@cdklabs/cdk-ssm-documents 0.0.71 → 0.0.73

package/node_modules/@aws-sdk/client-ssm/dist-types/ts3.4/runtimeConfig.browser.d.ts

@@ -71,6 +71,7 @@ export declare const getRuntimeConfig: (config: SSMClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -90,4 +91,5 @@ export declare const getRuntimeConfig: (config: SSMClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-ssm/dist-types/ts3.4/runtimeConfig.d.ts

@@ -72,6 +72,7 @@ export declare const getRuntimeConfig: (config: SSMClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
   httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SSMHttpAuthSchemeProvider;
@@ -90,4 +91,5 @@ export declare const getRuntimeConfig: (config: SSMClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-ssm/dist-types/ts3.4/runtimeConfig.native.d.ts

@@ -75,6 +75,7 @@ export declare const getRuntimeConfig: (config: SSMClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -94,4 +95,5 @@ export declare const getRuntimeConfig: (config: SSMClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-ssm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/client-ssm",
-  "version": "3.1090.0",
+  "version": "3.1101.0",
   "description": "AWS SDK for JavaScript Ssm Client for Node.js, Browser and React Native",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-ssm",
   "license": "Apache-2.0",
@@ -48,12 +48,12 @@
     "test:index": "tsc --noEmit ./test/index-types.ts && node ./test/index-objects.spec.mjs"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.975.3",
-    "@aws-sdk/credential-provider-node": "^3.972.70",
+    "@aws-sdk/core": "^3.977.4",
+    "@aws-sdk/credential-provider-node": "^3.972.76",
     "@aws-sdk/types": "^3.974.2",
-    "@smithy/core": "^3.29.4",
-    "@smithy/fetch-http-handler": "^5.6.6",
-    "@smithy/node-http-handler": "^4.9.6",
+    "@smithy/core": "^3.31.1",
+    "@smithy/fetch-http-handler": "^5.6.13",
+    "@smithy/node-http-handler": "^4.9.13",
     "@smithy/types": "^4.16.1",
     "tslib": "^2.6.2"
   },

package/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js

@@ -1,21 +1,27 @@
-const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");
-const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");
-const { ProviderError } = require("@smithy/core/config");
+const { ProviderError, booleanSelector, SelectorType, loadConfig } = require("@smithy/core/config");
 const { setCredentialFeature } = require("@aws-sdk/core/client");
+const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");
 const { SignatureV4 } = require("@smithy/signature-v4");
+const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");
 
 const getDateHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.date ?? response.headers?.Date) : undefined;
+const getAgeHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.age ?? response.headers?.Age) : undefined;
 
 const getSkewCorrectedDate = (systemClockOffset) => new Date(Date.now() + systemClockOffset);
 
-const isClockSkewed = (clockTime, systemClockOffset) => Math.abs(getSkewCorrectedDate(systemClockOffset).getTime() - clockTime) >= 300000;
-
-const getUpdatedSystemClockOffset = (clockTime, currentSystemClockOffset) => {
-    const clockTimeInMs = Date.parse(clockTime);
-    if (isClockSkewed(clockTimeInMs, currentSystemClockOffset)) {
-        return clockTimeInMs - Date.now();
+const getUpdatedSystemClockOffset = (clockTime, currentSystemClockOffset, timeRequestSent, ageHeader) => {
+    if (ageHeader !== undefined) {
+        return currentSystemClockOffset;
+    }
+    const serverTime = Date.parse(clockTime);
+    const timeResponseReceived = Date.now();
+    if (timeRequestSent !== undefined && timeResponseReceived - timeRequestSent > 900_000) {
+        return currentSystemClockOffset;
     }
-    return currentSystemClockOffset;
+    const candidateSkew = timeRequestSent !== undefined
+        ? serverTime - (timeRequestSent + timeResponseReceived) / 2
+        : serverTime - timeResponseReceived;
+    return candidateSkew;
 };
 
 const throwSigningPropertyError = (name, property) => {
@@ -57,9 +63,14 @@ class AwsSdkSigV4Signer {
                 signingName = second?.signingName ?? signingName;
             }
         }
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: signingRegion,
             signingService: signingName,
         });
@@ -68,27 +79,36 @@ class AwsSdkSigV4Signer {
     errorHandler(signingProperties) {
         return (error) => {
             const errorException = error;
-            const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
-            if (serverTime) {
-                const config = throwSigningPropertyError("config", signingProperties.config);
-                const preRequestOffset = signingProperties._preRequestSystemClockOffset;
-                const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset);
-                const isLocalCorrection = newOffset !== config.systemClockOffset;
-                const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
-                const clockSkewCorrected = isLocalCorrection || isConcurrentCorrection;
-                if (clockSkewCorrected && errorException.$metadata) {
+            if (!signingProperties._disableClockSkewCorrection) {
+                const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
+                if (serverTime) {
+                    const config = throwSigningPropertyError("config", signingProperties.config);
+                    const preRequestOffset = signingProperties._preRequestSystemClockOffset;
+                    const timeRequestSent = signingProperties._requestSentAt;
+                    const ageHeader = getAgeHeader(errorException.$response);
+                    const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset, timeRequestSent, ageHeader);
                     config.systemClockOffset = newOffset;
-                    errorException.$metadata.clockSkewCorrected = true;
+                    const skewExceedsThreshold = Math.abs(newOffset) >= 240_000;
+                    const isLocalCorrection = newOffset !== preRequestOffset;
+                    const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
+                    if (skewExceedsThreshold && (isLocalCorrection || isConcurrentCorrection) && errorException.$metadata) {
+                        errorException.$metadata.clockSkewCorrected = true;
+                    }
                 }
             }
             throw error;
         };
     }
     successHandler(httpResponse, signingProperties) {
+        if (signingProperties._disableClockSkewCorrection) {
+            return;
+        }
         const dateHeader = getDateHeader(httpResponse);
         if (dateHeader) {
             const config = throwSigningPropertyError("config", signingProperties.config);
-            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset);
+            const timeRequestSent = signingProperties._requestSentAt;
+            const ageHeader = getAgeHeader(httpResponse);
+            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset, timeRequestSent, ageHeader);
         }
     }
 }
@@ -103,9 +123,14 @@ class AwsSdkSigV4ASigner extends AwsSdkSigV4Signer {
         const configResolvedSigningRegionSet = await config.sigv4aSigningRegionSet?.();
         const multiRegionOverride = (configResolvedSigningRegionSet ??
             signingRegionSet ?? [signingRegion]).join(",");
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: multiRegionOverride,
             signingService: signingName,
         });
@@ -162,7 +187,7 @@ const NODE_SIGV4A_CONFIG_OPTIONS = {
     default: undefined,
 };
 
-const resolveAwsSdkSigV4Config = (config) => {
+const bindResolveAwsSdkSigV4Config = (defaultDisableClockSkewCorrection) => (config) => {
     let inputCredentials = config.credentials;
     let isUserSupplied = !!config.credentials;
     let resolvedCredentials = undefined;
@@ -260,11 +285,11 @@ const resolveAwsSdkSigV4Config = (config) => {
         systemClockOffset,
         signingEscapePath,
         signer,
+        disableClockSkewCorrection: normalizeProvider(config.disableClockSkewCorrection ?? defaultDisableClockSkewCorrection),
     });
     return resolvedConfig;
 };
-const resolveAWSSDKSigV4Config = resolveAwsSdkSigV4Config;
-function normalizeCredentialProvider(config, { credentials, credentialDefaultProvider, }) {
+function normalizeCredentialProvider(config, { credentials, credentialDefaultProvider }) {
     let credentialsProvider;
     if (credentials) {
         if (!credentials?.memoized) {
@@ -299,6 +324,19 @@ function bindCallerConfig(config, credentialsProvider) {
     return fn;
 }
 
+const ENV_DISABLE_CLOCK_SKEW_CORRECTION = "AWS_DISABLE_CLOCK_SKEW_CORRECTION";
+const CONFIG_DISABLE_CLOCK_SKEW_CORRECTION = "disable_clock_skew_correction";
+const NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS = {
+    environmentVariableSelector: (env) => booleanSelector(env, ENV_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.ENV),
+    configFileSelector: (profile) => booleanSelector(profile, CONFIG_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.CONFIG),
+    default: false,
+};
+
+const DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION = loadConfig(NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS);
+
+const resolveAwsSdkSigV4Config = bindResolveAwsSdkSigV4Config(DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION);
+const resolveAWSSDKSigV4Config = resolveAwsSdkSigV4Config;
+
 exports.AWSSDKSigV4Signer = AWSSDKSigV4Signer;
 exports.AwsSdkSigV4ASigner = AwsSdkSigV4ASigner;
 exports.AwsSdkSigV4Signer = AwsSdkSigV4Signer;