npm - @smithy/credential-provider-imds - Versions diffs - 2.0.18 → 2.1.0 - Mend

@smithy/credential-provider-imds 2.0.18 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/dist-cjs/error/InstanceMetadataV1FallbackError.js ADDED Viewed

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstanceMetadataV1FallbackError = void 0;
+const property_provider_1 = require("@smithy/property-provider");
+class InstanceMetadataV1FallbackError extends property_provider_1.CredentialsProviderError {
+    constructor(message, tryNextLink = true) {
+        super(message, tryNextLink);
+        this.tryNextLink = tryNextLink;
+        this.name = "InstanceMetadataV1FallbackError";
+        Object.setPrototypeOf(this, InstanceMetadataV1FallbackError.prototype);
+    }
+}
+exports.InstanceMetadataV1FallbackError = InstanceMetadataV1FallbackError;

package/dist-cjs/fromInstanceMetadata.js CHANGED Viewed

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fromInstanceMetadata = void 0;
+const node_config_provider_1 = require("@smithy/node-config-provider");
 const property_provider_1 = require("@smithy/property-provider");
+const InstanceMetadataV1FallbackError_1 = require("./error/InstanceMetadataV1FallbackError");
 const httpRequest_1 = require("./remoteProvider/httpRequest");
 const ImdsCredentials_1 = require("./remoteProvider/ImdsCredentials");
 const RemoteProviderInit_1 = require("./remoteProvider/RemoteProviderInit");
@@ -10,13 +12,51 @@ const getInstanceMetadataEndpoint_1 = require("./utils/getInstanceMetadataEndpoi
 const staticStabilityProvider_1 = require("./utils/staticStabilityProvider");
 const IMDS_PATH = "/latest/meta-data/iam/security-credentials/";
 const IMDS_TOKEN_PATH = "/latest/api/token";
+const AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED";
+const PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled";
+const X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token";
 const fromInstanceMetadata = (init = {}) => (0, staticStabilityProvider_1.staticStabilityProvider)(getInstanceImdsProvider(init), { logger: init.logger });
 exports.fromInstanceMetadata = fromInstanceMetadata;
 const getInstanceImdsProvider = (init) => {
     let disableFetchToken = false;
+    const { logger, profile } = init;
     const { timeout, maxRetries } = (0, RemoteProviderInit_1.providerConfigFromInit)(init);
     const getCredentials = async (maxRetries, options) => {
-        const profile = (await (0, retry_1.retry)(async () => {
+        var _a;
+        const isImdsV1Fallback = disableFetchToken || ((_a = options.headers) === null || _a === void 0 ? void 0 : _a[X_AWS_EC2_METADATA_TOKEN]) == null;
+        if (isImdsV1Fallback) {
+            let fallbackBlockedFromProfile = false;
+            let fallbackBlockedFromProcessEnv = false;
+            const configValue = await (0, node_config_provider_1.loadConfig)({
+                environmentVariableSelector: (env) => {
+                    const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
+                    fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
+                    if (envValue === undefined) {
+                        throw new property_provider_1.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`);
+                    }
+                    return fallbackBlockedFromProcessEnv;
+                },
+                configFileSelector: (profile) => {
+                    const profileValue = profile[PROFILE_AWS_EC2_METADATA_V1_DISABLED];
+                    fallbackBlockedFromProfile = !!profileValue && profileValue !== "false";
+                    return fallbackBlockedFromProfile;
+                },
+                default: false,
+            }, {
+                profile,
+            })();
+            if (init.ec2MetadataV1Disabled || configValue) {
+                const causes = [];
+                if (init.ec2MetadataV1Disabled)
+                    causes.push("credential provider initialization (runtime option ec2MetadataV1Disabled)");
+                if (fallbackBlockedFromProfile)
+                    causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);
+                if (fallbackBlockedFromProcessEnv)
+                    causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);
+                throw new InstanceMetadataV1FallbackError_1.InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(", ")}].`);
+            }
+        }
+        const imdsProfile = (await (0, retry_1.retry)(async () => {
             let profile;
             try {
                 profile = await getProfile(options);
@@ -32,7 +72,7 @@ const getInstanceImdsProvider = (init) => {
         return (0, retry_1.retry)(async () => {
             let creds;
             try {
-                creds = await getCredentialsFromProfile(profile, options);
+                creds = await getCredentialsFromProfile(imdsProfile, options);
             }
             catch (err) {
                 if (err.statusCode === 401) {
@@ -46,6 +86,7 @@ const getInstanceImdsProvider = (init) => {
     return async () => {
         const endpoint = await (0, getInstanceMetadataEndpoint_1.getInstanceMetadataEndpoint)();
         if (disableFetchToken) {
+            logger === null || logger === void 0 ? void 0 : logger.debug("AWS SDK Instance Metadata", "using v1 fallback (no token fetch)");
             return getCredentials(maxRetries, { ...endpoint, timeout });
         }
         else {
@@ -62,12 +103,13 @@ const getInstanceImdsProvider = (init) => {
                 else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
                     disableFetchToken = true;
                 }
+                logger === null || logger === void 0 ? void 0 : logger.debug("AWS SDK Instance Metadata", "using v1 fallback (initial)");
                 return getCredentials(maxRetries, { ...endpoint, timeout });
             }
             return getCredentials(maxRetries, {
                 ...endpoint,
                 headers: {
-                    "x-aws-ec2-metadata-token": token,
+                    [X_AWS_EC2_METADATA_TOKEN]: token,
                 },
                 timeout,
             });

package/dist-es/error/InstanceMetadataV1FallbackError.js ADDED Viewed

@@ -0,0 +1,9 @@
+import { CredentialsProviderError } from "@smithy/property-provider";
+export class InstanceMetadataV1FallbackError extends CredentialsProviderError {
+    constructor(message, tryNextLink = true) {
+        super(message, tryNextLink);
+        this.tryNextLink = tryNextLink;
+        this.name = "InstanceMetadataV1FallbackError";
+        Object.setPrototypeOf(this, InstanceMetadataV1FallbackError.prototype);
+    }
+}

package/dist-es/fromInstanceMetadata.js CHANGED Viewed

@@ -1,4 +1,6 @@
+import { loadConfig } from "@smithy/node-config-provider";
 import { CredentialsProviderError } from "@smithy/property-provider";
+import { InstanceMetadataV1FallbackError } from "./error/InstanceMetadataV1FallbackError";
 import { httpRequest } from "./remoteProvider/httpRequest";
 import { fromImdsCredentials, isImdsCredentials } from "./remoteProvider/ImdsCredentials";
 import { providerConfigFromInit } from "./remoteProvider/RemoteProviderInit";
@@ -7,12 +9,49 @@ import { getInstanceMetadataEndpoint } from "./utils/getInstanceMetadataEndpoint
 import { staticStabilityProvider } from "./utils/staticStabilityProvider";
 const IMDS_PATH = "/latest/meta-data/iam/security-credentials/";
 const IMDS_TOKEN_PATH = "/latest/api/token";
+const AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED";
+const PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled";
+const X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token";
 export const fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceImdsProvider(init), { logger: init.logger });
 const getInstanceImdsProvider = (init) => {
     let disableFetchToken = false;
+    const { logger, profile } = init;
     const { timeout, maxRetries } = providerConfigFromInit(init);
     const getCredentials = async (maxRetries, options) => {
-        const profile = (await retry(async () => {
+        const isImdsV1Fallback = disableFetchToken || options.headers?.[X_AWS_EC2_METADATA_TOKEN] == null;
+        if (isImdsV1Fallback) {
+            let fallbackBlockedFromProfile = false;
+            let fallbackBlockedFromProcessEnv = false;
+            const configValue = await loadConfig({
+                environmentVariableSelector: (env) => {
+                    const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
+                    fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
+                    if (envValue === undefined) {
+                        throw new CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`);
+                    }
+                    return fallbackBlockedFromProcessEnv;
+                },
+                configFileSelector: (profile) => {
+                    const profileValue = profile[PROFILE_AWS_EC2_METADATA_V1_DISABLED];
+                    fallbackBlockedFromProfile = !!profileValue && profileValue !== "false";
+                    return fallbackBlockedFromProfile;
+                },
+                default: false,
+            }, {
+                profile,
+            })();
+            if (init.ec2MetadataV1Disabled || configValue) {
+                const causes = [];
+                if (init.ec2MetadataV1Disabled)
+                    causes.push("credential provider initialization (runtime option ec2MetadataV1Disabled)");
+                if (fallbackBlockedFromProfile)
+                    causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);
+                if (fallbackBlockedFromProcessEnv)
+                    causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);
+                throw new InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(", ")}].`);
+            }
+        }
+        const imdsProfile = (await retry(async () => {
             let profile;
             try {
                 profile = await getProfile(options);
@@ -28,7 +67,7 @@ const getInstanceImdsProvider = (init) => {
         return retry(async () => {
             let creds;
             try {
-                creds = await getCredentialsFromProfile(profile, options);
+                creds = await getCredentialsFromProfile(imdsProfile, options);
             }
             catch (err) {
                 if (err.statusCode === 401) {
@@ -42,6 +81,7 @@ const getInstanceImdsProvider = (init) => {
     return async () => {
         const endpoint = await getInstanceMetadataEndpoint();
         if (disableFetchToken) {
+            logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (no token fetch)");
             return getCredentials(maxRetries, { ...endpoint, timeout });
         }
         else {
@@ -58,12 +98,13 @@ const getInstanceImdsProvider = (init) => {
                 else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
                     disableFetchToken = true;
                 }
+                logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (initial)");
                 return getCredentials(maxRetries, { ...endpoint, timeout });
             }
             return getCredentials(maxRetries, {
                 ...endpoint,
                 headers: {
-                    "x-aws-ec2-metadata-token": token,
+                    [X_AWS_EC2_METADATA_TOKEN]: token,
                 },
                 timeout,
             });

package/dist-types/error/InstanceMetadataV1FallbackError.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+import { CredentialsProviderError } from "@smithy/property-provider";
+/**
+ * @public
+ *
+ * A specific sub-case of CredentialsProviderError, when the IMDSv1 fallback
+ * has been attempted but shut off by SDK configuration.
+ */
+export declare class InstanceMetadataV1FallbackError extends CredentialsProviderError {
+    readonly tryNextLink: boolean;
+    name: string;
+    constructor(message: string, tryNextLink?: boolean);
+}

package/dist-types/remoteProvider/RemoteProviderInit.d.ts CHANGED Viewed

@@ -8,7 +8,7 @@ export declare const DEFAULT_TIMEOUT = 1000;
  */
 export declare const DEFAULT_MAX_RETRIES = 0;
 /**
- * @internal
+ * @public
  */
 export interface RemoteProviderConfig {
     /**
@@ -21,10 +21,18 @@ export interface RemoteProviderConfig {
     maxRetries: number;
 }
 /**
- * @internal
+ * @public
  */
 export interface RemoteProviderInit extends Partial<RemoteProviderConfig> {
     logger?: Logger;
+    /**
+     * Only used in the IMDS credential provider.
+     */
+    ec2MetadataV1Disabled?: boolean;
+    /**
+     * AWS_PROFILE.
+     */
+    profile?: string;
 }
 /**
  * @internal

package/dist-types/ts3.4/error/InstanceMetadataV1FallbackError.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+import { CredentialsProviderError } from "@smithy/property-provider";
+/**
+ * @public
+ *
+ * A specific sub-case of CredentialsProviderError, when the IMDSv1 fallback
+ * has been attempted but shut off by SDK configuration.
+ */
+export declare class InstanceMetadataV1FallbackError extends CredentialsProviderError {
+    readonly tryNextLink: boolean;
+    name: string;
+    constructor(message: string, tryNextLink?: boolean);
+}

package/dist-types/ts3.4/remoteProvider/RemoteProviderInit.d.ts CHANGED Viewed

@@ -8,7 +8,7 @@ export declare const DEFAULT_TIMEOUT = 1000;
  */
 export declare const DEFAULT_MAX_RETRIES = 0;
 /**
- * @internal
+ * @public
  */
 export interface RemoteProviderConfig {
     /**
@@ -21,10 +21,18 @@ export interface RemoteProviderConfig {
     maxRetries: number;
 }
 /**
- * @internal
+ * @public
  */
 export interface RemoteProviderInit extends Partial<RemoteProviderConfig> {
     logger?: Logger;
+    /**
+     * Only used in the IMDS credential provider.
+     */
+    ec2MetadataV1Disabled?: boolean;
+    /**
+     * AWS_PROFILE.
+     */
+    profile?: string;
 }
 /**
  * @internal

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/credential-provider-imds",
-  "version": "2.0.18",
+  "version": "2.1.0",
   "description": "AWS credential provider that sources credentials from the EC2 instance metadata service and ECS container metadata service",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -26,7 +26,7 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@smithy/node-config-provider": "^2.1.3",
+    "@smithy/node-config-provider": "^2.1.4",
     "@smithy/property-provider": "^2.0.13",
     "@smithy/types": "^2.4.0",
     "@smithy/url-parser": "^2.0.12",