capo-cloudcontrol 0.7.0__tar.gz → 0.9.0__tar.gz

{capo_cloudcontrol-0.7.0/src/capo_cloudcontrol.egg-info → capo_cloudcontrol-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-cloudcontrol
-Version: 0.7.0
+Version: 0.9.0
 Summary: Python SDK for AWS Cloudcontrol.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capo-cloudcontrol"
-version = "0.7.0"
+version = "0.9.0"
 description = "Python SDK for AWS Cloudcontrol."
 readme = "README.md"
 requires-python = ">=3.10"

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/src/capo_cloudcontrol/__init__.py

@@ -16,6 +16,9 @@ from ._auth._providers import (
 from ._auth._providers import (
     ChainedProvider as ChainedProvider,
 )
+from ._auth._providers import (
+    CredentialProcessError as CredentialProcessError,
+)
 from ._auth._providers import (
     CredentialsProvider as CredentialsProvider,
 )
@@ -31,6 +34,9 @@ from ._auth._providers import (
 from ._auth._providers import (
     MissingDependencyError as MissingDependencyError,
 )
+from ._auth._providers import (
+    ProcessCredentialsProvider as ProcessCredentialsProvider,
+)
 from ._auth._providers import (
     ProfileCredentialsProvider as ProfileCredentialsProvider,
 )

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/src/capo_cloudcontrol/_auth/_providers.py

@@ -4,6 +4,7 @@ import configparser
 import hashlib
 import json
 import os
+import subprocess
 import time
 from abc import abstractmethod
 from dataclasses import dataclass
@@ -59,6 +60,10 @@ class IdentityNotFound(Exception):
     """Raised when a provider cannot resolve an identity. Chain continues."""
 
 
+class CredentialProcessError(Exception):
+    """Raised when a profile's `credential_process` fails or prints unusable output. Chain stops."""
+
+
 class MissingDependencyError(Exception):
     """Raised when a provider needs the `sso` extra but it is not installed."""
 
@@ -186,13 +191,27 @@ class ProfileCredentialsProvider(CredentialsProvider):
         self, credentials_file: Path | None = None, profile: str | None = None
     ) -> None:
         self._profile = profile or active_profile()
-        self._cred_file = credentials_file or Path(
-            os.environ.get("AWS_SHARED_CREDENTIALS_FILE")
-            or Path.home() / ".aws" / "credentials"
-        )
+        self._cred_file = credentials_file or _shared_credentials_file()
 
     def resolve_identity(self) -> Credentials:
-        section = self._load_section()
+        from_config, _ = _load_profile(self._profile)
+        from_credentials_file = _credentials_file_section(
+            self._profile, self._cred_file
+        )
+        section = {**from_config, **from_credentials_file}
+        if not section:
+            raise IdentityNotFound(
+                f"profile {self._profile!r} not found in credentials/config files"
+            )
+        # botocore's order: keys from the credentials file, then credential_process, then keys from the
+        # config file, so a profile with a process only takes its keys from the credentials file
+        if "credential_process" in section and not (
+            from_credentials_file.get("aws_access_key_id")
+            and from_credentials_file.get("aws_secret_access_key")
+        ):
+            raise IdentityNotFound(
+                f"profile {self._profile!r}: credential_process comes before the keys in the config file"
+            )
         ak = section.get("aws_access_key_id")
         sk = section.get("aws_secret_access_key")
         if not ak or not sk:
@@ -205,19 +224,94 @@ class ProfileCredentialsProvider(CredentialsProvider):
             out["session_token"] = token
         return out
 
-    def _load_section(self) -> dict[str, str]:
-        # config-file profile reuses the loader from _services/_aws_config
-        merged, _ = _load_profile(self._profile)
-        if self._cred_file.is_file():
-            cfg = configparser.ConfigParser(interpolation=None)
-            cfg.read(self._cred_file)
-            if cfg.has_section(self._profile):
-                merged.update(dict(cfg.items(self._profile)))
-        if not merged:
-            raise IdentityNotFound(
-                f"profile {self._profile!r} not found in credentials/config files"
+
+class ProcessCredentialsProvider(CredentialsProvider):
+    """Run the profile's ``credential_process`` command and read the credentials it prints.
+
+    This is how helpers such as ``aws-sso-cli`` hand out short-term credentials. The command
+    runs through the system shell, as in the Rust, Kotlin and Swift SDKs, so a quoted Windows path
+    works as written, and it must print the JSON document the AWS SDKs define (``Version`` 1).
+    The key is read from the credentials file as well as the config file. A profile without
+    ``credential_process`` is skipped; a command that fails or outlives the timeout stops the chain.
+    """
+
+    def __init__(
+        self,
+        credentials_file: Path | None = None,
+        profile: str | None = None,
+        timeout: float = 60.0,
+    ) -> None:
+        self._profile = profile or active_profile()
+        self._cred_file = credentials_file or _shared_credentials_file()
+        self._timeout = timeout
+
+    def resolve_identity(self) -> Credentials:
+        section = _load_merged_profile(self._profile, self._cred_file)
+        command = section.get("credential_process")
+        if not command:
+            raise IdentityNotFound(f"profile {self._profile!r}: no credential_process")
+        try:
+            # the shell is sh -c on POSIX and cmd.exe /c on Windows, which parses the path natively
+            result = subprocess.run(
+                command,
+                shell=True,
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=self._timeout,
+            )
+        except subprocess.TimeoutExpired:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process did not finish within {self._timeout} seconds"
+            ) from None
+        except OSError as e:
+            raise CredentialProcessError(f"profile {self._profile!r}: {e}") from e
+        # stdout carries the secret, so only stderr ever goes into an error message
+        if result.returncode != 0:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process exited with {result.returncode}: {result.stderr.strip()}"
+            )
+        try:
+            data = json.loads(result.stdout)
+        except ValueError:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process did not print JSON"
+            ) from None
+        if not isinstance(data, dict) or data.get("Version") != 1:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process output must be a JSON object with Version 1"
             )
-        return merged
+        try:
+            return _credentials_from_json(data, token_key="SessionToken")
+        except IdentityNotFound as e:
+            raise CredentialProcessError(f"profile {self._profile!r}: {e}") from None
+        except ValueError:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process printed an invalid Expiration"
+            ) from None
+
+
+def _shared_credentials_file() -> Path:
+    return Path(
+        os.environ.get("AWS_SHARED_CREDENTIALS_FILE")
+        or Path.home() / ".aws" / "credentials"
+    )
+
+
+def _load_merged_profile(profile: str, credentials_file: Path) -> dict[str, str]:
+    """The profile's keys from the config file, overlaid by the credentials file, as the AWS SDKs merge them."""
+    # config-file profile reuses the loader from _services/_aws_config
+    merged, _ = _load_profile(profile)
+    merged.update(_credentials_file_section(profile, credentials_file))
+    return merged
+
+
+def _credentials_file_section(profile: str, credentials_file: Path) -> dict[str, str]:
+    if not credentials_file.is_file():
+        return {}
+    cfg = configparser.ConfigParser(interpolation=None)
+    cfg.read(credentials_file)
+    return dict(cfg.items(profile)) if cfg.has_section(profile) else {}
 
 
 class EcsContainerCredentialsProvider(CredentialsProvider):
@@ -721,6 +815,7 @@ class AssumeRoleCredentialsProvider(CredentialsProvider):
             ),
             SsoCredentialsProvider(self._client, source_profile),
             ProfileCredentialsProvider(profile=source_profile),
+            ProcessCredentialsProvider(profile=source_profile),
         )
 
 
@@ -853,7 +948,10 @@ def _parse_iso8601(value: str) -> datetime:
     return datetime.fromisoformat(value.replace("Z", "+00:00"))
 
 
-def _credentials_from_json(data: dict[str, object]) -> Credentials:
+def _credentials_from_json(
+    data: dict[str, object], *, token_key: str = "Token"
+) -> Credentials:
+    # ECS and IMDS name the session token Token; credential_process names it SessionToken
     ak = data.get("AccessKeyId")
     sk = data.get("SecretAccessKey")
     if not isinstance(ak, str) or not isinstance(sk, str):
@@ -861,7 +959,7 @@ def _credentials_from_json(data: dict[str, object]) -> Credentials:
             "credentials response missing AccessKeyId/SecretAccessKey"
         )
     out: Credentials = {"access_key": ak, "secret_key": sk}
-    token = data.get("Token")
+    token = data.get(token_key)
     if isinstance(token, str):
         out["session_token"] = token
     exp = data.get("Expiration")
@@ -880,6 +978,7 @@ def default_aws_credentials_chain(
             WebIdentityCredentialsProvider(client),
             SsoCredentialsProvider(client),
             ProfileCredentialsProvider(),
+            ProcessCredentialsProvider(),
             EcsContainerCredentialsProvider(client),
             Ec2InstanceMetadataProvider(client),
         )

capo_cloudcontrol-0.9.0/src/capo_cloudcontrol/_aws.py

@@ -0,0 +1,28 @@
+"""Error codes and HTTP statuses that are retried whether or not the model marks them @retryable."""
+
+# Transient: retried with the normal backoff.
+KNOWN_RETRYABLE_STATUSES = frozenset({500, 502, 503, 504})
+KNOWN_RETRYABLE_CODES = frozenset(
+    {"PriorRequestNotComplete", "RequestTimeout", "RequestTimeoutException"}
+)
+
+# Throttling: retried with the longer throttling backoff.
+KNOWN_THROTTLING_STATUSES = frozenset({429})
+KNOWN_THROTTLING_CODES = frozenset(
+    {
+        "BandwidthLimitExceeded",
+        "EC2ThrottledException",
+        "LimitExceededException",
+        "PriorRequestNotComplete",
+        "ProvisionedThroughputExceededException",
+        "RequestLimitExceeded",
+        "RequestThrottled",
+        "RequestThrottledException",
+        "SlowDown",
+        "ThrottledException",
+        "Throttling",
+        "ThrottlingException",
+        "TooManyRequestsException",
+        "TransactionInProgressException",
+    }
+)

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/src/capo_cloudcontrol/_operations/cloud_api_service/cancel_resource_request.py

@@ -32,11 +32,11 @@ def handle_error(response: zapros.Response) -> Never:
     match code:
         case "ConcurrentModificationException":
             raise capo_cloudcontrol.errors.concurrent_modification_exception.ConcurrentModificationException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "RequestTokenNotFoundException":
             raise capo_cloudcontrol.errors.request_token_not_found_exception.RequestTokenNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case _:
             raise UnknownServiceError(code=code, message=message, response=response)

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/src/capo_cloudcontrol/_operations/cloud_api_service/create_resource.py

@@ -49,79 +49,79 @@ def handle_error(response: zapros.Response) -> Never:
     match code:
         case "AlreadyExistsException":
             raise capo_cloudcontrol.errors.already_exists_exception.AlreadyExistsException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ClientTokenConflictException":
             raise capo_cloudcontrol.errors.client_token_conflict_exception.ClientTokenConflictException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ConcurrentOperationException":
             raise capo_cloudcontrol.errors.concurrent_operation_exception.ConcurrentOperationException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "GeneralServiceException":
             raise capo_cloudcontrol.errors.general_service_exception.GeneralServiceException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "HandlerFailureException":
             raise capo_cloudcontrol.errors.handler_failure_exception.HandlerFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "HandlerInternalFailureException":
             raise capo_cloudcontrol.errors.handler_internal_failure_exception.HandlerInternalFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "InvalidCredentialsException":
             raise capo_cloudcontrol.errors.invalid_credentials_exception.InvalidCredentialsException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "InvalidRequestException":
             raise capo_cloudcontrol.errors.invalid_request_exception.InvalidRequestException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NetworkFailureException":
             raise capo_cloudcontrol.errors.network_failure_exception.NetworkFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NotStabilizedException":
             raise capo_cloudcontrol.errors.not_stabilized_exception.NotStabilizedException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NotUpdatableException":
             raise capo_cloudcontrol.errors.not_updatable_exception.NotUpdatableException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "PrivateTypeException":
             raise capo_cloudcontrol.errors.private_type_exception.PrivateTypeException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ResourceConflictException":
             raise capo_cloudcontrol.errors.resource_conflict_exception.ResourceConflictException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ResourceNotFoundException":
             raise capo_cloudcontrol.errors.resource_not_found_exception.ResourceNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ServiceInternalErrorException":
             raise capo_cloudcontrol.errors.service_internal_error_exception.ServiceInternalErrorException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ServiceLimitExceededException":
             raise capo_cloudcontrol.errors.service_limit_exceeded_exception.ServiceLimitExceededException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ThrottlingException":
             raise capo_cloudcontrol.errors.throttling_exception.ThrottlingException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "TypeNotFoundException":
             raise capo_cloudcontrol.errors.type_not_found_exception.TypeNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "UnsupportedActionException":
             raise capo_cloudcontrol.errors.unsupported_action_exception.UnsupportedActionException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case _:
             raise UnknownServiceError(code=code, message=message, response=response)

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/src/capo_cloudcontrol/_operations/cloud_api_service/delete_resource.py

@@ -49,79 +49,79 @@ def handle_error(response: zapros.Response) -> Never:
     match code:
         case "AlreadyExistsException":
             raise capo_cloudcontrol.errors.already_exists_exception.AlreadyExistsException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ClientTokenConflictException":
             raise capo_cloudcontrol.errors.client_token_conflict_exception.ClientTokenConflictException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ConcurrentOperationException":
             raise capo_cloudcontrol.errors.concurrent_operation_exception.ConcurrentOperationException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "GeneralServiceException":
             raise capo_cloudcontrol.errors.general_service_exception.GeneralServiceException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "HandlerFailureException":
             raise capo_cloudcontrol.errors.handler_failure_exception.HandlerFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "HandlerInternalFailureException":
             raise capo_cloudcontrol.errors.handler_internal_failure_exception.HandlerInternalFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "InvalidCredentialsException":
             raise capo_cloudcontrol.errors.invalid_credentials_exception.InvalidCredentialsException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "InvalidRequestException":
             raise capo_cloudcontrol.errors.invalid_request_exception.InvalidRequestException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NetworkFailureException":
             raise capo_cloudcontrol.errors.network_failure_exception.NetworkFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NotStabilizedException":
             raise capo_cloudcontrol.errors.not_stabilized_exception.NotStabilizedException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NotUpdatableException":
             raise capo_cloudcontrol.errors.not_updatable_exception.NotUpdatableException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "PrivateTypeException":
             raise capo_cloudcontrol.errors.private_type_exception.PrivateTypeException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ResourceConflictException":
             raise capo_cloudcontrol.errors.resource_conflict_exception.ResourceConflictException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ResourceNotFoundException":
             raise capo_cloudcontrol.errors.resource_not_found_exception.ResourceNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ServiceInternalErrorException":
             raise capo_cloudcontrol.errors.service_internal_error_exception.ServiceInternalErrorException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ServiceLimitExceededException":
             raise capo_cloudcontrol.errors.service_limit_exceeded_exception.ServiceLimitExceededException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ThrottlingException":
             raise capo_cloudcontrol.errors.throttling_exception.ThrottlingException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "TypeNotFoundException":
             raise capo_cloudcontrol.errors.type_not_found_exception.TypeNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "UnsupportedActionException":
             raise capo_cloudcontrol.errors.unsupported_action_exception.UnsupportedActionException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case _:
             raise UnknownServiceError(code=code, message=message, response=response)

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/src/capo_cloudcontrol/_operations/cloud_api_service/get_resource.py

@@ -47,71 +47,71 @@ def handle_error(response: zapros.Response) -> Never:
     match code:
         case "AlreadyExistsException":
             raise capo_cloudcontrol.errors.already_exists_exception.AlreadyExistsException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "GeneralServiceException":
             raise capo_cloudcontrol.errors.general_service_exception.GeneralServiceException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "HandlerFailureException":
             raise capo_cloudcontrol.errors.handler_failure_exception.HandlerFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "HandlerInternalFailureException":
             raise capo_cloudcontrol.errors.handler_internal_failure_exception.HandlerInternalFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "InvalidCredentialsException":
             raise capo_cloudcontrol.errors.invalid_credentials_exception.InvalidCredentialsException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "InvalidRequestException":
             raise capo_cloudcontrol.errors.invalid_request_exception.InvalidRequestException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NetworkFailureException":
             raise capo_cloudcontrol.errors.network_failure_exception.NetworkFailureException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NotStabilizedException":
             raise capo_cloudcontrol.errors.not_stabilized_exception.NotStabilizedException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "NotUpdatableException":
             raise capo_cloudcontrol.errors.not_updatable_exception.NotUpdatableException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "PrivateTypeException":
             raise capo_cloudcontrol.errors.private_type_exception.PrivateTypeException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ResourceConflictException":
             raise capo_cloudcontrol.errors.resource_conflict_exception.ResourceConflictException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ResourceNotFoundException":
             raise capo_cloudcontrol.errors.resource_not_found_exception.ResourceNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ServiceInternalErrorException":
             raise capo_cloudcontrol.errors.service_internal_error_exception.ServiceInternalErrorException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ServiceLimitExceededException":
             raise capo_cloudcontrol.errors.service_limit_exceeded_exception.ServiceLimitExceededException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "ThrottlingException":
             raise capo_cloudcontrol.errors.throttling_exception.ThrottlingException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "TypeNotFoundException":
             raise capo_cloudcontrol.errors.type_not_found_exception.TypeNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case "UnsupportedActionException":
             raise capo_cloudcontrol.errors.unsupported_action_exception.UnsupportedActionException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case _:
             raise UnknownServiceError(code=code, message=message, response=response)

{capo_cloudcontrol-0.7.0 → capo_cloudcontrol-0.9.0}/src/capo_cloudcontrol/_operations/cloud_api_service/get_resource_request_status.py

@@ -32,7 +32,7 @@ def handle_error(response: zapros.Response) -> Never:
     match code:
         case "RequestTokenNotFoundException":
             raise capo_cloudcontrol.errors.request_token_not_found_exception.RequestTokenNotFoundException.from_aws_json_1_0(
-                data, message
+                data, message, response=response
             )
         case _:
             raise UnknownServiceError(code=code, message=message, response=response)