@rio-cloud/cdk-v2-constructs 6.3.0 → 6.3.2

package/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js

@@ -1,39 +1,62 @@
-import { fromEnv } from "@aws-sdk/credential-provider-env";
+import { ENV_KEY, ENV_SECRET, fromEnv } from "@aws-sdk/credential-provider-env";
 import { chain, CredentialsProviderError, memoize } from "@smithy/property-provider";
 import { ENV_PROFILE } from "@smithy/shared-ini-file-loader";
 import { remoteProvider } from "./remoteProvider";
-export const defaultProvider = (init = {}) => memoize(chain(...(init.profile || process.env[ENV_PROFILE]
-    ? []
-    : [
-        async () => {
-            init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromEnv");
-            return fromEnv(init)();
-        },
-    ]), async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromSSO");
+let multipleCredentialSourceWarningEmitted = false;
+export const defaultProvider = (init = {}) => memoize(chain(async () => {
+    const profile = init.profile ?? process.env[ENV_PROFILE];
+    if (profile) {
+        const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
+        if (envStaticCredentialsAreSet) {
+            if (!multipleCredentialSourceWarningEmitted) {
+                const warnFn = init.logger?.warn && init.logger?.constructor?.name !== "NoOpLogger" ? init.logger.warn : console.warn;
+                warnFn(`@aws-sdk/credential-provider-node - defaultProvider::fromEnv WARNING:
+    Multiple credential sources detected: 
+    Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
+    This SDK will proceed with the AWS_PROFILE value.
+    
+    However, a future version may change this behavior to prefer the ENV static credentials.
+    Please ensure that your environment only sets either the AWS_PROFILE or the
+    AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.
+`);
+                multipleCredentialSourceWarningEmitted = true;
+            }
+        }
+        throw new CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+            logger: init.logger,
+            tryNextLink: true,
+        });
+    }
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
+    return fromEnv(init)();
+}, async () => {
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
     const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-        throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).");
+        throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
     const { fromSSO } = await import("@aws-sdk/credential-provider-sso");
     return fromSSO(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromIni");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
     const { fromIni } = await import("@aws-sdk/credential-provider-ini");
     return fromIni(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromProcess");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
     const { fromProcess } = await import("@aws-sdk/credential-provider-process");
     return fromProcess(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::fromTokenFile");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
     const { fromTokenFile } = await import("@aws-sdk/credential-provider-web-identity");
     return fromTokenFile(init)();
 }, async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-node", "defaultProvider::remoteProvider");
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::remoteProvider");
     return (await remoteProvider(init))();
 }, async () => {
-    throw new CredentialsProviderError("Could not load credentials from any providers", false);
+    throw new CredentialsProviderError("Could not load credentials from any providers", {
+        tryNextLink: false,
+        logger: init.logger,
+    });
 }), credentialsTreatedAsExpired, credentialsWillNeedRefresh);
 export const credentialsWillNeedRefresh = (credentials) => credentials?.expiration !== undefined;
 export const credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;

package/node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js

@@ -3,15 +3,15 @@ export const ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 export const remoteProvider = async (init) => {
     const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("@smithy/credential-provider-imds");
     if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
-        init.logger?.debug("@aws-sdk/credential-provider-node", "remoteProvider::fromHttp/fromContainerMetadata");
+        init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
         const { fromHttp } = await import("@aws-sdk/credential-provider-http");
         return chain(fromHttp(init), fromContainerMetadata(init));
     }
     if (process.env[ENV_IMDS_DISABLED]) {
         return async () => {
-            throw new CredentialsProviderError("EC2 Instance Metadata Service access disabled");
+            throw new CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
         };
     }
-    init.logger?.debug("@aws-sdk/credential-provider-node", "remoteProvider::fromInstanceMetadata");
+    init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
     return fromInstanceMetadata(init);
 };

package/node_modules/@aws-sdk/credential-provider-node/dist-types/defaultProvider.d.ts

@@ -1,3 +1,4 @@
+import type { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import type { FromIniInit } from "@aws-sdk/credential-provider-ini";
 import type { FromProcessInit } from "@aws-sdk/credential-provider-process";
 import type { FromSSOInit, SsoCredentialsParameters } from "@aws-sdk/credential-provider-sso";
@@ -7,7 +8,7 @@ import { AwsCredentialIdentity, MemoizedProvider } from "@smithy/types";
 /**
  * @public
  */
-export type DefaultProviderInit = FromIniInit & RemoteProviderInit & FromProcessInit & (FromSSOInit & Partial<SsoCredentialsParameters>) & FromTokenFileInit;
+export type DefaultProviderInit = FromIniInit & FromHttpOptions & RemoteProviderInit & FromProcessInit & (FromSSOInit & Partial<SsoCredentialsParameters>) & FromTokenFileInit;
 /**
  * Creates a credential provider that will attempt to find credentials from the
  * following sources (listed in order of precedence):

package/node_modules/@aws-sdk/credential-provider-node/dist-types/remoteProvider.d.ts

@@ -1,3 +1,4 @@
+import type { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import type { RemoteProviderInit } from "@smithy/credential-provider-imds";
 import type { AwsCredentialIdentityProvider } from "@smithy/types";
 /**
@@ -7,4 +8,4 @@ export declare const ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 /**
  * @internal
  */
-export declare const remoteProvider: (init: RemoteProviderInit) => Promise<AwsCredentialIdentityProvider>;
+export declare const remoteProvider: (init: RemoteProviderInit | FromHttpOptions) => Promise<AwsCredentialIdentityProvider>;

package/node_modules/@aws-sdk/credential-provider-node/dist-types/ts3.4/defaultProvider.d.ts

@@ -1,3 +1,4 @@
+import { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import { FromIniInit } from "@aws-sdk/credential-provider-ini";
 import { FromProcessInit } from "@aws-sdk/credential-provider-process";
 import {
@@ -8,6 +9,7 @@ import { FromTokenFileInit } from "@aws-sdk/credential-provider-web-identity";
 import { RemoteProviderInit } from "@smithy/credential-provider-imds";
 import { AwsCredentialIdentity, MemoizedProvider } from "@smithy/types";
 export type DefaultProviderInit = FromIniInit &
+  FromHttpOptions &
   RemoteProviderInit &
   FromProcessInit &
   (FromSSOInit & Partial<SsoCredentialsParameters>) &

package/node_modules/@aws-sdk/credential-provider-node/dist-types/ts3.4/remoteProvider.d.ts

@@ -1,6 +1,7 @@
+import { FromHttpOptions } from "@aws-sdk/credential-provider-http";
 import { RemoteProviderInit } from "@smithy/credential-provider-imds";
 import { AwsCredentialIdentityProvider } from "@smithy/types";
 export declare const ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 export declare const remoteProvider: (
-  init: RemoteProviderInit
+  init: RemoteProviderInit | FromHttpOptions
 ) => Promise<AwsCredentialIdentityProvider>;

package/node_modules/@aws-sdk/credential-provider-node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-node",
-  "version": "3.577.0",
+  "version": "3.621.0",
   "description": "AWS credential provider that sources credentials from a Node.JS environment. ",
   "engines": {
     "node": ">=16.0.0"
@@ -28,17 +28,17 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/credential-provider-env": "3.577.0",
-    "@aws-sdk/credential-provider-http": "3.577.0",
-    "@aws-sdk/credential-provider-ini": "3.577.0",
-    "@aws-sdk/credential-provider-process": "3.577.0",
-    "@aws-sdk/credential-provider-sso": "3.577.0",
-    "@aws-sdk/credential-provider-web-identity": "3.577.0",
-    "@aws-sdk/types": "3.577.0",
-    "@smithy/credential-provider-imds": "^3.0.0",
-    "@smithy/property-provider": "^3.0.0",
-    "@smithy/shared-ini-file-loader": "^3.0.0",
-    "@smithy/types": "^3.0.0",
+    "@aws-sdk/credential-provider-env": "3.620.1",
+    "@aws-sdk/credential-provider-http": "3.621.0",
+    "@aws-sdk/credential-provider-ini": "3.621.0",
+    "@aws-sdk/credential-provider-process": "3.620.1",
+    "@aws-sdk/credential-provider-sso": "3.621.0",
+    "@aws-sdk/credential-provider-web-identity": "3.621.0",
+    "@aws-sdk/types": "3.609.0",
+    "@smithy/credential-provider-imds": "^3.2.0",
+    "@smithy/property-provider": "^3.1.3",
+    "@smithy/shared-ini-file-loader": "^3.1.4",
+    "@smithy/types": "^3.3.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

package/node_modules/@aws-sdk/credential-provider-process/dist-cjs/index.js

@@ -34,7 +34,8 @@ var import_child_process = require("child_process");
 var import_util = require("util");
 
 // src/getValidatedProcessCredentials.ts
-var getValidatedProcessCredentials = /* @__PURE__ */ __name((profileName, data) => {
+var getValidatedProcessCredentials = /* @__PURE__ */ __name((profileName, data, profiles) => {
+  var _a;
   if (data.Version !== 1) {
     throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
   }
@@ -48,17 +49,22 @@ var getValidatedProcessCredentials = /* @__PURE__ */ __name((profileName, data)
       throw Error(`Profile ${profileName} credential_process returned expired credentials.`);
     }
   }
+  let accountId = data.AccountId;
+  if (!accountId && ((_a = profiles == null ? void 0 : profiles[profileName]) == null ? void 0 : _a.aws_account_id)) {
+    accountId = profiles[profileName].aws_account_id;
+  }
   return {
     accessKeyId: data.AccessKeyId,
     secretAccessKey: data.SecretAccessKey,
     ...data.SessionToken && { sessionToken: data.SessionToken },
     ...data.Expiration && { expiration: new Date(data.Expiration) },
-    ...data.CredentialScope && { credentialScope: data.CredentialScope }
+    ...data.CredentialScope && { credentialScope: data.CredentialScope },
+    ...accountId && { accountId }
   };
 }, "getValidatedProcessCredentials");
 
 // src/resolveProcessCredentials.ts
-var resolveProcessCredentials = /* @__PURE__ */ __name(async (profileName, profiles) => {
+var resolveProcessCredentials = /* @__PURE__ */ __name(async (profileName, profiles, logger) => {
   const profile = profiles[profileName];
   if (profiles[profileName]) {
     const credentialProcess = profile["credential_process"];
@@ -72,24 +78,26 @@ var resolveProcessCredentials = /* @__PURE__ */ __name(async (profileName, profi
         } catch {
           throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
         }
-        return getValidatedProcessCredentials(profileName, data);
+        return getValidatedProcessCredentials(profileName, data, profiles);
       } catch (error) {
-        throw new import_property_provider.CredentialsProviderError(error.message);
+        throw new import_property_provider.CredentialsProviderError(error.message, { logger });
       }
     } else {
-      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`);
+      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
     }
   } else {
-    throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`);
+    throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+      logger
+    });
   }
 }, "resolveProcessCredentials");
 
 // src/fromProcess.ts
 var fromProcess = /* @__PURE__ */ __name((init = {}) => async () => {
   var _a;
-  (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-process", "fromProcess");
+  (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-process - fromProcess");
   const profiles = await (0, import_shared_ini_file_loader.parseKnownFiles)(init);
-  return resolveProcessCredentials((0, import_shared_ini_file_loader.getProfileName)(init), profiles);
+  return resolveProcessCredentials((0, import_shared_ini_file_loader.getProfileName)(init), profiles, init.logger);
 }, "fromProcess");
 // Annotate the CommonJS export names for ESM import in node:
 

package/node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js

@@ -1,7 +1,7 @@
 import { getProfileName, parseKnownFiles } from "@smithy/shared-ini-file-loader";
 import { resolveProcessCredentials } from "./resolveProcessCredentials";
 export const fromProcess = (init = {}) => async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-process", "fromProcess");
+    init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
     const profiles = await parseKnownFiles(init);
-    return resolveProcessCredentials(getProfileName(init), profiles);
+    return resolveProcessCredentials(getProfileName(init), profiles, init.logger);
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js

@@ -1,4 +1,4 @@
-export const getValidatedProcessCredentials = (profileName, data) => {
+export const getValidatedProcessCredentials = (profileName, data, profiles) => {
     if (data.Version !== 1) {
         throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
     }
@@ -12,11 +12,16 @@ export const getValidatedProcessCredentials = (profileName, data) => {
             throw Error(`Profile ${profileName} credential_process returned expired credentials.`);
         }
     }
+    let accountId = data.AccountId;
+    if (!accountId && profiles?.[profileName]?.aws_account_id) {
+        accountId = profiles[profileName].aws_account_id;
+    }
     return {
         accessKeyId: data.AccessKeyId,
         secretAccessKey: data.SecretAccessKey,
         ...(data.SessionToken && { sessionToken: data.SessionToken }),
         ...(data.Expiration && { expiration: new Date(data.Expiration) }),
         ...(data.CredentialScope && { credentialScope: data.CredentialScope }),
+        ...(accountId && { accountId }),
     };
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js

@@ -2,7 +2,7 @@ import { CredentialsProviderError } from "@smithy/property-provider";
 import { exec } from "child_process";
 import { promisify } from "util";
 import { getValidatedProcessCredentials } from "./getValidatedProcessCredentials";
-export const resolveProcessCredentials = async (profileName, profiles) => {
+export const resolveProcessCredentials = async (profileName, profiles, logger) => {
     const profile = profiles[profileName];
     if (profiles[profileName]) {
         const credentialProcess = profile["credential_process"];
@@ -17,17 +17,19 @@ export const resolveProcessCredentials = async (profileName, profiles) => {
                 catch {
                     throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
                 }
-                return getValidatedProcessCredentials(profileName, data);
+                return getValidatedProcessCredentials(profileName, data, profiles);
             }
             catch (error) {
-                throw new CredentialsProviderError(error.message);
+                throw new CredentialsProviderError(error.message, { logger });
             }
         }
         else {
-            throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`);
+            throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
         }
     }
     else {
-        throw new CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`);
+        throw new CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+            logger,
+        });
     }
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ProcessCredentials.d.ts

@@ -8,4 +8,5 @@ export type ProcessCredentials = {
     SessionToken?: string;
     Expiration?: number;
     CredentialScope?: string;
+    AccountId?: string;
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-types/getValidatedProcessCredentials.d.ts

@@ -1,6 +1,6 @@
-import { AwsCredentialIdentity } from "@smithy/types";
+import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
 import { ProcessCredentials } from "./ProcessCredentials";
 /**
  * @internal
  */
-export declare const getValidatedProcessCredentials: (profileName: string, data: ProcessCredentials) => AwsCredentialIdentity;
+export declare const getValidatedProcessCredentials: (profileName: string, data: ProcessCredentials, profiles: ParsedIniData) => AwsCredentialIdentity;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/resolveProcessCredentials.d.ts

@@ -1,5 +1,5 @@
-import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import { AwsCredentialIdentity, Logger, ParsedIniData } from "@smithy/types";
 /**
  * @internal
  */
-export declare const resolveProcessCredentials: (profileName: string, profiles: ParsedIniData) => Promise<AwsCredentialIdentity>;
+export declare const resolveProcessCredentials: (profileName: string, profiles: ParsedIniData, logger?: Logger) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ts3.4/ProcessCredentials.d.ts

@@ -5,4 +5,5 @@ export type ProcessCredentials = {
   SessionToken?: string;
   Expiration?: number;
   CredentialScope?: string;
+  AccountId?: string;
 };

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ts3.4/getValidatedProcessCredentials.d.ts

@@ -1,6 +1,7 @@
-import { AwsCredentialIdentity } from "@smithy/types";
+import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
 import { ProcessCredentials } from "./ProcessCredentials";
 export declare const getValidatedProcessCredentials: (
   profileName: string,
-  data: ProcessCredentials
+  data: ProcessCredentials,
+  profiles: ParsedIniData
 ) => AwsCredentialIdentity;

package/node_modules/@aws-sdk/credential-provider-process/dist-types/ts3.4/resolveProcessCredentials.d.ts

@@ -1,5 +1,6 @@
-import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import { AwsCredentialIdentity, Logger, ParsedIniData } from "@smithy/types";
 export declare const resolveProcessCredentials: (
   profileName: string,
-  profiles: ParsedIniData
+  profiles: ParsedIniData,
+  logger?: Logger
 ) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-process/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-process",
-  "version": "3.577.0",
+  "version": "3.620.1",
   "description": "AWS credential provider that sources credential_process from ~/.aws/credentials and ~/.aws/config",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -24,10 +24,10 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/types": "3.577.0",
-    "@smithy/property-provider": "^3.0.0",
-    "@smithy/shared-ini-file-loader": "^3.0.0",
-    "@smithy/types": "^3.0.0",
+    "@aws-sdk/types": "3.609.0",
+    "@smithy/property-provider": "^3.1.3",
+    "@smithy/shared-ini-file-loader": "^3.1.4",
+    "@smithy/types": "^3.3.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

package/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/index.js

@@ -64,7 +64,8 @@ var resolveSSOCredentials = /* @__PURE__ */ __name(async ({
   ssoRoleName,
   ssoClient,
   clientConfig,
-  profile
+  profile,
+  logger
 }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
@@ -76,23 +77,26 @@ var resolveSSOCredentials = /* @__PURE__ */ __name(async ({
         expiresAt: new Date(_token.expiration).toISOString()
       };
     } catch (e) {
-      throw new import_property_provider.CredentialsProviderError(e.message, SHOULD_FAIL_CREDENTIAL_CHAIN);
+      throw new import_property_provider.CredentialsProviderError(e.message, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
     }
   } else {
     try {
       token = await (0, import_shared_ini_file_loader.getSSOTokenFromFile)(ssoStartUrl);
     } catch (e) {
-      throw new import_property_provider.CredentialsProviderError(
-        `The SSO session associated with this profile is invalid. ${refreshMessage}`,
-        SHOULD_FAIL_CREDENTIAL_CHAIN
-      );
+      throw new import_property_provider.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
     }
   }
   if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
-    throw new import_property_provider.CredentialsProviderError(
-      `The SSO session associated with this profile has expired. ${refreshMessage}`,
-      SHOULD_FAIL_CREDENTIAL_CHAIN
-    );
+    throw new import_property_provider.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
   }
   const { accessToken } = token;
   const { SSOClient: SSOClient2, GetRoleCredentialsCommand: GetRoleCredentialsCommand2 } = await Promise.resolve().then(() => (init_loadSso(), loadSso_exports));
@@ -111,18 +115,33 @@ var resolveSSOCredentials = /* @__PURE__ */ __name(async ({
       })
     );
   } catch (e) {
-    throw import_property_provider.CredentialsProviderError.from(e, SHOULD_FAIL_CREDENTIAL_CHAIN);
+    throw new import_property_provider.CredentialsProviderError(e, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
   }
-  const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope } = {} } = ssoResp;
+  const {
+    roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {}
+  } = ssoResp;
   if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
-    throw new import_property_provider.CredentialsProviderError("SSO returns an invalid temporary credential.", SHOULD_FAIL_CREDENTIAL_CHAIN);
+    throw new import_property_provider.CredentialsProviderError("SSO returns an invalid temporary credential.", {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
   }
-  return { accessKeyId, secretAccessKey, sessionToken, expiration: new Date(expiration), credentialScope };
+  return {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken,
+    expiration: new Date(expiration),
+    ...credentialScope && { credentialScope },
+    ...accountId && { accountId }
+  };
 }, "resolveSSOCredentials");
 
 // src/validateSsoProfile.ts
 
-var validateSsoProfile = /* @__PURE__ */ __name((profile) => {
+var validateSsoProfile = /* @__PURE__ */ __name((profile, logger) => {
   const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
   if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
     throw new import_property_provider.CredentialsProviderError(
@@ -130,7 +149,7 @@ var validateSsoProfile = /* @__PURE__ */ __name((profile) => {
         ", "
       )}
 Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,
-      false
+      { tryNextLink: false, logger }
     );
   }
   return profile;
@@ -139,7 +158,7 @@ Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.ht
 // src/fromSSO.ts
 var fromSSO = /* @__PURE__ */ __name((init = {}) => async () => {
   var _a;
-  (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-sso", "fromSSO");
+  (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-sso - fromSSO");
   const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
   const { ssoClient } = init;
   const profileName = (0, import_shared_ini_file_loader.getProfileName)(init);
@@ -147,25 +166,36 @@ var fromSSO = /* @__PURE__ */ __name((init = {}) => async () => {
     const profiles = await (0, import_shared_ini_file_loader.parseKnownFiles)(init);
     const profile = profiles[profileName];
     if (!profile) {
-      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} was not found.`);
+      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
     }
     if (!isSsoProfile(profile)) {
-      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`);
+      throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+        logger: init.logger
+      });
     }
     if (profile == null ? void 0 : profile.sso_session) {
       const ssoSessions = await (0, import_shared_ini_file_loader.loadSsoSessionData)(init);
       const session = ssoSessions[profile.sso_session];
       const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
       if (ssoRegion && ssoRegion !== session.sso_region) {
-        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, false);
+        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
       }
       if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
-        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, false);
+        throw new import_property_provider.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
       }
       profile.sso_region = session.sso_region;
       profile.sso_start_url = session.sso_start_url;
     }
-    const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile);
+    const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(
+      profile,
+      init.logger
+    );
     return resolveSSOCredentials({
       ssoStartUrl: sso_start_url,
       ssoSession: sso_session,
@@ -178,7 +208,8 @@ var fromSSO = /* @__PURE__ */ __name((init = {}) => async () => {
     });
   } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
     throw new import_property_provider.CredentialsProviderError(
-      'Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"'
+      'Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"',
+      { tryNextLink: false, logger: init.logger }
     );
   } else {
     return resolveSSOCredentials({

package/node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js

@@ -4,7 +4,7 @@ import { isSsoProfile } from "./isSsoProfile";
 import { resolveSSOCredentials } from "./resolveSSOCredentials";
 import { validateSsoProfile } from "./validateSsoProfile";
 export const fromSSO = (init = {}) => async () => {
-    init.logger?.debug("@aws-sdk/credential-provider-sso", "fromSSO");
+    init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
     const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
     const { ssoClient } = init;
     const profileName = getProfileName(init);
@@ -12,25 +12,33 @@ export const fromSSO = (init = {}) => async () => {
         const profiles = await parseKnownFiles(init);
         const profile = profiles[profileName];
         if (!profile) {
-            throw new CredentialsProviderError(`Profile ${profileName} was not found.`);
+            throw new CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
         }
         if (!isSsoProfile(profile)) {
-            throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`);
+            throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+                logger: init.logger,
+            });
         }
         if (profile?.sso_session) {
             const ssoSessions = await loadSsoSessionData(init);
             const session = ssoSessions[profile.sso_session];
             const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
             if (ssoRegion && ssoRegion !== session.sso_region) {
-                throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, false);
+                throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+                    tryNextLink: false,
+                    logger: init.logger,
+                });
             }
             if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
-                throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, false);
+                throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+                    tryNextLink: false,
+                    logger: init.logger,
+                });
             }
             profile.sso_region = session.sso_region;
             profile.sso_start_url = session.sso_start_url;
         }
-        const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile);
+        const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);
         return resolveSSOCredentials({
             ssoStartUrl: sso_start_url,
             ssoSession: sso_session,
@@ -44,7 +52,7 @@ export const fromSSO = (init = {}) => async () => {
     }
     else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
         throw new CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " +
-            '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"');
+            '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
     }
     else {
         return resolveSSOCredentials({