@jjrawlins/cdk-iam-policy-builder-helper 0.0.2 → 0.0.3

package/node_modules/@aws-sdk/credential-provider-node/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@aws-sdk/credential-provider-node",
-  "version": "3.565.0",
+  "version": "3.758.0",
   "description": "AWS credential provider that sources credentials from a Node.JS environment. ",
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18.0.0"
   },
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -15,8 +15,9 @@
     "build:types": "tsc -p tsconfig.types.json",
     "build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
     "clean": "rimraf ./dist-* && rimraf *.tsbuildinfo",
-    "test": "jest",
-    "test:integration": "jest -c jest.config.integ.js"
+    "test": "yarn g:vitest run",
+    "test:integration": "yarn g:jest -c jest.config.integ.js",
+    "test:watch": "yarn g:vitest watch"
   },
   "keywords": [
     "aws",
@@ -28,26 +29,26 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/credential-provider-env": "3.535.0",
-    "@aws-sdk/credential-provider-http": "3.552.0",
-    "@aws-sdk/credential-provider-ini": "3.565.0",
-    "@aws-sdk/credential-provider-process": "3.535.0",
-    "@aws-sdk/credential-provider-sso": "3.565.0",
-    "@aws-sdk/credential-provider-web-identity": "3.565.0",
-    "@aws-sdk/types": "3.535.0",
-    "@smithy/credential-provider-imds": "^2.3.0",
-    "@smithy/property-provider": "^2.2.0",
-    "@smithy/shared-ini-file-loader": "^2.4.0",
-    "@smithy/types": "^2.12.0",
+    "@aws-sdk/credential-provider-env": "3.758.0",
+    "@aws-sdk/credential-provider-http": "3.758.0",
+    "@aws-sdk/credential-provider-ini": "3.758.0",
+    "@aws-sdk/credential-provider-process": "3.758.0",
+    "@aws-sdk/credential-provider-sso": "3.758.0",
+    "@aws-sdk/credential-provider-web-identity": "3.758.0",
+    "@aws-sdk/types": "3.734.0",
+    "@smithy/credential-provider-imds": "^4.0.1",
+    "@smithy/property-provider": "^4.0.1",
+    "@smithy/shared-ini-file-loader": "^4.0.1",
+    "@smithy/types": "^4.1.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {
     "@tsconfig/recommended": "1.0.1",
-    "@types/node": "^14.14.31",
+    "@types/node": "^18.19.69",
     "concurrently": "7.0.0",
     "downlevel-dts": "0.10.1",
     "rimraf": "3.0.2",
-    "typescript": "~4.9.5"
+    "typescript": "~5.2.2"
   },
   "types": "./dist-types/index.d.ts",
   "typesVersions": {

package/node_modules/@aws-sdk/credential-provider-process/dist-cjs/index.js

@@ -1,3 +1,4 @@
+"use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -33,7 +34,8 @@ var import_child_process = require("child_process");
 var import_util = require("util");
 
 // src/getValidatedProcessCredentials.ts
-var getValidatedProcessCredentials = /* @__PURE__ */ __name((profileName, data) => {
+var import_client = require("@aws-sdk/core/client");
+var getValidatedProcessCredentials = /* @__PURE__ */ __name((profileName, data, profiles) => {
   if (data.Version !== 1) {
     throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
   }
@@ -47,17 +49,24 @@ var getValidatedProcessCredentials = /* @__PURE__ */ __name((profileName, data)
       throw Error(`Profile ${profileName} credential_process returned expired credentials.`);
     }
   }
-  return {
+  let accountId = data.AccountId;
+  if (!accountId && profiles?.[profileName]?.aws_account_id) {
+    accountId = profiles[profileName].aws_account_id;
+  }
+  const credentials = {
     accessKeyId: data.AccessKeyId,
     secretAccessKey: data.SecretAccessKey,
     ...data.SessionToken && { sessionToken: data.SessionToken },
     ...data.Expiration && { expiration: new Date(data.Expiration) },
-    ...data.CredentialScope && { credentialScope: data.CredentialScope }
+    ...data.CredentialScope && { credentialScope: data.CredentialScope },
+    ...accountId && { accountId }
   };
+  (0, import_client.setCredentialFeature)(credentials, "CREDENTIALS_PROCESS", "w");
+  return credentials;
 }, "getValidatedProcessCredentials");
 
 // src/resolveProcessCredentials.ts
-var resolveProcessCredentials = /* @__PURE__ */ __name(async (profileName, profiles) => {
+var resolveProcessCredentials = /* @__PURE__ */ __name(async (profileName, profiles, logger) => {
   const profile = profiles[profileName];
   if (profiles[profileName]) {
     const credentialProcess = profile["credential_process"];
@@ -71,24 +80,31 @@ var resolveProcessCredentials = /* @__PURE__ */ __name(async (profileName, profi
         } catch {
           throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
         }
-        return getValidatedProcessCredentials(profileName, data);
+        return getValidatedProcessCredentials(profileName, data, profiles);
       } catch (error) {
-        throw new import_property_provider.CredentialsProviderError(error.message);
+        throw new import_property_provider.CredentialsProviderError(error.message, { logger });
       }
     } else {
-      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`);
+      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
     }
   } else {
-    throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`);
+    throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+      logger
+    });
   }
 }, "resolveProcessCredentials");
 
 // src/fromProcess.ts
-var fromProcess = /* @__PURE__ */ __name((init = {}) => async () => {
-  var _a;
-  (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-process", "fromProcess");
+var fromProcess = /* @__PURE__ */ __name((init = {}) => async ({ callerClientConfig } = {}) => {
+  init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
   const profiles = await (0, import_shared_ini_file_loader.parseKnownFiles)(init);
-  return resolveProcessCredentials((0, import_shared_ini_file_loader.getProfileName)(init), profiles);
+  return resolveProcessCredentials(
+    (0, import_shared_ini_file_loader.getProfileName)({
+      profile: init.profile ?? callerClientConfig?.profile
+    }),
+    profiles,
+    init.logger
+  );
 }, "fromProcess");
 // Annotate the CommonJS export names for ESM import in node:
 

package/node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js

@@ -1,7 +1,9 @@
 import { getProfileName, parseKnownFiles } from "@smithy/shared-ini-file-loader";
 import { resolveProcessCredentials } from "./resolveProcessCredentials";
-export const fromProcess = (init = {}) => async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-process", "fromProcess");
+export const fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
+    init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
     const profiles = await parseKnownFiles(init);
-    return resolveProcessCredentials(getProfileName(init), profiles);
+    return resolveProcessCredentials(getProfileName({
+        profile: init.profile ?? callerClientConfig?.profile,
+    }), profiles, init.logger);
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js

@@ -1,4 +1,5 @@
-export const getValidatedProcessCredentials = (profileName, data) => {
+import { setCredentialFeature } from "@aws-sdk/core/client";
+export const getValidatedProcessCredentials = (profileName, data, profiles) => {
     if (data.Version !== 1) {
         throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
     }
@@ -12,11 +13,18 @@ export const getValidatedProcessCredentials = (profileName, data) => {
             throw Error(`Profile ${profileName} credential_process returned expired credentials.`);
         }
     }
-    return {
+    let accountId = data.AccountId;
+    if (!accountId && profiles?.[profileName]?.aws_account_id) {
+        accountId = profiles[profileName].aws_account_id;
+    }
+    const credentials = {
         accessKeyId: data.AccessKeyId,
         secretAccessKey: data.SecretAccessKey,
         ...(data.SessionToken && { sessionToken: data.SessionToken }),
         ...(data.Expiration && { expiration: new Date(data.Expiration) }),
         ...(data.CredentialScope && { credentialScope: data.CredentialScope }),
+        ...(accountId && { accountId }),
     };
+    setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+    return credentials;
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js

@@ -2,7 +2,7 @@ import { CredentialsProviderError } from "@smithy/property-provider";
 import { exec } from "child_process";
 import { promisify } from "util";
 import { getValidatedProcessCredentials } from "./getValidatedProcessCredentials";
-export const resolveProcessCredentials = async (profileName, profiles) => {
+export const resolveProcessCredentials = async (profileName, profiles, logger) => {
     const profile = profiles[profileName];
     if (profiles[profileName]) {
         const credentialProcess = profile["credential_process"];
@@ -17,17 +17,19 @@ export const resolveProcessCredentials = async (profileName, profiles) => {
                 catch {
                     throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
                 }
-                return getValidatedProcessCredentials(profileName, data);
+                return getValidatedProcessCredentials(profileName, data, profiles);
             }
             catch (error) {
-                throw new CredentialsProviderError(error.message);
+                throw new CredentialsProviderError(error.message, { logger });
             }
         }
         else {
-            throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`);
+            throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
         }
     }
     else {
-        throw new CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`);
+        throw new CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+            logger,
+        });
     }
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ProcessCredentials.d.ts

@@ -8,4 +8,5 @@ export type ProcessCredentials = {
     SessionToken?: string;
     Expiration?: number;
     CredentialScope?: string;
+    AccountId?: string;
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-types/fromProcess.d.ts

@@ -1,6 +1,5 @@
-import type { CredentialProviderOptions } from "@aws-sdk/types";
+import type { CredentialProviderOptions, RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
 import { SourceProfileInit } from "@smithy/shared-ini-file-loader";
-import { AwsCredentialIdentityProvider } from "@smithy/types";
 /**
  * @internal
  */
@@ -12,4 +11,4 @@ export interface FromProcessInit extends SourceProfileInit, CredentialProviderOp
  * Creates a credential provider that will read from a credential_process specified
  * in ini files.
  */
-export declare const fromProcess: (init?: FromProcessInit) => AwsCredentialIdentityProvider;
+export declare const fromProcess: (init?: FromProcessInit) => RuntimeConfigAwsCredentialIdentityProvider;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/getValidatedProcessCredentials.d.ts

@@ -1,6 +1,6 @@
-import { AwsCredentialIdentity } from "@smithy/types";
+import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
 import { ProcessCredentials } from "./ProcessCredentials";
 /**
  * @internal
  */
-export declare const getValidatedProcessCredentials: (profileName: string, data: ProcessCredentials) => AwsCredentialIdentity;
+export declare const getValidatedProcessCredentials: (profileName: string, data: ProcessCredentials, profiles: ParsedIniData) => AwsCredentialIdentity;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/resolveProcessCredentials.d.ts

@@ -1,5 +1,5 @@
-import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import { AwsCredentialIdentity, Logger, ParsedIniData } from "@smithy/types";
 /**
  * @internal
  */
-export declare const resolveProcessCredentials: (profileName: string, profiles: ParsedIniData) => Promise<AwsCredentialIdentity>;
+export declare const resolveProcessCredentials: (profileName: string, profiles: ParsedIniData, logger?: Logger) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ts3.4/ProcessCredentials.d.ts

@@ -5,4 +5,5 @@ export type ProcessCredentials = {
   SessionToken?: string;
   Expiration?: number;
   CredentialScope?: string;
+  AccountId?: string;
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ts3.4/fromProcess.d.ts

@@ -1,9 +1,11 @@
-import { CredentialProviderOptions } from "@aws-sdk/types";
+import {
+  CredentialProviderOptions,
+  RuntimeConfigAwsCredentialIdentityProvider,
+} from "@aws-sdk/types";
 import { SourceProfileInit } from "@smithy/shared-ini-file-loader";
-import { AwsCredentialIdentityProvider } from "@smithy/types";
 export interface FromProcessInit
   extends SourceProfileInit,
     CredentialProviderOptions {}
 export declare const fromProcess: (
   init?: FromProcessInit
-) => AwsCredentialIdentityProvider;
+) => RuntimeConfigAwsCredentialIdentityProvider;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ts3.4/getValidatedProcessCredentials.d.ts

@@ -1,6 +1,7 @@
-import { AwsCredentialIdentity } from "@smithy/types";
+import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
 import { ProcessCredentials } from "./ProcessCredentials";
 export declare const getValidatedProcessCredentials: (
   profileName: string,
-  data: ProcessCredentials
+  data: ProcessCredentials,
+  profiles: ParsedIniData
 ) => AwsCredentialIdentity;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ts3.4/resolveProcessCredentials.d.ts

@@ -1,5 +1,6 @@
-import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import { AwsCredentialIdentity, Logger, ParsedIniData } from "@smithy/types";
 export declare const resolveProcessCredentials: (
   profileName: string,
-  profiles: ParsedIniData
+  profiles: ParsedIniData,
+  logger?: Logger
 ) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-process/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-process",
-  "version": "3.535.0",
+  "version": "3.758.0",
   "description": "AWS credential provider that sources credential_process from ~/.aws/credentials and ~/.aws/config",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -12,7 +12,8 @@
     "build:types": "tsc -p tsconfig.types.json",
     "build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
     "clean": "rimraf ./dist-* && rimraf *.tsbuildinfo",
-    "test": "jest"
+    "test": "yarn g:vitest run",
+    "test:watch": "yarn g:vitest watch"
   },
   "keywords": [
     "aws",
@@ -24,23 +25,24 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/types": "3.535.0",
-    "@smithy/property-provider": "^2.2.0",
-    "@smithy/shared-ini-file-loader": "^2.4.0",
-    "@smithy/types": "^2.12.0",
+    "@aws-sdk/core": "3.758.0",
+    "@aws-sdk/types": "3.734.0",
+    "@smithy/property-provider": "^4.0.1",
+    "@smithy/shared-ini-file-loader": "^4.0.1",
+    "@smithy/types": "^4.1.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {
     "@tsconfig/recommended": "1.0.1",
-    "@types/node": "^14.14.31",
+    "@types/node": "^18.19.69",
     "concurrently": "7.0.0",
     "downlevel-dts": "0.10.1",
     "rimraf": "3.0.2",
-    "typescript": "~4.9.5"
+    "typescript": "~5.2.2"
   },
   "types": "./dist-types/index.d.ts",
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18.0.0"
   },
   "typesVersions": {
     "<4.0": {

package/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/index.js

@@ -1,3 +1,4 @@
+"use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -29,6 +30,7 @@ __export(loadSso_exports, {
 var import_client_sso;
 var init_loadSso = __esm({
   "src/loadSso.ts"() {
+    "use strict";
     import_client_sso = require("@aws-sdk/client-sso");
   }
 });
@@ -50,6 +52,7 @@ module.exports = __toCommonJS(src_exports);
 var isSsoProfile = /* @__PURE__ */ __name((arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string"), "isSsoProfile");
 
 // src/resolveSSOCredentials.ts
+var import_client = require("@aws-sdk/core/client");
 var import_token_providers = require("@aws-sdk/token-providers");
 var import_property_provider = require("@smithy/property-provider");
 var import_shared_ini_file_loader = require("@smithy/shared-ini-file-loader");
@@ -62,7 +65,9 @@ var resolveSSOCredentials = /* @__PURE__ */ __name(async ({
   ssoRoleName,
   ssoClient,
   clientConfig,
-  profile
+  parentClientConfig,
+  profile,
+  logger
 }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
@@ -74,29 +79,33 @@ var resolveSSOCredentials = /* @__PURE__ */ __name(async ({
         expiresAt: new Date(_token.expiration).toISOString()
       };
     } catch (e) {
-      throw new import_property_provider.CredentialsProviderError(e.message, SHOULD_FAIL_CREDENTIAL_CHAIN);
+      throw new import_property_provider.CredentialsProviderError(e.message, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
     }
   } else {
     try {
       token = await (0, import_shared_ini_file_loader.getSSOTokenFromFile)(ssoStartUrl);
     } catch (e) {
-      throw new import_property_provider.CredentialsProviderError(
-        `The SSO session associated with this profile is invalid. ${refreshMessage}`,
-        SHOULD_FAIL_CREDENTIAL_CHAIN
-      );
+      throw new import_property_provider.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
     }
   }
   if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
-    throw new import_property_provider.CredentialsProviderError(
-      `The SSO session associated with this profile has expired. ${refreshMessage}`,
-      SHOULD_FAIL_CREDENTIAL_CHAIN
-    );
+    throw new import_property_provider.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
   }
   const { accessToken } = token;
   const { SSOClient: SSOClient2, GetRoleCredentialsCommand: GetRoleCredentialsCommand2 } = await Promise.resolve().then(() => (init_loadSso(), loadSso_exports));
   const sso = ssoClient || new SSOClient2(
     Object.assign({}, clientConfig ?? {}, {
-      region: (clientConfig == null ? void 0 : clientConfig.region) ?? ssoRegion
+      logger: clientConfig?.logger ?? parentClientConfig?.logger,
+      region: clientConfig?.region ?? ssoRegion
     })
   );
   let ssoResp;
@@ -109,18 +118,39 @@ var resolveSSOCredentials = /* @__PURE__ */ __name(async ({
       })
     );
   } catch (e) {
-    throw import_property_provider.CredentialsProviderError.from(e, SHOULD_FAIL_CREDENTIAL_CHAIN);
+    throw new import_property_provider.CredentialsProviderError(e, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
   }
-  const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope } = {} } = ssoResp;
+  const {
+    roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {}
+  } = ssoResp;
   if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
-    throw new import_property_provider.CredentialsProviderError("SSO returns an invalid temporary credential.", SHOULD_FAIL_CREDENTIAL_CHAIN);
+    throw new import_property_provider.CredentialsProviderError("SSO returns an invalid temporary credential.", {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
   }
-  return { accessKeyId, secretAccessKey, sessionToken, expiration: new Date(expiration), credentialScope };
+  const credentials = {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken,
+    expiration: new Date(expiration),
+    ...credentialScope && { credentialScope },
+    ...accountId && { accountId }
+  };
+  if (ssoSession) {
+    (0, import_client.setCredentialFeature)(credentials, "CREDENTIALS_SSO", "s");
+  } else {
+    (0, import_client.setCredentialFeature)(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+  }
+  return credentials;
 }, "resolveSSOCredentials");
 
 // src/validateSsoProfile.ts
 
-var validateSsoProfile = /* @__PURE__ */ __name((profile) => {
+var validateSsoProfile = /* @__PURE__ */ __name((profile, logger) => {
   const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
   if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
     throw new import_property_provider.CredentialsProviderError(
@@ -128,42 +158,54 @@ var validateSsoProfile = /* @__PURE__ */ __name((profile) => {
         ", "
       )}
 Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,
-      false
+      { tryNextLink: false, logger }
     );
   }
   return profile;
 }, "validateSsoProfile");
 
 // src/fromSSO.ts
-var fromSSO = /* @__PURE__ */ __name((init = {}) => async () => {
-  var _a;
-  (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-sso", "fromSSO");
+var fromSSO = /* @__PURE__ */ __name((init = {}) => async ({ callerClientConfig } = {}) => {
+  init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
   const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
   const { ssoClient } = init;
-  const profileName = (0, import_shared_ini_file_loader.getProfileName)(init);
+  const profileName = (0, import_shared_ini_file_loader.getProfileName)({
+    profile: init.profile ?? callerClientConfig?.profile
+  });
   if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
     const profiles = await (0, import_shared_ini_file_loader.parseKnownFiles)(init);
     const profile = profiles[profileName];
     if (!profile) {
-      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} was not found.`);
+      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
     }
     if (!isSsoProfile(profile)) {
-      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`);
+      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+        logger: init.logger
+      });
     }
-    if (profile == null ? void 0 : profile.sso_session) {
+    if (profile?.sso_session) {
       const ssoSessions = await (0, import_shared_ini_file_loader.loadSsoSessionData)(init);
       const session = ssoSessions[profile.sso_session];
       const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
       if (ssoRegion && ssoRegion !== session.sso_region) {
-        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, false);
+        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
       }
       if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
-        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, false);
+        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
       }
       profile.sso_region = session.sso_region;
       profile.sso_start_url = session.sso_start_url;
     }
-    const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile);
+    const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(
+      profile,
+      init.logger
+    );
     return resolveSSOCredentials({
       ssoStartUrl: sso_start_url,
       ssoSession: sso_session,
@@ -172,11 +214,13 @@ var fromSSO = /* @__PURE__ */ __name((init = {}) => async () => {
       ssoRoleName: sso_role_name,
       ssoClient,
       clientConfig: init.clientConfig,
+      parentClientConfig: init.parentClientConfig,
       profile: profileName
     });
   } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
     throw new import_property_provider.CredentialsProviderError(
-      'Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"'
+      'Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"',
+      { tryNextLink: false, logger: init.logger }
     );
   } else {
     return resolveSSOCredentials({
@@ -187,6 +231,7 @@ var fromSSO = /* @__PURE__ */ __name((init = {}) => async () => {
       ssoRoleName,
       ssoClient,
       clientConfig: init.clientConfig,
+      parentClientConfig: init.parentClientConfig,
       profile: profileName
     });
   }

package/node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js

@@ -3,34 +3,44 @@ import { getProfileName, loadSsoSessionData, parseKnownFiles } from "@smithy/sha
 import { isSsoProfile } from "./isSsoProfile";
 import { resolveSSOCredentials } from "./resolveSSOCredentials";
 import { validateSsoProfile } from "./validateSsoProfile";
-export const fromSSO = (init = {}) => async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-sso", "fromSSO");
+export const fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
+    init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
     const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
     const { ssoClient } = init;
-    const profileName = getProfileName(init);
+    const profileName = getProfileName({
+        profile: init.profile ?? callerClientConfig?.profile,
+    });
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
         const profiles = await parseKnownFiles(init);
         const profile = profiles[profileName];
         if (!profile) {
-            throw new CredentialsProviderError(`Profile ${profileName} was not found.`);
+            throw new CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
         }
         if (!isSsoProfile(profile)) {
-            throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`);
+            throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+                logger: init.logger,
+            });
         }
         if (profile?.sso_session) {
             const ssoSessions = await loadSsoSessionData(init);
             const session = ssoSessions[profile.sso_session];
             const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
             if (ssoRegion && ssoRegion !== session.sso_region) {
-                throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, false);
+                throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+                    tryNextLink: false,
+                    logger: init.logger,
+                });
             }
             if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
-                throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, false);
+                throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+                    tryNextLink: false,
+                    logger: init.logger,
+                });
             }
             profile.sso_region = session.sso_region;
             profile.sso_start_url = session.sso_start_url;
         }
-        const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile);
+        const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);
         return resolveSSOCredentials({
             ssoStartUrl: sso_start_url,
             ssoSession: sso_session,
@@ -39,12 +49,13 @@ export const fromSSO = (init = {}) => async () => {
             ssoRoleName: sso_role_name,
             ssoClient: ssoClient,
             clientConfig: init.clientConfig,
+            parentClientConfig: init.parentClientConfig,
             profile: profileName,
         });
     }
     else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
         throw new CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " +
-            '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"');
+            '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
     }
     else {
         return resolveSSOCredentials({
@@ -55,6 +66,7 @@ export const fromSSO = (init = {}) => async () => {
             ssoRoleName,
             ssoClient,
             clientConfig: init.clientConfig,
+            parentClientConfig: init.parentClientConfig,
             profile: profileName,
         });
     }