@jjrawlins/cdk-iam-policy-builder-helper 0.0.2 → 0.0.3

package/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js

@@ -1,14 +1,18 @@
+import { setCredentialFeature } from "@aws-sdk/core/client";
 export const isStaticCredsProfile = (arg) => Boolean(arg) &&
     typeof arg === "object" &&
     typeof arg.aws_access_key_id === "string" &&
     typeof arg.aws_secret_access_key === "string" &&
-    ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1;
-export const resolveStaticCredentials = (profile, options) => {
-    options?.logger?.debug("@aws-sdk/credential-provider-ini", "resolveStaticCredentials");
-    return Promise.resolve({
+    ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 &&
+    ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1;
+export const resolveStaticCredentials = async (profile, options) => {
+    options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
+    const credentials = {
         accessKeyId: profile.aws_access_key_id,
         secretAccessKey: profile.aws_secret_access_key,
         sessionToken: profile.aws_session_token,
-        credentialScope: profile.aws_credential_scope,
-    });
+        ...(profile.aws_credential_scope && { credentialScope: profile.aws_credential_scope }),
+        ...(profile.aws_account_id && { accountId: profile.aws_account_id }),
+    };
+    return setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
 };

package/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js

@@ -1,3 +1,4 @@
+import { setCredentialFeature } from "@aws-sdk/core/client";
 export const isWebIdentityProfile = (arg) => Boolean(arg) &&
     typeof arg === "object" &&
     typeof arg.web_identity_token_file === "string" &&
@@ -10,4 +11,4 @@ export const resolveWebIdentityCredentials = async (profile, options) => import(
     roleAssumerWithWebIdentity: options.roleAssumerWithWebIdentity,
     logger: options.logger,
     parentClientConfig: options.parentClientConfig,
-})());
+})().then((creds) => setCredentialFeature(creds, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q")));

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/fromIni.d.ts

@@ -1,7 +1,8 @@
 import type { AssumeRoleWithWebIdentityParams } from "@aws-sdk/credential-provider-web-identity";
 import type { CredentialProviderOptions } from "@aws-sdk/types";
+import type { RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
 import { SourceProfileInit } from "@smithy/shared-ini-file-loader";
-import type { AwsCredentialIdentity, AwsCredentialIdentityProvider, Pluggable } from "@smithy/types";
+import type { AwsCredentialIdentity, Pluggable } from "@smithy/types";
 import { AssumeRoleParams } from "./resolveAssumeRoleCredentials";
 /**
  * @public
@@ -33,11 +34,17 @@ export interface FromIniInit extends SourceProfileInit, CredentialProviderOption
      */
     roleAssumerWithWebIdentity?: (params: AssumeRoleWithWebIdentityParams) => Promise<AwsCredentialIdentity>;
     /**
-     * STSClientConfig to be used for creating STS Client for assuming role.
+     * STSClientConfig or SSOClientConfig to be used for creating inner client
+     * for auth operations.
      * @internal
      */
     clientConfig?: any;
     clientPlugins?: Pluggable<any, any>[];
+    /**
+     * When true, always reload credentials from the file system instead of using cached values.
+     * This is useful when you need to detect changes to the credentials file.
+     */
+    ignoreCache?: boolean;
 }
 /**
  * @internal
@@ -45,4 +52,4 @@ export interface FromIniInit extends SourceProfileInit, CredentialProviderOption
  * Creates a credential provider that will read from ini files and supports
  * role assumption and multi-factor authentication.
  */
-export declare const fromIni: (init?: FromIniInit) => AwsCredentialIdentityProvider;
+export declare const fromIni: (_init?: FromIniInit) => RuntimeConfigAwsCredentialIdentityProvider;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveAssumeRoleCredentials.d.ts

@@ -1,4 +1,4 @@
-import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import { Logger, ParsedIniData } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
 /**
  * @internal
@@ -37,8 +37,11 @@ export interface AssumeRoleParams {
 /**
  * @internal
  */
-export declare const isAssumeRoleProfile: (arg: any) => boolean;
+export declare const isAssumeRoleProfile: (arg: any, { profile, logger }?: {
+    profile?: string | undefined;
+    logger?: Logger | undefined;
+}) => boolean;
 /**
  * @internal
  */
-export declare const resolveAssumeRoleCredentials: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>) => Promise<AwsCredentialIdentity>;
+export declare const resolveAssumeRoleCredentials: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveCredentialSource.d.ts

@@ -1,5 +1,5 @@
 import type { CredentialProviderOptions } from "@aws-sdk/types";
-import { AwsCredentialIdentityProvider } from "@smithy/types";
+import { AwsCredentialIdentityProvider, Logger } from "@smithy/types";
 /**
  * @internal
  *
@@ -9,4 +9,4 @@ import { AwsCredentialIdentityProvider } from "@smithy/types";
  * fromIni() provider. The source credential needs to be refreshed every time
  * fromIni() is called.
  */
-export declare const resolveCredentialSource: (credentialSource: string, profileName: string) => (options?: CredentialProviderOptions) => Promise<AwsCredentialIdentityProvider>;
+export declare const resolveCredentialSource: (credentialSource: string, profileName: string, logger?: Logger) => (options?: CredentialProviderOptions) => Promise<AwsCredentialIdentityProvider>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveProfileData.d.ts

@@ -3,4 +3,4 @@ import { FromIniInit } from "./fromIni";
 /**
  * @internal
  */
-export declare const resolveProfileData: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>) => Promise<AwsCredentialIdentity>;
+export declare const resolveProfileData: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>, isAssumeRoleRecursiveCall?: boolean) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveSsoCredentials.d.ts

@@ -1,10 +1,10 @@
 import type { SsoProfile } from "@aws-sdk/credential-provider-sso";
-import type { CredentialProviderOptions } from "@aws-sdk/types";
-import type { Profile } from "@smithy/types";
+import type { IniSection, Profile } from "@smithy/types";
+import type { FromIniInit } from "./fromIni";
 /**
  * @internal
  */
-export declare const resolveSsoCredentials: (profile: string, options?: CredentialProviderOptions) => Promise<import("@aws-sdk/types").AwsCredentialIdentity>;
+export declare const resolveSsoCredentials: (profile: string, profileData: IniSection, options?: FromIniInit) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;
 /**
  * @internal
  * duplicated from \@aws-sdk/credential-provider-sso to defer import.

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveStaticCredentials.d.ts

@@ -8,6 +8,7 @@ export interface StaticCredsProfile extends Profile {
     aws_secret_access_key: string;
     aws_session_token?: string;
     aws_credential_scope?: string;
+    aws_account_id?: string;
 }
 /**
  * @internal

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/fromIni.d.ts

@@ -1,11 +1,8 @@
 import { AssumeRoleWithWebIdentityParams } from "@aws-sdk/credential-provider-web-identity";
 import { CredentialProviderOptions } from "@aws-sdk/types";
+import { RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
 import { SourceProfileInit } from "@smithy/shared-ini-file-loader";
-import {
-  AwsCredentialIdentity,
-  AwsCredentialIdentityProvider,
-  Pluggable,
-} from "@smithy/types";
+import { AwsCredentialIdentity, Pluggable } from "@smithy/types";
 import { AssumeRoleParams } from "./resolveAssumeRoleCredentials";
 export interface FromIniInit
   extends SourceProfileInit,
@@ -20,7 +17,8 @@ export interface FromIniInit
   ) => Promise<AwsCredentialIdentity>;
   clientConfig?: any;
   clientPlugins?: Pluggable<any, any>[];
+  ignoreCache?: boolean;
 }
 export declare const fromIni: (
-  init?: FromIniInit
-) => AwsCredentialIdentityProvider;
+  _init?: FromIniInit
+) => RuntimeConfigAwsCredentialIdentityProvider;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveAssumeRoleCredentials.d.ts

@@ -1,4 +1,4 @@
-import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import { Logger, ParsedIniData } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
 export interface AssumeRoleParams {
   RoleArn: string;
@@ -8,10 +8,19 @@ export interface AssumeRoleParams {
   TokenCode?: string;
   DurationSeconds?: number;
 }
-export declare const isAssumeRoleProfile: (arg: any) => boolean;
+export declare const isAssumeRoleProfile: (
+  arg: any,
+  {
+    profile,
+    logger,
+  }?: {
+    profile?: string | undefined;
+    logger?: Logger | undefined;
+  }
+) => boolean;
 export declare const resolveAssumeRoleCredentials: (
   profileName: string,
   profiles: ParsedIniData,
   options: FromIniInit,
   visitedProfiles?: Record<string, true>
-) => Promise<AwsCredentialIdentity>;
+) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveCredentialSource.d.ts

@@ -1,8 +1,9 @@
 import { CredentialProviderOptions } from "@aws-sdk/types";
-import { AwsCredentialIdentityProvider } from "@smithy/types";
+import { AwsCredentialIdentityProvider, Logger } from "@smithy/types";
 export declare const resolveCredentialSource: (
   credentialSource: string,
-  profileName: string
+  profileName: string,
+  logger?: Logger
 ) => (
   options?: CredentialProviderOptions
 ) => Promise<AwsCredentialIdentityProvider>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveProfileData.d.ts

@@ -4,5 +4,6 @@ export declare const resolveProfileData: (
   profileName: string,
   profiles: ParsedIniData,
   options: FromIniInit,
-  visitedProfiles?: Record<string, true>
+  visitedProfiles?: Record<string, true>,
+  isAssumeRoleRecursiveCall?: boolean
 ) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveSsoCredentials.d.ts

@@ -1,8 +1,9 @@
 import { SsoProfile } from "@aws-sdk/credential-provider-sso";
-import { CredentialProviderOptions } from "@aws-sdk/types";
-import { Profile } from "@smithy/types";
+import { IniSection, Profile } from "@smithy/types";
+import { FromIniInit } from "./fromIni";
 export declare const resolveSsoCredentials: (
   profile: string,
-  options?: CredentialProviderOptions
-) => Promise<import("@aws-sdk/types").AwsCredentialIdentity>;
+  profileData: IniSection,
+  options?: FromIniInit
+) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;
 export declare const isSsoProfile: (arg: Profile) => arg is Partial<SsoProfile>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveStaticCredentials.d.ts

@@ -5,6 +5,7 @@ export interface StaticCredsProfile extends Profile {
   aws_secret_access_key: string;
   aws_session_token?: string;
   aws_credential_scope?: string;
+  aws_account_id?: string;
 }
 export declare const isStaticCredsProfile: (
   arg: any

package/node_modules/@aws-sdk/credential-provider-ini/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-ini",
-  "version": "3.565.0",
+  "version": "3.758.0",
   "description": "AWS credential provider that sources credentials from ~/.aws/credentials and ~/.aws/config",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -12,7 +12,10 @@
     "build:types": "tsc -p tsconfig.types.json",
     "build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
     "clean": "rimraf ./dist-* && rimraf *.tsbuildinfo",
-    "test": "jest"
+    "test": "yarn g:vitest run",
+    "test:watch": "yarn g:vitest watch",
+    "test:integration": "yarn g:vitest run -c vitest.config.integ.ts",
+    "test:integration:watch": "yarn g:vitest watch -c vitest.config.integ.ts"
   },
   "keywords": [
     "aws",
@@ -24,31 +27,31 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/credential-provider-env": "3.535.0",
-    "@aws-sdk/credential-provider-process": "3.535.0",
-    "@aws-sdk/credential-provider-sso": "3.565.0",
-    "@aws-sdk/credential-provider-web-identity": "3.565.0",
-    "@aws-sdk/types": "3.535.0",
-    "@smithy/credential-provider-imds": "^2.3.0",
-    "@smithy/property-provider": "^2.2.0",
-    "@smithy/shared-ini-file-loader": "^2.4.0",
-    "@smithy/types": "^2.12.0",
+    "@aws-sdk/core": "3.758.0",
+    "@aws-sdk/credential-provider-env": "3.758.0",
+    "@aws-sdk/credential-provider-http": "3.758.0",
+    "@aws-sdk/credential-provider-process": "3.758.0",
+    "@aws-sdk/credential-provider-sso": "3.758.0",
+    "@aws-sdk/credential-provider-web-identity": "3.758.0",
+    "@aws-sdk/nested-clients": "3.758.0",
+    "@aws-sdk/types": "3.734.0",
+    "@smithy/credential-provider-imds": "^4.0.1",
+    "@smithy/property-provider": "^4.0.1",
+    "@smithy/shared-ini-file-loader": "^4.0.1",
+    "@smithy/types": "^4.1.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {
     "@tsconfig/recommended": "1.0.1",
-    "@types/node": "^14.14.31",
+    "@types/node": "^18.19.69",
     "concurrently": "7.0.0",
     "downlevel-dts": "0.10.1",
     "rimraf": "3.0.2",
-    "typescript": "~4.9.5"
-  },
-  "peerDependencies": {
-    "@aws-sdk/client-sts": "^3.565.0"
+    "typescript": "~5.2.2"
   },
   "types": "./dist-types/index.d.ts",
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18.0.0"
   },
   "typesVersions": {
     "<4.0": {

package/node_modules/@aws-sdk/credential-provider-node/README.md

@@ -5,9 +5,9 @@
 
 ## AWS Credential Provider for Node.JS
 
-This module provides a factory function, `fromEnv`, that will attempt to source
-AWS credentials from a Node.JS environment. It will attempt to find credentials
-from the following sources (listed in order of precedence):
+This module provides a factory function, `defaultProvider`, that will attempt to
+source AWS credentials from a Node.JS environment. It will attempt to find
+credentials from the following sources (listed in order of precedence):
 
 - Environment variables exposed via `process.env`
 - SSO credentials from token cache

package/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js

@@ -1,3 +1,4 @@
+"use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -45,76 +46,97 @@ var import_shared_ini_file_loader = require("@smithy/shared-ini-file-loader");
 var import_property_provider = require("@smithy/property-provider");
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = /* @__PURE__ */ __name(async (init) => {
-  var _a, _b;
   const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await Promise.resolve().then(() => __toESM(require("@smithy/credential-provider-imds")));
   if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
-    (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node", "remoteProvider::fromHttp/fromContainerMetadata");
+    init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
     const { fromHttp } = await Promise.resolve().then(() => __toESM(require("@aws-sdk/credential-provider-http")));
     return (0, import_property_provider.chain)(fromHttp(init), fromContainerMetadata(init));
   }
-  if (process.env[ENV_IMDS_DISABLED]) {
+  if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
     return async () => {
-      throw new import_property_provider.CredentialsProviderError("EC2 Instance Metadata Service access disabled");
+      throw new import_property_provider.CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
     };
   }
-  (_b = init.logger) == null ? void 0 : _b.debug("@aws-sdk/credential-provider-node", "remoteProvider::fromInstanceMetadata");
+  init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
   return fromInstanceMetadata(init);
 }, "remoteProvider");
 
 // src/defaultProvider.ts
+var multipleCredentialSourceWarningEmitted = false;
 var defaultProvider = /* @__PURE__ */ __name((init = {}) => (0, import_property_provider.memoize)(
   (0, import_property_provider.chain)(
-    ...init.profile || process.env[import_shared_ini_file_loader.ENV_PROFILE] ? [] : [
-      async () => {
-        var _a;
-        (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromEnv");
-        return (0, import_credential_provider_env.fromEnv)(init)();
+    async () => {
+      const profile = init.profile ?? process.env[import_shared_ini_file_loader.ENV_PROFILE];
+      if (profile) {
+        const envStaticCredentialsAreSet = process.env[import_credential_provider_env.ENV_KEY] && process.env[import_credential_provider_env.ENV_SECRET];
+        if (envStaticCredentialsAreSet) {
+          if (!multipleCredentialSourceWarningEmitted) {
+            const warnFn = init.logger?.warn && init.logger?.constructor?.name !== "NoOpLogger" ? init.logger.warn : console.warn;
+            warnFn(
+              `@aws-sdk/credential-provider-node - defaultProvider::fromEnv WARNING:
+    Multiple credential sources detected: 
+    Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
+    This SDK will proceed with the AWS_PROFILE value.
+    
+    However, a future version may change this behavior to prefer the ENV static credentials.
+    Please ensure that your environment only sets either the AWS_PROFILE or the
+    AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.
+`
+            );
+            multipleCredentialSourceWarningEmitted = true;
+          }
+        }
+        throw new import_property_provider.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+          logger: init.logger,
+          tryNextLink: true
+        });
       }
-    ],
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
+      return (0, import_credential_provider_env.fromEnv)(init)();
+    },
     async () => {
-      var _a;
-      (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromSSO");
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
       const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
       if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
         throw new import_property_provider.CredentialsProviderError(
-          "Skipping SSO provider in default chain (inputs do not include SSO fields)."
+          "Skipping SSO provider in default chain (inputs do not include SSO fields).",
+          { logger: init.logger }
         );
       }
       const { fromSSO } = await Promise.resolve().then(() => __toESM(require("@aws-sdk/credential-provider-sso")));
       return fromSSO(init)();
     },
     async () => {
-      var _a;
-      (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromIni");
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
       const { fromIni } = await Promise.resolve().then(() => __toESM(require("@aws-sdk/credential-provider-ini")));
       return fromIni(init)();
     },
     async () => {
-      var _a;
-      (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromProcess");
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
       const { fromProcess } = await Promise.resolve().then(() => __toESM(require("@aws-sdk/credential-provider-process")));
       return fromProcess(init)();
     },
     async () => {
-      var _a;
-      (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromTokenFile");
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
       const { fromTokenFile } = await Promise.resolve().then(() => __toESM(require("@aws-sdk/credential-provider-web-identity")));
       return fromTokenFile(init)();
     },
     async () => {
-      var _a;
-      (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node", "defaultProvider::remoteProvider");
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::remoteProvider");
       return (await remoteProvider(init))();
     },
     async () => {
-      throw new import_property_provider.CredentialsProviderError("Could not load credentials from any providers", false);
+      throw new import_property_provider.CredentialsProviderError("Could not load credentials from any providers", {
+        tryNextLink: false,
+        logger: init.logger
+      });
     }
   ),
   credentialsTreatedAsExpired,
   credentialsWillNeedRefresh
 ), "defaultProvider");
-var credentialsWillNeedRefresh = /* @__PURE__ */ __name((credentials) => (credentials == null ? void 0 : credentials.expiration) !== void 0, "credentialsWillNeedRefresh");
-var credentialsTreatedAsExpired = /* @__PURE__ */ __name((credentials) => (credentials == null ? void 0 : credentials.expiration) !== void 0 && credentials.expiration.getTime() - Date.now() < 3e5, "credentialsTreatedAsExpired");
+var credentialsWillNeedRefresh = /* @__PURE__ */ __name((credentials) => credentials?.expiration !== void 0, "credentialsWillNeedRefresh");
+var credentialsTreatedAsExpired = /* @__PURE__ */ __name((credentials) => credentials?.expiration !== void 0 && credentials.expiration.getTime() - Date.now() < 3e5, "credentialsTreatedAsExpired");
 // Annotate the CommonJS export names for ESM import in node:
 
 0 && (module.exports = {

package/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js

@@ -1,39 +1,62 @@
-import { fromEnv } from "@aws-sdk/credential-provider-env";
+import { ENV_KEY, ENV_SECRET, fromEnv } from "@aws-sdk/credential-provider-env";
 import { chain, CredentialsProviderError, memoize } from "@smithy/property-provider";
 import { ENV_PROFILE } from "@smithy/shared-ini-file-loader";
 import { remoteProvider } from "./remoteProvider";
-export const defaultProvider = (init = {}) => memoize(chain(...(init.profile || process.env[ENV_PROFILE]
-    ? []
-    : [
-        async () => {
-            init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromEnv");
-            return fromEnv(init)();
-        },
-    ]), async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromSSO");
+let multipleCredentialSourceWarningEmitted = false;
+export const defaultProvider = (init = {}) => memoize(chain(async () => {
+    const profile = init.profile ?? process.env[ENV_PROFILE];
+    if (profile) {
+        const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
+        if (envStaticCredentialsAreSet) {
+            if (!multipleCredentialSourceWarningEmitted) {
+                const warnFn = init.logger?.warn && init.logger?.constructor?.name !== "NoOpLogger" ? init.logger.warn : console.warn;
+                warnFn(`@aws-sdk/credential-provider-node - defaultProvider::fromEnv WARNING:
+    Multiple credential sources detected: 
+    Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
+    This SDK will proceed with the AWS_PROFILE value.
+    
+    However, a future version may change this behavior to prefer the ENV static credentials.
+    Please ensure that your environment only sets either the AWS_PROFILE or the
+    AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.
+`);
+                multipleCredentialSourceWarningEmitted = true;
+            }
+        }
+        throw new CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+            logger: init.logger,
+            tryNextLink: true,
+        });
+    }
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
+    return fromEnv(init)();
+}, async () => {
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
     const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-        throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).");
+        throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
     const { fromSSO } = await import("@aws-sdk/credential-provider-sso");
     return fromSSO(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromIni");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
     const { fromIni } = await import("@aws-sdk/credential-provider-ini");
     return fromIni(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromProcess");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
     const { fromProcess } = await import("@aws-sdk/credential-provider-process");
     return fromProcess(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromTokenFile");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
     const { fromTokenFile } = await import("@aws-sdk/credential-provider-web-identity");
     return fromTokenFile(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::remoteProvider");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::remoteProvider");
     return (await remoteProvider(init))();
 }, async () => {
-    throw new CredentialsProviderError("Could not load credentials from any providers", false);
+    throw new CredentialsProviderError("Could not load credentials from any providers", {
+        tryNextLink: false,
+        logger: init.logger,
+    });
 }), credentialsTreatedAsExpired, credentialsWillNeedRefresh);
 export const credentialsWillNeedRefresh = (credentials) => credentials?.expiration !== undefined;
 export const credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;

package/node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js

@@ -3,15 +3,15 @@ export const ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 export const remoteProvider = async (init) => {
     const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("@smithy/credential-provider-imds");
     if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
-        init.logger?.debug("@aws-sdk/credential-provider-node", "remoteProvider::fromHttp/fromContainerMetadata");
+        init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
         const { fromHttp } = await import("@aws-sdk/credential-provider-http");
         return chain(fromHttp(init), fromContainerMetadata(init));
     }
-    if (process.env[ENV_IMDS_DISABLED]) {
+    if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
         return async () => {
-            throw new CredentialsProviderError("EC2 Instance Metadata Service access disabled");
+            throw new CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
         };
     }
-    init.logger?.debug("@aws-sdk/credential-provider-node", "remoteProvider::fromInstanceMetadata");
+    init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
     return fromInstanceMetadata(init);
 };

package/node_modules/@aws-sdk/credential-provider-node/dist-types/defaultProvider.d.ts

@@ -1,3 +1,4 @@
+import type { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import type { FromIniInit } from "@aws-sdk/credential-provider-ini";
 import type { FromProcessInit } from "@aws-sdk/credential-provider-process";
 import type { FromSSOInit, SsoCredentialsParameters } from "@aws-sdk/credential-provider-sso";
@@ -7,7 +8,7 @@ import { AwsCredentialIdentity, MemoizedProvider } from "@smithy/types";
 /**
  * @public
  */
-export type DefaultProviderInit = FromIniInit & RemoteProviderInit & FromProcessInit & (FromSSOInit & Partial<SsoCredentialsParameters>) & FromTokenFileInit;
+export type DefaultProviderInit = FromIniInit & FromHttpOptions & RemoteProviderInit & FromProcessInit & (FromSSOInit & Partial<SsoCredentialsParameters>) & FromTokenFileInit;
 /**
  * Creates a credential provider that will attempt to find credentials from the
  * following sources (listed in order of precedence):

package/node_modules/@aws-sdk/credential-provider-node/dist-types/remoteProvider.d.ts

@@ -1,3 +1,4 @@
+import type { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import type { RemoteProviderInit } from "@smithy/credential-provider-imds";
 import type { AwsCredentialIdentityProvider } from "@smithy/types";
 /**
@@ -7,4 +8,4 @@ export declare const ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 /**
  * @internal
  */
-export declare const remoteProvider: (init: RemoteProviderInit) => Promise<AwsCredentialIdentityProvider>;
+export declare const remoteProvider: (init: RemoteProviderInit | FromHttpOptions) => Promise<AwsCredentialIdentityProvider>;

package/node_modules/@aws-sdk/credential-provider-node/dist-types/ts3.4/defaultProvider.d.ts

@@ -1,3 +1,4 @@
+import { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import { FromIniInit } from "@aws-sdk/credential-provider-ini";
 import { FromProcessInit } from "@aws-sdk/credential-provider-process";
 import {
@@ -8,6 +9,7 @@ import { FromTokenFileInit } from "@aws-sdk/credential-provider-web-identity";
 import { RemoteProviderInit } from "@smithy/credential-provider-imds";
 import { AwsCredentialIdentity, MemoizedProvider } from "@smithy/types";
 export type DefaultProviderInit = FromIniInit &
+  FromHttpOptions &
   RemoteProviderInit &
   FromProcessInit &
   (FromSSOInit & Partial<SsoCredentialsParameters>) &

package/node_modules/@aws-sdk/credential-provider-node/dist-types/ts3.4/remoteProvider.d.ts

@@ -1,6 +1,7 @@
+import { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import { RemoteProviderInit } from "@smithy/credential-provider-imds";
 import { AwsCredentialIdentityProvider } from "@smithy/types";
 export declare const ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 export declare const remoteProvider: (
-  init: RemoteProviderInit
+  init: RemoteProviderInit | FromHttpOptions
 ) => Promise<AwsCredentialIdentityProvider>;