11
11
|
"build": "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
|
|
12
12
|
"build:cjs": "node ../../scripts/compilation/inline",
|
|
13
|
-
"build:es": "tsc -p tsconfig.es.json",
|
|
13
|
+
"build:es": "premove dist-es && tsc -p tsconfig.es.json",
|
|
14
14
|
"build:include:deps": "yarn g:turbo run build -F=\"$npm_package_name\"",
|
|
15
|
-
"build:types": "tsc -p tsconfig.types.json",
|
|
15
|
+
"build:types": "premove dist-types && tsc -p tsconfig.types.json",
|
|
16
16
|
"build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
|
|
17
|
-
"clean": "premove dist-cjs dist-es dist-types
|
|
17
|
+
"clean": "premove dist-cjs dist-es dist-types",
|
|
18
18
|
"test": "yarn g:vitest run --reporter verbose",
|
|
19
19
|
"test:watch": "yarn g:vitest watch",
|
|
20
20
|
"test:integration": "yarn g:vitest run -c vitest.config.integ.mts",
|
|
@@ -31,13 +31,13 @@
|
|
|
31
31
|
},
|
|
32
32
|
"license": "Apache-2.0",
|
|
33
33
|
"dependencies": {
|
|
34
|
-
"@aws-sdk/credential-provider-env": "^3.972.
|
|
35
|
-
"@aws-sdk/credential-provider-http": "^3.972.
|
|
36
|
-
"@aws-sdk/credential-provider-ini": "^3.972.
|
|
37
|
-
"@aws-sdk/credential-provider-process": "^3.972.
|
|
38
|
-
"@aws-sdk/credential-provider-sso": "^3.972.
|
|
39
|
-
"@aws-sdk/credential-provider-web-identity": "^3.972.
|
|
40
|
-
"@aws-sdk/types": "^3.973.
|
|
34
|
+
"@aws-sdk/credential-provider-env": "^3.972.47",
|
|
35
|
+
"@aws-sdk/credential-provider-http": "^3.972.49",
|
|
36
|
+
"@aws-sdk/credential-provider-ini": "^3.972.54",
|
|
37
|
+
"@aws-sdk/credential-provider-process": "^3.972.47",
|
|
38
|
+
"@aws-sdk/credential-provider-sso": "^3.972.53",
|
|
39
|
+
"@aws-sdk/credential-provider-web-identity": "^3.972.53",
|
|
40
|
+
"@aws-sdk/types": "^3.973.13",
|
|
41
41
|
"@smithy/core": "^3.24.6",
|
|
42
42
|
"@smithy/credential-provider-imds": "^4.3.7",
|
|
43
43
|
"@smithy/types": "^4.14.3",
|
|
@@ -1,9 +1,7 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
var node_util = require('node:util');
|
|
6
|
-
var client = require('@aws-sdk/core/client');
|
|
1
|
+
const { externalDataInterceptor, CredentialsProviderError, parseKnownFiles, getProfileName } = require("@smithy/core/config");
|
|
2
|
+
const { exec } = require("node:child_process");
|
|
3
|
+
const { promisify } = require("node:util");
|
|
4
|
+
const { setCredentialFeature } = require("@aws-sdk/core/client");
|
|
7
5
|
|
|
8
6
|
const getValidatedProcessCredentials = (profileName, data, profiles) => {
|
|
9
7
|
if (data.Version !== 1) {
|
|
@@ -31,7 +29,7 @@ const getValidatedProcessCredentials = (profileName, data, profiles) => {
|
|
|
31
29
|
...(data.CredentialScope && { credentialScope: data.CredentialScope }),
|
|
32
30
|
...(accountId && { accountId }),
|
|
33
31
|
};
|
|
34
|
-
|
|
32
|
+
setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
|
|
35
33
|
return credentials;
|
|
36
34
|
};
|
|
37
35
|
|
|
@@ -40,7 +38,7 @@ const resolveProcessCredentials = async (profileName, profiles, logger) => {
|
|
|
40
38
|
if (profiles[profileName]) {
|
|
41
39
|
const credentialProcess = profile["credential_process"];
|
|
42
40
|
if (credentialProcess !== undefined) {
|
|
43
|
-
const execPromise =
|
|
41
|
+
const execPromise = promisify(externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
|
|
44
42
|
try {
|
|
45
43
|
const { stdout } = await execPromise(credentialProcess);
|
|
46
44
|
let data;
|
|
@@ -53,15 +51,15 @@ const resolveProcessCredentials = async (profileName, profiles, logger) => {
|
|
|
53
51
|
return getValidatedProcessCredentials(profileName, data, profiles);
|
|
54
52
|
}
|
|
55
53
|
catch (error) {
|
|
56
|
-
throw new
|
|
54
|
+
throw new CredentialsProviderError(error.message, { logger });
|
|
57
55
|
}
|
|
58
56
|
}
|
|
59
57
|
else {
|
|
60
|
-
throw new
|
|
58
|
+
throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
|
|
61
59
|
}
|
|
62
60
|
}
|
|
63
61
|
else {
|
|
64
|
-
throw new
|
|
62
|
+
throw new CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
|
|
65
63
|
logger,
|
|
66
64
|
});
|
|
67
65
|
}
|
|
@@ -69,8 +67,8 @@ const resolveProcessCredentials = async (profileName, profiles, logger) => {
|
|
|
69
67
|
|
|
70
68
|
const fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
|
|
71
69
|
init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
|
|
72
|
-
const profiles = await
|
|
73
|
-
return resolveProcessCredentials(
|
|
70
|
+
const profiles = await parseKnownFiles(init);
|
|
71
|
+
return resolveProcessCredentials(getProfileName({
|
|
74
72
|
profile: init.profile ?? callerClientConfig?.profile,
|
|
75
73
|
}), profiles, init.logger);
|
|
76
74
|
};
|
|
@@ -1,17 +1,17 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aws-sdk/credential-provider-process",
|
|
3
|
-
"version": "3.972.
|
|
3
|
+
"version": "3.972.47",
|
|
4
4
|
"description": "AWS credential provider that sources credential_process from ~/.aws/credentials and ~/.aws/config",
|
|
5
5
|
"main": "./dist-cjs/index.js",
|
|
6
6
|
"module": "./dist-es/index.js",
|
|
7
7
|
"scripts": {
|
|
8
8
|
"build": "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
|
|
9
9
|
"build:cjs": "node ../../scripts/compilation/inline",
|
|
10
|
-
"build:es": "tsc -p tsconfig.es.json",
|
|
10
|
+
"build:es": "premove dist-es && tsc -p tsconfig.es.json",
|
|
11
11
|
"build:include:deps": "yarn g:turbo run build -F=\"$npm_package_name\"",
|
|
12
|
-
"build:types": "tsc -p tsconfig.types.json",
|
|
12
|
+
"build:types": "premove dist-types && tsc -p tsconfig.types.json",
|
|
13
13
|
"build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
|
|
14
|
-
"clean": "premove dist-cjs dist-es dist-types
|
|
14
|
+
"clean": "premove dist-cjs dist-es dist-types",
|
|
15
15
|
"test": "yarn g:vitest run",
|
|
16
16
|
"test:watch": "yarn g:vitest watch"
|
|
17
17
|
},
|
|
@@ -26,8 +26,8 @@
|
|
|
26
26
|
},
|
|
27
27
|
"license": "Apache-2.0",
|
|
28
28
|
"dependencies": {
|
|
29
|
-
"@aws-sdk/core": "^3.974.
|
|
30
|
-
"@aws-sdk/types": "^3.973.
|
|
29
|
+
"@aws-sdk/core": "^3.974.21",
|
|
30
|
+
"@aws-sdk/types": "^3.973.13",
|
|
31
31
|
"@smithy/core": "^3.24.6",
|
|
32
32
|
"@smithy/types": "^4.14.3",
|
|
33
33
|
"tslib": "^2.6.2"
|
|
@@ -1,8 +1,6 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
var client = require('@aws-sdk/core/client');
|
|
5
|
-
var tokenProviders = require('@aws-sdk/token-providers');
|
|
1
|
+
const { CredentialsProviderError, getSSOTokenFromFile, getProfileName, parseKnownFiles, loadSsoSessionData } = require("@smithy/core/config");
|
|
2
|
+
const { setCredentialFeature } = require("@aws-sdk/core/client");
|
|
3
|
+
const { fromSso } = require("@aws-sdk/token-providers");
|
|
6
4
|
|
|
7
5
|
const isSsoProfile = (arg) => arg &&
|
|
8
6
|
(typeof arg.sso_start_url === "string" ||
|
|
@@ -17,7 +15,7 @@ const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ss
|
|
|
17
15
|
const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
|
|
18
16
|
if (ssoSession) {
|
|
19
17
|
try {
|
|
20
|
-
const _token = await
|
|
18
|
+
const _token = await fromSso({
|
|
21
19
|
profile,
|
|
22
20
|
filepath,
|
|
23
21
|
configFilepath,
|
|
@@ -32,7 +30,7 @@ const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ss
|
|
|
32
30
|
};
|
|
33
31
|
}
|
|
34
32
|
catch (e) {
|
|
35
|
-
throw new
|
|
33
|
+
throw new CredentialsProviderError(e.message, {
|
|
36
34
|
tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
|
|
37
35
|
logger,
|
|
38
36
|
});
|
|
@@ -40,23 +38,23 @@ const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ss
|
|
|
40
38
|
}
|
|
41
39
|
else {
|
|
42
40
|
try {
|
|
43
|
-
token = await
|
|
41
|
+
token = await getSSOTokenFromFile(ssoStartUrl);
|
|
44
42
|
}
|
|
45
43
|
catch (e) {
|
|
46
|
-
throw new
|
|
44
|
+
throw new CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
|
|
47
45
|
tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
|
|
48
46
|
logger,
|
|
49
47
|
});
|
|
50
48
|
}
|
|
51
49
|
}
|
|
52
50
|
if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
|
|
53
|
-
throw new
|
|
51
|
+
throw new CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
|
|
54
52
|
tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
|
|
55
53
|
logger,
|
|
56
54
|
});
|
|
57
55
|
}
|
|
58
56
|
const { accessToken } = token;
|
|
59
|
-
const { SSOClient, GetRoleCredentialsCommand } =
|
|
57
|
+
const { SSOClient, GetRoleCredentialsCommand } = require('./loadSso-BGYXHf8s.js');
|
|
60
58
|
const sso = ssoClient ||
|
|
61
59
|
new SSOClient(Object.assign({}, clientConfig ?? {}, {
|
|
62
60
|
logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,
|
|
@@ -72,14 +70,14 @@ const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ss
|
|
|
72
70
|
}));
|
|
73
71
|
}
|
|
74
72
|
catch (e) {
|
|
75
|
-
throw new
|
|
73
|
+
throw new CredentialsProviderError(e, {
|
|
76
74
|
tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
|
|
77
75
|
logger,
|
|
78
76
|
});
|
|
79
77
|
}
|
|
80
78
|
const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {}, } = ssoResp;
|
|
81
79
|
if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
|
|
82
|
-
throw new
|
|
80
|
+
throw new CredentialsProviderError("SSO returns an invalid temporary credential.", {
|
|
83
81
|
tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
|
|
84
82
|
logger,
|
|
85
83
|
});
|
|
@@ -93,10 +91,10 @@ const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ss
|
|
|
93
91
|
...(accountId && { accountId }),
|
|
94
92
|
};
|
|
95
93
|
if (ssoSession) {
|
|
96
|
-
|
|
94
|
+
setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
|
|
97
95
|
}
|
|
98
96
|
else {
|
|
99
|
-
|
|
97
|
+
setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
|
|
100
98
|
}
|
|
101
99
|
return credentials;
|
|
102
100
|
};
|
|
@@ -104,7 +102,7 @@ const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ss
|
|
|
104
102
|
const validateSsoProfile = (profile, logger) => {
|
|
105
103
|
const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
|
|
106
104
|
if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
|
|
107
|
-
throw new
|
|
105
|
+
throw new CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` +
|
|
108
106
|
`"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}\nReference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });
|
|
109
107
|
}
|
|
110
108
|
return profile;
|
|
@@ -114,32 +112,32 @@ const fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
|
|
|
114
112
|
init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
|
|
115
113
|
const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
|
|
116
114
|
const { ssoClient } = init;
|
|
117
|
-
const profileName =
|
|
115
|
+
const profileName = getProfileName({
|
|
118
116
|
profile: init.profile ?? callerClientConfig?.profile,
|
|
119
117
|
});
|
|
120
118
|
if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
|
|
121
|
-
const profiles = await
|
|
119
|
+
const profiles = await parseKnownFiles(init);
|
|
122
120
|
const profile = profiles[profileName];
|
|
123
121
|
if (!profile) {
|
|
124
|
-
throw new
|
|
122
|
+
throw new CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
|
|
125
123
|
}
|
|
126
124
|
if (!isSsoProfile(profile)) {
|
|
127
|
-
throw new
|
|
125
|
+
throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
|
|
128
126
|
logger: init.logger,
|
|
129
127
|
});
|
|
130
128
|
}
|
|
131
129
|
if (profile?.sso_session) {
|
|
132
|
-
const ssoSessions = await
|
|
130
|
+
const ssoSessions = await loadSsoSessionData(init);
|
|
133
131
|
const session = ssoSessions[profile.sso_session];
|
|
134
132
|
const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
|
|
135
133
|
if (ssoRegion && ssoRegion !== session.sso_region) {
|
|
136
|
-
throw new
|
|
134
|
+
throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
|
|
137
135
|
tryNextLink: false,
|
|
138
136
|
logger: init.logger,
|
|
139
137
|
});
|
|
140
138
|
}
|
|
141
139
|
if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
|
|
142
|
-
throw new
|
|
140
|
+
throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
|
|
143
141
|
tryNextLink: false,
|
|
144
142
|
logger: init.logger,
|
|
145
143
|
});
|
|
@@ -166,7 +164,7 @@ const fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
|
|
|
166
164
|
});
|
|
167
165
|
}
|
|
168
166
|
else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
|
|
169
|
-
throw new
|
|
167
|
+
throw new CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " +
|
|
170
168
|
'"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
|
|
171
169
|
}
|
|
172
170
|
else {
|