n8n-nodes-base 1.116.0 → 1.118.0

package/dist/credentials/common/aws/system-credentials-utils.d.ts

@@ -0,0 +1,24 @@
+type Resolvers = 'environment' | 'podIdentity' | 'containerMetadata' | 'instanceMetadata';
+type RetrunData = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+};
+export declare const envGetter: (key: string) => string | undefined;
+export declare const credentialsResolver: Record<Resolvers, () => Promise<RetrunData | null>>;
+/**
+ * Retrieves AWS credentials from various system sources following the AWS credential chain.
+ * Attempts to get credentials in the following order:
+ * 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
+ * 2. EKS Pod Identity (AWS_CONTAINER_CREDENTIALS_FULL_URI)
+ * 3. ECS/Fargate container metadata (AWS_CONTAINER_CREDENTIALS_RELATIVE_URI)
+ * 4. EC2 instance metadata service
+ */
+export declare function getSystemCredentials(): Promise<{
+    source: Resolvers;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+} | null>;
+export {};
+//# sourceMappingURL=system-credentials-utils.d.ts.map

package/dist/credentials/common/aws/system-credentials-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-credentials-utils.d.ts","sourceRoot":"","sources":["../../../../credentials/common/aws/system-credentials-utils.ts"],"names":[],"mappings":"AAIA,KAAK,SAAS,GAAG,aAAa,GAAG,aAAa,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC1F,KAAK,UAAU,GAAG;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAA6B,CAAC;AAE/E,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAKnF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,oBAAoB;;iBAtB5B,MAAM;qBACF,MAAM;mBACR,MAAM;UA4CrB"}

package/dist/credentials/common/aws/system-credentials-utils.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.credentialsResolver = exports.envGetter = void 0;
+exports.getSystemCredentials = getSystemCredentials;
+const config_1 = require("@n8n/config");
+const di_1 = require("@n8n/di");
+const n8n_workflow_1 = require("n8n-workflow");
+const envGetter = (key) => process.env[key];
+exports.envGetter = envGetter;
+exports.credentialsResolver = {
+    environment: getEnvironmentCredentials,
+    instanceMetadata: getInstanceMetadataCredentials,
+    containerMetadata: getContainerMetadataCredentials,
+    podIdentity: getPodIdentityCredentials,
+};
+/**
+ * Retrieves AWS credentials from various system sources following the AWS credential chain.
+ * Attempts to get credentials in the following order:
+ * 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
+ * 2. EKS Pod Identity (AWS_CONTAINER_CREDENTIALS_FULL_URI)
+ * 3. ECS/Fargate container metadata (AWS_CONTAINER_CREDENTIALS_RELATIVE_URI)
+ * 4. EC2 instance metadata service
+ */
+async function getSystemCredentials() {
+    if (!di_1.Container.get(config_1.SecurityConfig).awsSystemCredentialsAccess) {
+        throw new n8n_workflow_1.ApplicationError('Access to AWS system credentials disabled, contact your administrator.');
+    }
+    const resolveOrder = [
+        'environment',
+        'podIdentity',
+        'containerMetadata',
+        'instanceMetadata',
+    ];
+    for (const resolver of resolveOrder) {
+        try {
+            const credentials = await exports.credentialsResolver[resolver]();
+            if (credentials)
+                return { ...credentials, source: resolver };
+        }
+        catch (error) {
+            // Ignore and continue to the next resolver
+        }
+    }
+    return null;
+}
+async function getEnvironmentCredentials() {
+    const accessKeyId = (0, exports.envGetter)('AWS_ACCESS_KEY_ID');
+    const secretAccessKey = (0, exports.envGetter)('AWS_SECRET_ACCESS_KEY');
+    const sessionToken = (0, exports.envGetter)('AWS_SESSION_TOKEN');
+    if (accessKeyId && secretAccessKey) {
+        return {
+            accessKeyId: accessKeyId.trim(),
+            secretAccessKey: secretAccessKey.trim(),
+            sessionToken: sessionToken?.trim(),
+        };
+    }
+    return null;
+}
+/**
+ * Retrieves AWS credentials from EC2 instance metadata service (IMDSv2-aware).
+ * This function is used when running on an EC2 instance with an attached IAM role.
+ * It first attempts to obtain an IMDSv2 session token and includes it in all metadata requests.
+ * Falls back to IMDSv1 if IMDSv2 is unavailable (older or less restricted environments).
+ *
+ * @returns Promise resolving to credentials object or null if not running on EC2 or no role attached
+ *
+ * @see {@link https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html IAM Roles for Amazon EC2}
+ */
+async function getInstanceMetadataCredentials() {
+    try {
+        const baseUrl = 'http://169.254.169.254/latest';
+        const headers = {
+            'User-Agent': 'n8n-aws-credential',
+        };
+        // Try to obtain an IMDSv2 token
+        try {
+            const tokenResponse = await fetch(`${baseUrl}/api/token`, {
+                method: 'PUT',
+                headers: {
+                    'X-aws-ec2-metadata-token-ttl-seconds': '21600',
+                    'User-Agent': 'n8n-aws-credential',
+                },
+                signal: AbortSignal.timeout(2000),
+            });
+            if (tokenResponse.ok) {
+                const token = await tokenResponse.text();
+                headers['X-aws-ec2-metadata-token'] = token;
+            }
+        }
+        catch {
+            // IMDSv2 may be disabled; continue with IMDSv1
+        }
+        const roleResponse = await fetch(`${baseUrl}/meta-data/iam/security-credentials/`, {
+            method: 'GET',
+            headers,
+            signal: AbortSignal.timeout(2000),
+        });
+        if (!roleResponse.ok) {
+            return null;
+        }
+        const roleName = (await roleResponse.text()).trim();
+        if (!roleName) {
+            return null;
+        }
+        const credentialsResponse = await fetch(`${baseUrl}/meta-data/iam/security-credentials/${roleName}`, {
+            method: 'GET',
+            headers,
+            signal: AbortSignal.timeout(2000),
+        });
+        if (!credentialsResponse.ok) {
+            return null;
+        }
+        const credentialsData = await credentialsResponse.json();
+        if (!credentialsData?.AccessKeyId || !credentialsData?.SecretAccessKey) {
+            return null;
+        }
+        return {
+            accessKeyId: credentialsData.AccessKeyId,
+            secretAccessKey: credentialsData.SecretAccessKey,
+            sessionToken: credentialsData.Token,
+        };
+    }
+    catch (error) {
+        return null;
+    }
+}
+/**
+ * Retrieves AWS credentials from ECS/Fargate container metadata service.
+ * This function is used when running in an ECS task or Fargate container with a task role.
+ * It uses the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable to fetch credentials.
+ * When AWS_CONTAINER_AUTHORIZATION_TOKEN is available, it includes the Authorization header
+ * as required by AWS for container credential endpoints.
+ *
+ * @returns Promise resolving to credentials object or null if not running in ECS/Fargate or no task role
+ *
+ * @see {@link https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html IAM Roles for Tasks}
+ */
+async function getContainerMetadataCredentials() {
+    try {
+        const relativeUri = (0, exports.envGetter)('AWS_CONTAINER_CREDENTIALS_RELATIVE_URI');
+        if (!relativeUri) {
+            return null;
+        }
+        const authToken = (0, exports.envGetter)('AWS_CONTAINER_AUTHORIZATION_TOKEN');
+        const headers = {
+            'User-Agent': 'n8n-aws-credential',
+        };
+        if (authToken) {
+            headers.Authorization = `Bearer ${authToken}`;
+        }
+        const response = await fetch(`http://169.254.170.2${relativeUri}`, {
+            method: 'GET',
+            headers,
+            signal: AbortSignal.timeout(2000),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const credentialsData = await response.json();
+        return {
+            accessKeyId: credentialsData.AccessKeyId,
+            secretAccessKey: credentialsData.SecretAccessKey,
+            sessionToken: credentialsData.Token,
+        };
+    }
+    catch (error) {
+        return null;
+    }
+}
+/**
+ * Retrieves AWS credentials from EKS Pod Identity service.
+ * This function is used when running in an EKS pod with Pod Identity configured.
+ * It uses the AWS_CONTAINER_CREDENTIALS_FULL_URI environment variable to fetch credentials.
+ * When AWS_CONTAINER_AUTHORIZATION_TOKEN is available, it includes the Authorization header
+ * as required by AWS for Pod Identity credential endpoints.
+ *
+ * @returns Promise resolving to credentials object or null if not running with EKS Pod Identity
+ *
+ * @see {@link https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html EKS Pod Identities}
+ */
+async function getPodIdentityCredentials() {
+    const fullUri = (0, exports.envGetter)('AWS_CONTAINER_CREDENTIALS_FULL_URI');
+    if (!fullUri) {
+        return null;
+    }
+    try {
+        const authToken = (0, exports.envGetter)('AWS_CONTAINER_AUTHORIZATION_TOKEN');
+        const headers = {
+            'User-Agent': 'n8n-aws-credential',
+        };
+        if (authToken) {
+            headers.Authorization = `Bearer ${authToken}`;
+        }
+        const response = await fetch(fullUri, {
+            method: 'GET',
+            headers,
+            signal: AbortSignal.timeout(2000),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const credentialsData = await response.json();
+        return {
+            accessKeyId: credentialsData.AccessKeyId,
+            secretAccessKey: credentialsData.SecretAccessKey,
+            sessionToken: credentialsData.Token,
+        };
+    }
+    catch (error) {
+        return null;
+    }
+}
+//# sourceMappingURL=system-credentials-utils.js.map

package/dist/credentials/common/aws/system-credentials-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-credentials-utils.js","sourceRoot":"","sources":["../../../../credentials/common/aws/system-credentials-utils.ts"],"names":[],"mappings":";;;AA4BA,oDAwBC;AApDD,wCAA6C;AAC7C,gCAAoC;AACpC,+CAAgD;AASzC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAAlE,QAAA,SAAS,aAAyD;AAElE,QAAA,mBAAmB,GAAwD;IACvF,WAAW,EAAE,yBAAyB;IACtC,gBAAgB,EAAE,8BAA8B;IAChD,iBAAiB,EAAE,+BAA+B;IAClD,WAAW,EAAE,yBAAyB;CACtC,CAAC;AAEF;;;;;;;GAOG;AACI,KAAK,UAAU,oBAAoB;IACzC,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,uBAAc,CAAC,CAAC,0BAA0B,EAAE,CAAC;QAC/D,MAAM,IAAI,+BAAgB,CACzB,wEAAwE,CACxE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAgB;QACjC,aAAa;QACb,aAAa;QACb,mBAAmB;QACnB,kBAAkB;KAClB,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACrC,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,2BAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,IAAI,WAAW;gBAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,2CAA2C;QAC5C,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,yBAAyB;IACvC,MAAM,WAAW,GAAG,IAAA,iBAAS,EAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,IAAA,iBAAS,EAAC,uBAAuB,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAA,iBAAS,EAAC,mBAAmB,CAAC,CAAC;IAEpD,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;QACpC,OAAO;YACN,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE;YAC/B,eAAe,EAAE,eAAe,CAAC,IAAI,EAAE;YACvC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE;SAClC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,8BAA8B;IAC5C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAChD,MAAM,OAAO,GAA2B;YACvC,YAAY,EAAE,oBAAoB;SAClC,CAAC;QAEF,gCAAgC;QAChC,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;gBACzD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACR,sCAAsC,EAAE,OAAO;oBAC/C,YAAY,EAAE,oBAAoB;iBAClC;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBACzC,OAAO,CAAC,0BAA0B,CAAC,GAAG,KAAK,CAAC;YAC7C,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,+CAA+C;QAChD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,sCAAsC,EAAE;YAClF,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,KAAK,CACtC,GAAG,OAAO,uCAAuC,QAAQ,EAAE,EAC3D;YACC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CACD,CAAC;QAEF,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAEzD,IAAI,CAAC,eAAe,EAAE,WAAW,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACb,CAAC;QAED,OAAO;YACN,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,eAAe,EAAE,eAAe,CAAC,eAAe;YAChD,YAAY,EAAE,eAAe,CAAC,KAAK;SACnC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,+BAA+B;IAC7C,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,IAAA,iBAAS,EAAC,wCAAwC,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,iBAAS,EAAC,mCAAmC,CAAC,CAAC;QACjE,MAAM,OAAO,GAA2B;YACvC,YAAY,EAAE,oBAAoB;SAClC,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,aAAa,GAAG,UAAU,SAAS,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,WAAW,EAAE,EAAE;YAClE,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO;YACN,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,eAAe,EAAE,eAAe,CAAC,eAAe;YAChD,YAAY,EAAE,eAAe,CAAC,KAAK;SACnC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,IAAA,iBAAS,EAAC,oCAAoC,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,IAAA,iBAAS,EAAC,mCAAmC,CAAC,CAAC;QACjE,MAAM,OAAO,GAA2B;YACvC,YAAY,EAAE,oBAAoB;SAClC,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,aAAa,GAAG,UAAU,SAAS,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACrC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO;YACN,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,eAAe,EAAE,eAAe,CAAC,eAAe;YAChD,YAAY,EAAE,eAAe,CAAC,KAAK;SACnC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC"}

package/dist/credentials/common/aws/types.d.ts

@@ -0,0 +1,44 @@
+export declare const AWS_CHINA_DOMAIN = "amazonaws.com.cn";
+export declare const AWS_GLOBAL_DOMAIN = "amazonaws.com";
+type RegionData = {
+    name: string;
+    displayName: string;
+    location: string;
+    domain?: string;
+};
+export declare const regions: RegionData[];
+export type AWSRegion = (typeof regions)[number]['name'];
+export type AwsCredentialsTypeBase = {
+    region: AWSRegion;
+    customEndpoints: boolean;
+    rekognitionEndpoint?: string;
+    lambdaEndpoint?: string;
+    snsEndpoint?: string;
+    sesEndpoint?: string;
+    sqsEndpoint?: string;
+    s3Endpoint?: string;
+    ssmEndpoint?: string;
+};
+export type AwsIamCredentialsType = AwsCredentialsTypeBase & {
+    accessKeyId: string;
+    secretAccessKey: string;
+    temporaryCredentials: boolean;
+    sessionToken?: string;
+};
+export type AwsAssumeRoleCredentialsType = AwsCredentialsTypeBase & {
+    assumeRole?: boolean;
+    roleArn?: string;
+    externalId?: string;
+    roleSessionName?: string;
+    useSystemCredentialsForRole?: boolean;
+    stsAccessKeyId?: string;
+    stsSecretAccessKey?: string;
+    stsSessionToken?: string;
+};
+export type AwsSecurityHeaders = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string | undefined;
+};
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/credentials/common/aws/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../credentials/common/aws/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,KAAK,UAAU,GAAG;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,UAAU,EAuLtB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,MAAM,sBAAsB,GAAG;IACpC,MAAM,EAAE,SAAS,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,GAAG;IACnE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC"}

package/dist/credentials/common/aws/types.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.regions = exports.AWS_GLOBAL_DOMAIN = exports.AWS_CHINA_DOMAIN = void 0;
+exports.AWS_CHINA_DOMAIN = 'amazonaws.com.cn';
+exports.AWS_GLOBAL_DOMAIN = 'amazonaws.com';
+exports.regions = [
+    {
+        name: 'af-south-1',
+        displayName: 'Africa',
+        location: 'Cape Town',
+    },
+    {
+        name: 'ap-east-1',
+        displayName: 'Asia Pacific',
+        location: 'Hong Kong',
+    },
+    {
+        name: 'ap-south-1',
+        displayName: 'Asia Pacific',
+        location: 'Mumbai',
+    },
+    {
+        name: 'ap-south-2',
+        displayName: 'Asia Pacific',
+        location: 'Hyderabad',
+    },
+    {
+        name: 'ap-southeast-1',
+        displayName: 'Asia Pacific',
+        location: 'Singapore',
+    },
+    {
+        name: 'ap-southeast-2',
+        displayName: 'Asia Pacific',
+        location: 'Sydney',
+    },
+    {
+        name: 'ap-southeast-3',
+        displayName: 'Asia Pacific',
+        location: 'Jakarta',
+    },
+    {
+        name: 'ap-southeast-4',
+        displayName: 'Asia Pacific',
+        location: 'Melbourne',
+    },
+    {
+        name: 'ap-southeast-5',
+        displayName: 'Asia Pacific',
+        location: 'Malaysia',
+    },
+    {
+        name: 'ap-southeast-7',
+        displayName: 'Asia Pacific',
+        location: 'Thailand',
+    },
+    {
+        name: 'ap-northeast-1',
+        displayName: 'Asia Pacific',
+        location: 'Tokyo',
+    },
+    {
+        name: 'ap-northeast-2',
+        displayName: 'Asia Pacific',
+        location: 'Seoul',
+    },
+    {
+        name: 'ap-northeast-3',
+        displayName: 'Asia Pacific',
+        location: 'Osaka',
+    },
+    {
+        name: 'ca-central-1',
+        displayName: 'Canada',
+        location: 'Central',
+    },
+    {
+        name: 'ca-west-1',
+        displayName: 'Canada West',
+        location: 'Calgary',
+    },
+    {
+        name: 'cn-north-1',
+        displayName: 'China',
+        location: 'Beijing',
+        domain: exports.AWS_CHINA_DOMAIN,
+    },
+    {
+        name: 'cn-northwest-1',
+        displayName: 'China',
+        location: 'Ningxia',
+        domain: exports.AWS_CHINA_DOMAIN,
+    },
+    {
+        name: 'eu-central-1',
+        displayName: 'Europe',
+        location: 'Frankfurt',
+    },
+    {
+        name: 'eu-central-2',
+        displayName: 'Europe',
+        location: 'Zurich',
+    },
+    {
+        name: 'eu-north-1',
+        displayName: 'Europe',
+        location: 'Stockholm',
+    },
+    {
+        name: 'eu-south-1',
+        displayName: 'Europe',
+        location: 'Milan',
+    },
+    {
+        name: 'eu-south-2',
+        displayName: 'Europe',
+        location: 'Spain',
+    },
+    {
+        name: 'eu-west-1',
+        displayName: 'Europe',
+        location: 'Ireland',
+    },
+    {
+        name: 'eu-west-2',
+        displayName: 'Europe',
+        location: 'London',
+    },
+    {
+        name: 'eu-west-3',
+        displayName: 'Europe',
+        location: 'Paris',
+    },
+    {
+        name: 'il-central-1',
+        displayName: 'Israel',
+        location: 'Tel Aviv',
+    },
+    {
+        name: 'me-central-1',
+        displayName: 'Middle East',
+        location: 'UAE',
+    },
+    {
+        name: 'me-south-1',
+        displayName: 'Middle East',
+        location: 'Bahrain',
+    },
+    {
+        name: 'mx-central-1',
+        displayName: 'Mexico',
+        location: 'Central',
+    },
+    {
+        name: 'sa-east-1',
+        displayName: 'South America',
+        location: 'São Paulo',
+    },
+    {
+        name: 'us-east-1',
+        displayName: 'US East',
+        location: 'N. Virginia',
+    },
+    {
+        name: 'us-east-2',
+        displayName: 'US East',
+        location: 'Ohio',
+    },
+    {
+        name: 'us-gov-east-1',
+        displayName: 'US East',
+        location: 'GovCloud',
+    },
+    {
+        name: 'us-west-1',
+        displayName: 'US West',
+        location: 'N. California',
+    },
+    {
+        name: 'us-west-2',
+        displayName: 'US West',
+        location: 'Oregon',
+    },
+    {
+        name: 'us-gov-west-1',
+        displayName: 'US West',
+        location: 'GovCloud',
+    },
+];
+//# sourceMappingURL=types.js.map

package/dist/credentials/common/aws/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../credentials/common/aws/types.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,iBAAiB,GAAG,eAAe,CAAC;AASpC,QAAA,OAAO,GAAiB;IACpC;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,QAAQ;KAClB;IACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,QAAQ;KAClB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,SAAS;KACnB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,UAAU;KACpB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,UAAU;KACpB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,SAAS;KACnB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,aAAa;QAC1B,QAAQ,EAAE,SAAS;KACnB;IACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,wBAAgB;KACxB;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,wBAAgB;KACxB;IACD;QACC,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,QAAQ;KAClB;IACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,SAAS;KACnB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,QAAQ;KAClB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,UAAU;KACpB;IACD;QACC,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,aAAa;QAC1B,QAAQ,EAAE,KAAK;KACf;IACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,aAAa;QAC1B,QAAQ,EAAE,SAAS;KACnB;IACD;QACC,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,SAAS;KACnB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,WAAW;KACrB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,SAAS;QACtB,QAAQ,EAAE,aAAa;KACvB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,SAAS;QACtB,QAAQ,EAAE,MAAM;KAChB;IACD;QACC,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,SAAS;QACtB,QAAQ,EAAE,UAAU;KACpB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,SAAS;QACtB,QAAQ,EAAE,eAAe;KACzB;IACD;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,SAAS;QACtB,QAAQ,EAAE,QAAQ;KAClB;IACD;QACC,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,SAAS;QACtB,QAAQ,EAAE,UAAU;KACpB;CACQ,CAAC"}

package/dist/credentials/common/aws/utils.d.ts

@@ -0,0 +1,72 @@
+import { type IHttpRequestMethods, type ICredentialTestRequest, type IHttpRequestOptions } from 'n8n-workflow';
+import type { Request } from 'aws4';
+import { type AwsCredentialsTypeBase, type AWSRegion, type AwsAssumeRoleCredentialsType, type AwsSecurityHeaders } from './types';
+/**
+ * Gets the AWS domain for a specific region.
+ *
+ * @param region - The AWS region to get the domain for
+ * @returns The AWS domain for the region, or the global domain if region not found
+ */
+export declare function getAwsDomain(region: AWSRegion): string;
+/**
+ * Parses an AWS service URL to extract the service name and region.
+ * Some AWS services are global and don't have a region.
+ *
+ * @param url - The AWS service URL to parse
+ * @returns Object containing the service name and region (null for global services)
+ *
+ * @see {@link https://docs.aws.amazon.com/general/latest/gr/rande.html#global-endpoints AWS Global Endpoints}
+ */
+export declare function parseAwsUrl(url: URL): {
+    region: AWSRegion | null;
+    service: string;
+};
+/**
+ * AWS credentials test configuration for validating AWS credentials.
+ * Uses the STS GetCallerIdentity action to verify that the provided credentials are valid.
+ * Automatically handles both standard AWS regions and China regions with appropriate endpoints.
+ */
+export declare const awsCredentialsTest: ICredentialTestRequest;
+/**
+ * Prepares AWS request options for signing by constructing the proper endpoint URL,
+ * handling query parameters, and setting up the request body for AWS4 signature.
+ *
+ * This function handles multiple scenarios:
+ * - Custom service endpoints from credentials
+ * - Default AWS service endpoints
+ * - URI-based requests (legacy IRequestOptions interface)
+ * - Form data conversion to URL-encoded format
+ * - Special handling for STS GetCallerIdentity requests
+ *
+ * @param requestOptions - The HTTP request options to modify
+ * @param credentials - AWS credentials containing potential custom endpoints
+ * @param path - The API path to append to the endpoint
+ * @param method - HTTP method for the request
+ * @param service - AWS service name (e.g., 's3', 'lambda', 'sts')
+ * @param region - AWS region for the request
+ * @returns Object containing signing options and the constructed endpoint URL
+ */
+export declare function awsGetSignInOptionsAndUpdateRequest(requestOptions: IHttpRequestOptions, credentials: AwsCredentialsTypeBase, path: string, method: string | undefined, service: string, region: AWSRegion): {
+    signOpts: Request;
+    url: string;
+};
+/**
+ * Assumes an AWS IAM role using STS (Security Token Service) and returns temporary credentials.
+ * This function supports two modes for providing credentials for the STS call:
+ * 1. Using system credentials (environment variables, instance metadata, etc.)
+ * 2. Using manually provided STS credentials
+ *
+ * @param credentials - The assume role credentials configuration
+ * @param region - AWS region for the STS endpoint
+ * @returns Promise resolving to temporary credentials for the assumed role
+ * @throws {ApplicationError} When credentials are invalid or STS call fails
+ *
+ * @see {@link https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html STS AssumeRole API}
+ */
+export declare function assumeRole(credentials: AwsAssumeRoleCredentialsType, region: AWSRegion): Promise<{
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+}>;
+export declare function signOptions(requestOptions: IHttpRequestOptions, signOpts: Request, securityHeaders: AwsSecurityHeaders, url: string, method?: IHttpRequestMethods): IHttpRequestOptions;
+//# sourceMappingURL=utils.d.ts.map

package/dist/credentials/common/aws/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../credentials/common/aws/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,mBAAmB,EAExB,KAAK,sBAAsB,EAE3B,KAAK,mBAAmB,EAExB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAEN,KAAK,sBAAsB,EAE3B,KAAK,SAAS,EACd,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,MAAM,SAAS,CAAC;AAuBjB;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG;IAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAKnF;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,sBAQhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mCAAmC,CAClD,cAAc,EAAE,mBAAmB,EACnC,WAAW,EAAE,sBAAsB,EACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,GACf;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAgHpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAC/B,WAAW,EAAE,4BAA4B,EACzC,MAAM,EAAE,SAAS,GACf,OAAO,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACrB,CAAC,CAwHD;AAED,wBAAgB,WAAW,CAC1B,cAAc,EAAE,mBAAmB,EACnC,QAAQ,EAAE,OAAO,EACjB,eAAe,EAAE,kBAAkB,EACnC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,mBAAmB,uBAiB5B"}