@vercel/oidc-aws-credentials-provider 3.1.4 → 3.2.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @vercel/oidc
 
+## 3.2.0
+
+### Minor Changes
+
+- 415fde0: Add optional `audience` and `jti` parameters to exchange Vercel OIDC tokens for use with AWS STS and other providers.
+
+### Patch Changes
+
+- Updated dependencies [415fde0]
+  - @vercel/oidc@3.7.0
+
+## 3.1.5
+
+### Patch Changes
+
+- @vercel/oidc@3.6.2
+
 ## 3.1.4
 
 ### Patch Changes

package/dist/aws-credentials-provider.d.ts

@@ -4,6 +4,8 @@ import type { FromWebTokenInit } from '@aws-sdk/credential-provider-web-identity
  * The init object for the `awsCredentialsProvider` function.
  *
  * @typedef {Object} AwsCredentialsProviderInit
+ * @property {string} audience - Optional audience to set on the exchanged token.
+ * @property {string} jti - Optional JTI to set on the exchanged token.
  * @property {string} roleArn - ARN of the role that the caller is assuming.
  * @property {Object} [clientConfig] - Custom STS client configurations overriding the default ones.
  * @property {Array} [clientPlugins] - Custom STS client middleware plugin to modify the client default behavior.
@@ -15,12 +17,24 @@ import type { FromWebTokenInit } from '@aws-sdk/credential-provider-web-identity
  * @property {number} [durationSeconds=3600] - The duration, in seconds, of the role session. Defaults to 3600 seconds.
  */
 export interface AwsCredentialsProviderInit extends Omit<FromWebTokenInit, 'webIdentityToken'> {
+    /**
+     * Optional audience to set on the exchanged token.
+     * @default undefined
+     */
+    audience?: string;
+    /**
+     * Optional JTI to set on the exchanged token.
+     * @default undefined
+     */
+    jti?: string;
 }
 /**
  * Obtains the Vercel OIDC token and creates an AWS credential provider function
  * that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
  *
  * @param {AwsCredentialsProviderInit} init - The initialization object.
+ * @param {string} init.audience - Optional audience to set on the exchanged token.
+ * @param {string} init.jti - Optional JTI to set on the exchanged token.
  * @param {string} init.roleArn - ARN of the role that the caller is assuming.
  * @param {Object} [init.clientConfig] - Custom STS client configurations overriding the default ones.
  * @param {Array} [init.clientPlugins] - Custom STS client middleware plugin to modify the client default behavior.
@@ -40,6 +54,8 @@ export interface AwsCredentialsProviderInit extends Omit<FromWebTokenInit, 'webI
  *
  * const s3Client = new s3.S3Client({
  *   credentials: awsCredentialsProvider({
+ *     audience: 'https://sts.amazonaws.com',
+ *     jti: secureRandomString(),
  *     roleArn: "arn:aws:iam::1234567890:role/RoleA",
  *     clientConfig: { region: "us-west-2" },
  *     clientPlugins: [addFooHeadersPlugin],

package/dist/aws-credentials-provider.js

@@ -24,10 +24,11 @@ module.exports = __toCommonJS(aws_credentials_provider_exports);
 var import_credential_provider_web_identity = require("@aws-sdk/credential-provider-web-identity");
 var import_oidc = require("@vercel/oidc");
 function awsCredentialsProvider(init) {
+  const { audience, jti, ...initOptions } = init;
   return async () => {
     return (0, import_credential_provider_web_identity.fromWebToken)({
-      ...init,
-      webIdentityToken: (0, import_oidc.getVercelOidcTokenSync)()
+      ...initOptions,
+      webIdentityToken: await (0, import_oidc.getVercelOidcToken)({ audience, jti })
     })();
   };
 }

package/docs/functions/awsCredentialsProvider.md

@@ -6,7 +6,7 @@
 
 > **awsCredentialsProvider**(`init`): `AwsCredentialIdentityProvider`
 
-Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:61](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L61)
+Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:77](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L77)
 
 Obtains the Vercel OIDC token and creates an AWS credential provider function
 that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
@@ -33,6 +33,8 @@ import { awsCredentialsProvider } from '@vercel/functions/oidc';
 
 const s3Client = new s3.S3Client({
   credentials: awsCredentialsProvider({
+    audience: 'https://sts.amazonaws.com',
+    jti: secureRandomString(),
     roleArn: 'arn:aws:iam::1234567890:role/RoleA',
     clientConfig: { region: 'us-west-2' },
     clientPlugins: [addFooHeadersPlugin],

package/docs/interfaces/AwsCredentialsProviderInit.md

@@ -4,7 +4,7 @@
 
 # Interface: AwsCredentialsProviderInit
 
-Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:21](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L21)
+Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:22](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L22)
 
 The init object for the `awsCredentialsProvider` function.
 
@@ -14,6 +14,16 @@ The init object for the `awsCredentialsProvider` function.
 
 ## Properties
 
+### audience?
+
+> `optional` **audience?**: `string`
+
+Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:28](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L28)
+
+Optional audience to set on the exchanged token.
+
+---
+
 ### clientConfig?
 
 > `optional` **clientConfig?**: `any`
@@ -54,6 +64,16 @@ The duration, in seconds, of the role session. Defaults to 3600 seconds.
 
 ---
 
+### jti?
+
+> `optional` **jti?**: `string`
+
+Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:33](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L33)
+
+Optional JTI to set on the exchanged token.
+
+---
+
 ### logger?
 
 > `optional` **logger?**: `Logger`

package/package.json

@@ -14,7 +14,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "3.1.4",
+  "version": "3.2.0",
   "repository": {
     "directory": "packages/oidc-aws-credentials-provider",
     "type": "git",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@aws-sdk/credential-provider-web-identity": "^3.609.0",
-    "@vercel/oidc": "3.6.1"
+    "@vercel/oidc": "3.7.0"
   },
   "scripts": {
     "pretest": "pnpm run build:code",