agentcore-cli 0.31.1__py3-none-any.whl

agentcore/aws/_util.py

@@ -0,0 +1,37 @@
+"""Small JS-semantics helpers shared by the AWS layer."""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Mapping
+from typing import Any
+
+
+def warn(message: str) -> None:
+    """``console.warn`` equivalent (stderr)."""
+    print(message, file=sys.stderr)
+
+
+def drop_none(mapping: Mapping[str, Any]) -> dict[str, Any]:
+    """Drop ``None`` values, as ``JSON.stringify`` drops ``undefined`` properties."""
+    return {k: v for k, v in mapping.items() if v is not None}
+
+
+def js_string(value: Any) -> str:
+    """``String(value)`` for JSON values."""
+    if value is None:
+        return "null"
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, float) and value.is_integer():
+        return str(int(value))
+    if isinstance(value, dict):
+        return "[object Object]"
+    if isinstance(value, list):
+        return ",".join("" if v is None else js_string(v) for v in value)
+    return str(value)
+
+
+def js_template(value: Any) -> str:
+    """Template-literal interpolation of a possibly-missing value (``None`` -> ``undefined``)."""
+    return "undefined" if value is None else js_string(value)

agentcore/aws/account.py

@@ -0,0 +1,165 @@
+"""Credential resolution and account detection (port of ``account.ts``).
+
+Upstream picks ``fromEnv()`` when ``AWS_ACCESS_KEY_ID`` and ``AWS_SECRET_ACCESS_KEY`` are set and
+otherwise the full Node provider chain (which honours ``AWS_PROFILE``, SSO, process credentials,
+IMDS, ...). A boto3 ``Session`` created *without* an explicit ``profile_name`` has the same
+precedence: the environment provider comes first and ``AWS_PROFILE`` selects the shared-config
+profile otherwise. Every client in this package is built through :func:`create_aws_client`.
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Callable, Mapping
+from typing import Any
+
+import boto3
+from botocore.client import BaseClient
+from botocore.config import Config
+from botocore.credentials import ReadOnlyCredentials
+
+from agentcore.aws._aws_errors import aws_error_name
+from agentcore.lib.errors.types import AwsCredentialsError, ValidationError
+
+# SDK v3 defaults to the "standard" retry mode with 3 attempts; botocore defaults to "legacy" with
+# 5. Use the SDK v3 behaviour unless the user configured retries through the environment.
+_DEFAULT_RETRIES = {"mode": "standard", "max_attempts": 3}
+
+
+def get_boto3_session(region: str | None = None) -> boto3.session.Session:
+    """A fresh boto3 session using the default credential chain (env first, then ``AWS_PROFILE``)."""
+    return boto3.session.Session(region_name=region)
+
+
+def get_credential_provider() -> Callable[[], ReadOnlyCredentials | None]:
+    """Callable resolving the current frozen credentials (``None`` when none are configured)."""
+
+    def provider() -> ReadOnlyCredentials | None:
+        credentials = get_boto3_session().get_credentials()
+        return credentials.get_frozen_credentials() if credentials is not None else None
+
+    return provider
+
+
+def default_client_config(**overrides: Any) -> Config:
+    kwargs: dict[str, Any] = {}
+    if not os.environ.get("AWS_RETRY_MODE") and not os.environ.get("AWS_MAX_ATTEMPTS"):
+        kwargs["retries"] = dict(_DEFAULT_RETRIES)
+    kwargs.update(overrides)
+    return Config(**kwargs)
+
+
+def create_aws_client(
+    service_name: str,
+    region: str,
+    *,
+    endpoint_url: str | None = None,
+    config: Config | None = None,
+) -> BaseClient:
+    """boto3 client for ``service_name`` in ``region`` with the CLI's credential/retry defaults."""
+    merged = default_client_config()
+    if config is not None:
+        merged = merged.merge(config)
+    return get_boto3_session(region).client(service_name, region_name=region, endpoint_url=endpoint_url, config=merged)
+
+
+def _get_aws_login_guidance() -> str:
+    try:
+        from agentcore.cli.external_requirements.checks import get_aws_login_guidance  # type: ignore[import-not-found]
+    except ImportError:
+        return "Run: aws login"
+    return get_aws_login_guidance()
+
+
+def detect_account() -> str | None:
+    """AWS account ID via STS ``GetCallerIdentity``.
+
+    Raises :class:`AwsCredentialsError` with remediation for expired/invalid credentials and
+    missing permissions; returns ``None`` for anything else (e.g. no credentials at all).
+    """
+    region = os.environ.get("AWS_REGION")
+    if region is None:
+        region = os.environ.get("AWS_DEFAULT_REGION")
+    if region is None:
+        region = "us-east-1"
+
+    try:
+        response = create_aws_client("sts", region).get_caller_identity()
+        return response.get("Account") or None
+    except Exception as exc:  # mirrors upstream's catch-all
+        code = aws_error_name(exc)
+
+        if code in ("ExpiredTokenException", "ExpiredToken"):
+            guidance = _get_aws_login_guidance()
+            raise AwsCredentialsError(
+                "AWS credentials expired.", f"AWS credentials expired.\n\nTo fix this:\n  {guidance}"
+            ) from exc
+
+        if code in ("InvalidClientTokenId", "SignatureDoesNotMatch"):
+            guidance = _get_aws_login_guidance()
+            raise AwsCredentialsError(
+                "AWS credentials are invalid.",
+                "AWS credentials are invalid.\n\nTo fix this:\n  1. Check your AWS_ACCESS_KEY_ID and "
+                f"AWS_SECRET_ACCESS_KEY\n  2. Or {guidance}",
+            ) from exc
+
+        if code in ("AccessDenied", "AccessDeniedException"):
+            raise AwsCredentialsError(
+                "AWS credentials lack required permissions.",
+                "AWS credentials lack required permissions for STS:GetCallerIdentity.\n\nTo fix this:\n"
+                "  Ensure your IAM user/role has sts:GetCallerIdentity permission",
+            ) from exc
+
+        # botocore names these differently from the AWS SDK for JavaScript, which upstream matches on:
+        # an expired/missing SSO session would otherwise surface later as "Target not found".
+        if type(exc).__name__ in _SSO_SESSION_ERRORS:
+            guidance = _sso_login_guidance()
+            raise AwsCredentialsError(
+                "AWS SSO session expired.", f"AWS SSO session expired or not logged in.\n\nTo fix this:\n  {guidance}"
+            ) from exc
+
+        return None
+
+
+_SSO_SESSION_ERRORS = frozenset(
+    {
+        "TokenRetrievalError",
+        "SSOTokenLoadError",
+        "UnauthorizedSSOTokenError",
+        "SSOError",
+        "PendingAuthorizationExpiredError",
+    }
+)
+
+
+def _sso_login_guidance() -> str:
+    profile = os.environ.get("AWS_PROFILE")
+    return f"Run: aws sso login --profile {profile}" if profile else "Run: aws sso login"
+
+
+def _target_field(target: object, field: str) -> Any:
+    if isinstance(target, Mapping):
+        return target.get(field)
+    return getattr(target, field, None)
+
+
+def validate_aws_credentials(target: object | None = None) -> None:
+    """Ensure credentials work and, when ``target`` (``name``/``account``) is given, match its account."""
+    account = detect_account()
+    if not account:
+        guidance = _get_aws_login_guidance()
+        raise AwsCredentialsError(
+            "No AWS credentials configured.",
+            "No AWS credentials configured.\n\n"
+            "To fix this:\n"
+            f"  1. {guidance}\n"
+            "  2. Or set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables",
+        )
+
+    target_account = _target_field(target, "account") if target is not None else None
+    if target_account and account != target_account:
+        raise ValidationError(
+            f"Your AWS credentials are for account {account}, but the target "
+            f'"{_target_field(target, "name")}" is configured for account {target_account}.\n'
+            "Ensure your credentials match the deployment target."
+        )