go.mod: update osbuild/images to v0.156.0

tag v0.155.0
Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com>

Changes with 0.155.0

----------------
  * Fedora 43: add shadow-utils when LockRoot is enabled, update cloud-init service name (osbuild/images#1618)
    * Author: Achilleas Koutsou, Reviewers: Gianluca Zuccarelli, Michael Vogt
  * Update osbuild dependency commit ID to latest (osbuild/images#1609)
    * Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger, Tomáš Hozza
  * Update snapshots to 20250626 (osbuild/images#1623)
    * Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
  * distro/rhel9: xz compress azure-cvm image type [HMS-8587] (osbuild/images#1620)
    * Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza
  * distro/rhel: introduce new image type: Azure SAP Apps [HMS-8738] (osbuild/images#1612)
    * Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza
  * distro/rhel: move ansible-core to sap_extras_pkgset (osbuild/images#1624)
    * Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Tomáš Hozza
  * github/create-tag: allow passing the version when run manually (osbuild/images#1621)
    * Author: Achilleas Koutsou, Reviewers: Lukáš Zapletal, Tomáš Hozza
  * rhel9: move image-config into pure YAML (HMS-8593) (osbuild/images#1616)
    * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger
  * test: split manifest checksums into separate files (osbuild/images#1625)
    * Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza

— Somewhere on the Internet, 2025-06-30

---

tag v0.156.0
Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com>

Changes with 0.156.0

----------------
  * Many: delete repositories for EOL distributions (HMS-7044) (osbuild/images#1607)
    * Author: Tomáš Hozza, Reviewers: Michael Vogt, Simon de Vlieger
  * RHSM/facts: add 'image-builder CLI' API type (osbuild/images#1640)
    * Author: Tomáš Hozza, Reviewers: Brian C. Lane, Simon de Vlieger
  * Update dependencies 2025-06-29 (osbuild/images#1628)
    * Author: SchutzBot, Reviewers: Simon de Vlieger, Tomáš Hozza
  * Update osbuild dependency commit ID to latest (osbuild/images#1627)
    * Author: SchutzBot, Reviewers: Simon de Vlieger, Tomáš Hozza
  * [RFC] image: drop `InstallWeakDeps` from image.DiskImage (osbuild/images#1642)
    * Author: Michael Vogt, Reviewers: Brian C. Lane, Simon de Vlieger, Tomáš Hozza
  * build(deps): bump the go-deps group across 1 directory with 3 updates (osbuild/images#1632)
    * Author: dependabot[bot], Reviewers: SchutzBot, Tomáš Hozza
  * distro/rhel10: xz compress azure-cvm image type (osbuild/images#1638)
    * Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Simon de Vlieger
  * distro: cleanup/refactor distro/{defs,generic} (HMS-8744) (osbuild/images#1570)
    * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza
  * distro: remove some hardcoded values from generic/images.go (osbuild/images#1636)
    * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza
  * distro: small tweaks for the YAML based imagetypes (osbuild/images#1622)
    * Author: Michael Vogt, Reviewers: Brian C. Lane, Simon de Vlieger
  * fedora/wsl: packages and locale (osbuild/images#1635)
    * Author: Simon de Vlieger, Reviewers: Michael Vogt, Tomáš Hozza
  * image/many: make compression more generic (osbuild/images#1634)
    * Author: Simon de Vlieger, Reviewers: Brian C. Lane, Michael Vogt
  * manifest: handle content template name with spaces (osbuild/images#1641)
    * Author: Bryttanie, Reviewers: Brian C. Lane, Michael Vogt, Tomáš Hozza
  * many: implement gzip (osbuild/images#1633)
    * Author: Simon de Vlieger, Reviewers: Michael Vogt, Tomáš Hozza
  * rhel/azure: set GRUB_TERMINAL based on architecture [RHEL-91383] (osbuild/images#1626)
    * Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza

— Somewhere on the Internet, 2025-07-07

---
This commit is contained in:
Achilleas Koutsou 2025-07-10 16:14:25 +02:00
parent 60c5f10af8
commit 3fd7092db5
1486 changed files with 124742 additions and 82516 deletions

33
vendor/github.com/aws/aws-sdk-go-v2/aws/checksum.go generated vendored Normal file
View file

@ -0,0 +1,33 @@
package aws
// RequestChecksumCalculation controls request checksum calculation workflow
type RequestChecksumCalculation int
const (
// RequestChecksumCalculationUnset is the unset value for RequestChecksumCalculation
RequestChecksumCalculationUnset RequestChecksumCalculation = iota
// RequestChecksumCalculationWhenSupported indicates request checksum will be calculated
// if the operation supports input checksums
RequestChecksumCalculationWhenSupported
// RequestChecksumCalculationWhenRequired indicates request checksum will be calculated
// if required by the operation or if user elects to set a checksum algorithm in request
RequestChecksumCalculationWhenRequired
)
// ResponseChecksumValidation controls response checksum validation workflow
type ResponseChecksumValidation int
const (
// ResponseChecksumValidationUnset is the unset value for ResponseChecksumValidation
ResponseChecksumValidationUnset ResponseChecksumValidation = iota
// ResponseChecksumValidationWhenSupported indicates response checksum will be validated
// if the operation supports output checksums
ResponseChecksumValidationWhenSupported
// ResponseChecksumValidationWhenRequired indicates response checksum will only
// be validated if the operation requires output checksum validation
ResponseChecksumValidationWhenRequired
)

View file

@ -165,6 +165,33 @@ type Config struct {
// Controls how a resolved AWS account ID is handled for endpoint routing.
AccountIDEndpointMode AccountIDEndpointMode
// RequestChecksumCalculation determines when request checksum calculation is performed.
//
// There are two possible values for this setting:
//
// 1. RequestChecksumCalculationWhenSupported (default): The checksum is always calculated
// if the operation supports it, regardless of whether the user sets an algorithm in the request.
//
// 2. RequestChecksumCalculationWhenRequired: The checksum is only calculated if the user
// explicitly sets a checksum algorithm in the request.
//
// This setting is sourced from the environment variable AWS_REQUEST_CHECKSUM_CALCULATION
// or the shared config profile attribute "request_checksum_calculation".
RequestChecksumCalculation RequestChecksumCalculation
// ResponseChecksumValidation determines when response checksum validation is performed
//
// There are two possible values for this setting:
//
// 1. ResponseChecksumValidationWhenSupported (default): The checksum is always validated
// if the operation supports it, regardless of whether the user sets the validation mode to ENABLED in request.
//
// 2. ResponseChecksumValidationWhenRequired: The checksum is only validated if the user
// explicitly sets the validation mode to ENABLED in the request
// This variable is sourced from environment variable AWS_RESPONSE_CHECKSUM_VALIDATION or
// the shared config profile attribute "response_checksum_validation".
ResponseChecksumValidation ResponseChecksumValidation
}
// NewConfig returns a new Config pointer that can be chained with builder

View file

@ -172,6 +172,17 @@ func (p *CredentialsCache) getCreds() (Credentials, bool) {
return *c, true
}
// ProviderSources returns a list of where the underlying credential provider
// has been sourced, if available. Returns empty if the provider doesn't implement
// the interface
func (p *CredentialsCache) ProviderSources() []CredentialSource {
asSource, ok := p.provider.(CredentialProviderSource)
if !ok {
return []CredentialSource{}
}
return asSource.ProviderSources()
}
// Invalidate will invalidate the cached credentials. The next call to Retrieve
// will cause the provider's Retrieve method to be called.
func (p *CredentialsCache) Invalidate() {

View file

@ -70,6 +70,56 @@ func (AnonymousCredentials) Retrieve(context.Context) (Credentials, error) {
fmt.Errorf("the AnonymousCredentials is not a valid credential provider, and cannot be used to sign AWS requests with")
}
// CredentialSource is the source of the credential provider.
// A provider can have multiple credential sources: For example, a provider that reads a profile, calls ECS to
// get credentials and then assumes a role using STS will have all these as part of its provider chain.
type CredentialSource int
const (
// CredentialSourceUndefined is the sentinel zero value
CredentialSourceUndefined CredentialSource = iota
// CredentialSourceCode credentials resolved from code, cli parameters, session object, or client instance
CredentialSourceCode
// CredentialSourceEnvVars credentials resolved from environment variables
CredentialSourceEnvVars
// CredentialSourceEnvVarsSTSWebIDToken credentials resolved from environment variables for assuming a role with STS using a web identity token
CredentialSourceEnvVarsSTSWebIDToken
// CredentialSourceSTSAssumeRole credentials resolved from STS using AssumeRole
CredentialSourceSTSAssumeRole
// CredentialSourceSTSAssumeRoleSaml credentials resolved from STS using assume role with SAML
CredentialSourceSTSAssumeRoleSaml
// CredentialSourceSTSAssumeRoleWebID credentials resolved from STS using assume role with web identity
CredentialSourceSTSAssumeRoleWebID
// CredentialSourceSTSFederationToken credentials resolved from STS using a federation token
CredentialSourceSTSFederationToken
// CredentialSourceSTSSessionToken credentials resolved from STS using a session token S
CredentialSourceSTSSessionToken
// CredentialSourceProfile credentials resolved from a config file(s) profile with static credentials
CredentialSourceProfile
// CredentialSourceProfileSourceProfile credentials resolved from a source profile in a config file(s) profile
CredentialSourceProfileSourceProfile
// CredentialSourceProfileNamedProvider credentials resolved from a named provider in a config file(s) profile (like EcsContainer)
CredentialSourceProfileNamedProvider
// CredentialSourceProfileSTSWebIDToken credentials resolved from configuration for assuming a role with STS using web identity token in a config file(s) profile
CredentialSourceProfileSTSWebIDToken
// CredentialSourceProfileSSO credentials resolved from an SSO session in a config file(s) profile
CredentialSourceProfileSSO
// CredentialSourceSSO credentials resolved from an SSO session
CredentialSourceSSO
// CredentialSourceProfileSSOLegacy credentials resolved from an SSO session in a config file(s) profile using legacy format
CredentialSourceProfileSSOLegacy
// CredentialSourceSSOLegacy credentials resolved from an SSO session using legacy format
CredentialSourceSSOLegacy
// CredentialSourceProfileProcess credentials resolved from a process in a config file(s) profile
CredentialSourceProfileProcess
// CredentialSourceProcess credentials resolved from a process
CredentialSourceProcess
// CredentialSourceHTTP credentials resolved from an HTTP endpoint
CredentialSourceHTTP
// CredentialSourceIMDS credentials resolved from the instance metadata service (IMDS)
CredentialSourceIMDS
)
// A Credentials is the AWS credentials value for individual credential fields.
type Credentials struct {
// AWS Access key ID
@ -125,6 +175,13 @@ type CredentialsProvider interface {
Retrieve(ctx context.Context) (Credentials, error)
}
// CredentialProviderSource allows any credential provider to track
// all providers where a credential provider were sourced. For example, if the credentials came from a
// call to a role specified in the profile, this method will give the whole breadcrumb trail
type CredentialProviderSource interface {
ProviderSources() []CredentialSource
}
// CredentialsProviderFunc provides a helper wrapping a function value to
// satisfy the CredentialsProvider interface.
type CredentialsProviderFunc func(context.Context) (Credentials, error)

View file

@ -3,4 +3,4 @@
package aws
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.32.7"
const goModuleVersion = "1.36.3"

View file

@ -76,21 +76,90 @@ type UserAgentFeature string
// Enumerates UserAgentFeature.
const (
UserAgentFeatureResourceModel UserAgentFeature = "A" // n/a (we don't generate separate resource types)
UserAgentFeatureWaiter = "B"
UserAgentFeaturePaginator = "C"
UserAgentFeatureRetryModeLegacy = "D" // n/a (equivalent to standard)
UserAgentFeatureRetryModeStandard = "E"
UserAgentFeatureRetryModeAdaptive = "F"
UserAgentFeatureS3Transfer = "G"
UserAgentFeatureS3CryptoV1N = "H" // n/a (crypto client is external)
UserAgentFeatureS3CryptoV2 = "I" // n/a
UserAgentFeatureS3ExpressBucket = "J"
UserAgentFeatureS3AccessGrants = "K" // not yet implemented
UserAgentFeatureGZIPRequestCompression = "L"
UserAgentFeatureProtocolRPCV2CBOR = "M"
UserAgentFeatureResourceModel UserAgentFeature = "A" // n/a (we don't generate separate resource types)
UserAgentFeatureWaiter = "B"
UserAgentFeaturePaginator = "C"
UserAgentFeatureRetryModeLegacy = "D" // n/a (equivalent to standard)
UserAgentFeatureRetryModeStandard = "E"
UserAgentFeatureRetryModeAdaptive = "F"
UserAgentFeatureS3Transfer = "G"
UserAgentFeatureS3CryptoV1N = "H" // n/a (crypto client is external)
UserAgentFeatureS3CryptoV2 = "I" // n/a
UserAgentFeatureS3ExpressBucket = "J"
UserAgentFeatureS3AccessGrants = "K" // not yet implemented
UserAgentFeatureGZIPRequestCompression = "L"
UserAgentFeatureProtocolRPCV2CBOR = "M"
UserAgentFeatureAccountIDEndpoint = "O" // DO NOT IMPLEMENT: rules output is not currently defined. SDKs should not parse endpoints for feature information.
UserAgentFeatureAccountIDModePreferred = "P"
UserAgentFeatureAccountIDModeDisabled = "Q"
UserAgentFeatureAccountIDModeRequired = "R"
UserAgentFeatureRequestChecksumCRC32 = "U"
UserAgentFeatureRequestChecksumCRC32C = "V"
UserAgentFeatureRequestChecksumCRC64 = "W"
UserAgentFeatureRequestChecksumSHA1 = "X"
UserAgentFeatureRequestChecksumSHA256 = "Y"
UserAgentFeatureRequestChecksumWhenSupported = "Z"
UserAgentFeatureRequestChecksumWhenRequired = "a"
UserAgentFeatureResponseChecksumWhenSupported = "b"
UserAgentFeatureResponseChecksumWhenRequired = "c"
UserAgentFeatureDynamoDBUserAgent = "d" // not yet implemented
UserAgentFeatureCredentialsCode = "e"
UserAgentFeatureCredentialsJvmSystemProperties = "f" // n/a (this is not a JVM sdk)
UserAgentFeatureCredentialsEnvVars = "g"
UserAgentFeatureCredentialsEnvVarsStsWebIDToken = "h"
UserAgentFeatureCredentialsStsAssumeRole = "i"
UserAgentFeatureCredentialsStsAssumeRoleSaml = "j" // not yet implemented
UserAgentFeatureCredentialsStsAssumeRoleWebID = "k"
UserAgentFeatureCredentialsStsFederationToken = "l" // not yet implemented
UserAgentFeatureCredentialsStsSessionToken = "m" // not yet implemented
UserAgentFeatureCredentialsProfile = "n"
UserAgentFeatureCredentialsProfileSourceProfile = "o"
UserAgentFeatureCredentialsProfileNamedProvider = "p"
UserAgentFeatureCredentialsProfileStsWebIDToken = "q"
UserAgentFeatureCredentialsProfileSso = "r"
UserAgentFeatureCredentialsSso = "s"
UserAgentFeatureCredentialsProfileSsoLegacy = "t"
UserAgentFeatureCredentialsSsoLegacy = "u"
UserAgentFeatureCredentialsProfileProcess = "v"
UserAgentFeatureCredentialsProcess = "w"
UserAgentFeatureCredentialsBoto2ConfigFile = "x" // n/a (this is not boto/Python)
UserAgentFeatureCredentialsAwsSdkStore = "y" // n/a (this is used by .NET based sdk)
UserAgentFeatureCredentialsHTTP = "z"
UserAgentFeatureCredentialsIMDS = "0"
)
var credentialSourceToFeature = map[aws.CredentialSource]UserAgentFeature{
aws.CredentialSourceCode: UserAgentFeatureCredentialsCode,
aws.CredentialSourceEnvVars: UserAgentFeatureCredentialsEnvVars,
aws.CredentialSourceEnvVarsSTSWebIDToken: UserAgentFeatureCredentialsEnvVarsStsWebIDToken,
aws.CredentialSourceSTSAssumeRole: UserAgentFeatureCredentialsStsAssumeRole,
aws.CredentialSourceSTSAssumeRoleSaml: UserAgentFeatureCredentialsStsAssumeRoleSaml,
aws.CredentialSourceSTSAssumeRoleWebID: UserAgentFeatureCredentialsStsAssumeRoleWebID,
aws.CredentialSourceSTSFederationToken: UserAgentFeatureCredentialsStsFederationToken,
aws.CredentialSourceSTSSessionToken: UserAgentFeatureCredentialsStsSessionToken,
aws.CredentialSourceProfile: UserAgentFeatureCredentialsProfile,
aws.CredentialSourceProfileSourceProfile: UserAgentFeatureCredentialsProfileSourceProfile,
aws.CredentialSourceProfileNamedProvider: UserAgentFeatureCredentialsProfileNamedProvider,
aws.CredentialSourceProfileSTSWebIDToken: UserAgentFeatureCredentialsProfileStsWebIDToken,
aws.CredentialSourceProfileSSO: UserAgentFeatureCredentialsProfileSso,
aws.CredentialSourceSSO: UserAgentFeatureCredentialsSso,
aws.CredentialSourceProfileSSOLegacy: UserAgentFeatureCredentialsProfileSsoLegacy,
aws.CredentialSourceSSOLegacy: UserAgentFeatureCredentialsSsoLegacy,
aws.CredentialSourceProfileProcess: UserAgentFeatureCredentialsProfileProcess,
aws.CredentialSourceProcess: UserAgentFeatureCredentialsProcess,
aws.CredentialSourceHTTP: UserAgentFeatureCredentialsHTTP,
aws.CredentialSourceIMDS: UserAgentFeatureCredentialsIMDS,
}
// RequestUserAgent is a build middleware that set the User-Agent for the request.
type RequestUserAgent struct {
sdkAgent, userAgent *smithyhttp.UserAgentBuilder
@ -243,6 +312,14 @@ func (u *RequestUserAgent) AddSDKAgentKeyValue(keyType SDKAgentKeyType, key, val
u.userAgent.AddKeyValue(keyType.string(), strings.Map(rules, key)+"#"+strings.Map(rules, value))
}
// AddCredentialsSource adds the credential source as a feature on the User-Agent string
func (u *RequestUserAgent) AddCredentialsSource(source aws.CredentialSource) {
x, ok := credentialSourceToFeature[source]
if ok {
u.AddUserAgentFeature(x)
}
}
// ID the name of the middleware.
func (u *RequestUserAgent) ID() string {
return "UserAgent"

View file

@ -1,8 +1,8 @@
package query
import (
"fmt"
"net/url"
"strconv"
)
// Array represents the encoding of Query lists and sets. A Query array is a
@ -21,19 +21,8 @@ type Array struct {
// keys for each element in the list. For example, an entry might have the
// key "ParentStructure.ListName.member.MemberName.1".
//
// While this is currently represented as a string that gets added to, it
// could also be represented as a stack that only gets condensed into a
// string when a finalized key is created. This could potentially reduce
// allocations.
// When the array is not flat the prefix will contain the memberName otherwise the memberName is ignored
prefix string
// Whether the list is flat or not. A list that is not flat will produce the
// following entry to the url.Values for a given entry:
// ListName.MemberName.1=value
// A list that is flat will produce the following:
// ListName.1=value
flat bool
// The location name of the member. In most cases this should be "member".
memberName string
// Elements are stored in values, so we keep track of the list size here.
size int32
// Empty lists are encoded as "<prefix>=", if we add a value later we will
@ -45,11 +34,14 @@ func newArray(values url.Values, prefix string, flat bool, memberName string) *A
emptyValue := newValue(values, prefix, flat)
emptyValue.String("")
if !flat {
// This uses string concatenation in place of fmt.Sprintf as fmt.Sprintf has a much higher resource overhead
prefix = prefix + keySeparator + memberName
}
return &Array{
values: values,
prefix: prefix,
flat: flat,
memberName: memberName,
emptyValue: emptyValue,
}
}
@ -63,10 +55,7 @@ func (a *Array) Value() Value {
// Query lists start a 1, so adjust the size first
a.size++
prefix := a.prefix
if !a.flat {
prefix = fmt.Sprintf("%s.%s", prefix, a.memberName)
}
// Lists can't have flat members
return newValue(a.values, fmt.Sprintf("%s.%d", prefix, a.size), false)
// This uses string concatenation in place of fmt.Sprintf as fmt.Sprintf has a much higher resource overhead
return newValue(a.values, a.prefix+keySeparator+strconv.FormatInt(int64(a.size), 10), false)
}

View file

@ -1,9 +1,6 @@
package query
import (
"fmt"
"net/url"
)
import "net/url"
// Object represents the encoding of Query structures and unions. A Query
// object is a representation of a mapping of string keys to arbitrary
@ -56,14 +53,16 @@ func (o *Object) FlatKey(name string) Value {
func (o *Object) key(name string, flatValue bool) Value {
if o.prefix != "" {
return newValue(o.values, fmt.Sprintf("%s.%s", o.prefix, name), flatValue)
// This uses string concatenation in place of fmt.Sprintf as fmt.Sprintf has a much higher resource overhead
return newValue(o.values, o.prefix+keySeparator+name, flatValue)
}
return newValue(o.values, name, flatValue)
}
func (o *Object) keyWithValues(name string, flatValue bool) Value {
if o.prefix != "" {
return newAppendValue(o.values, fmt.Sprintf("%s.%s", o.prefix, name), flatValue)
// This uses string concatenation in place of fmt.Sprintf as fmt.Sprintf has a much higher resource overhead
return newAppendValue(o.values, o.prefix+keySeparator+name, flatValue)
}
return newAppendValue(o.values, name, flatValue)
}

View file

@ -7,6 +7,8 @@ import (
"github.com/aws/smithy-go/encoding/httpbinding"
)
const keySeparator = "."
// Value represents a Query Value type.
type Value struct {
// The query values to add the value to.

View file

@ -116,7 +116,13 @@ func (r RetryableConnectionError) IsErrorRetryable(err error) aws.Ternary {
case errors.As(err, &conErr) && conErr.ConnectionError():
retryable = true
case strings.Contains(err.Error(), "use of closed network connection"):
fallthrough
case strings.Contains(err.Error(), "connection reset"):
// The errors "connection reset" and "use of closed network connection"
// are effectively the same. It appears to be the difference between
// sync and async read of TCP RST in the stdlib's net.Conn read loop.
// see #2737
retryable = true
case errors.As(err, &urlErr):

View file

@ -4,10 +4,11 @@ package v4
var IgnoredHeaders = Rules{
ExcludeList{
MapRule{
"Authorization": struct{}{},
"User-Agent": struct{}{},
"X-Amzn-Trace-Id": struct{}{},
"Expect": struct{}{},
"Authorization": struct{}{},
"User-Agent": struct{}{},
"X-Amzn-Trace-Id": struct{}{},
"Expect": struct{}{},
"Transfer-Encoding": struct{}{},
},
},
}

View file

@ -1,3 +1,67 @@
# v1.29.10 (2025-03-24)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.9 (2025-03-04.2)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.8 (2025-02-27)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.7 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.6 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.5 (2025-02-04)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.4 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.3 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.2 (2025-01-24)
* **Bug Fix**: Fix env config naming and usage of deprecated ioutil
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.29.1 (2025-01-17)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.29.0 (2025-01-15)
* **Feature**: S3 client behavior is updated to always calculate a checksum by default for operations that support it (such as PutObject or UploadPart), or require it (such as DeleteObjects). The checksum algorithm used by default now becomes CRC32. Checksum behavior can be configured using `when_supported` and `when_required` options - in code using RequestChecksumCalculation, in shared config using request_checksum_calculation, or as env variable using AWS_REQUEST_CHECKSUM_CALCULATION. The S3 client attempts to validate response checksums for all S3 API operations that support checksums. However, if the SDK has not implemented the specified checksum algorithm then this validation is skipped. Checksum validation behavior can be configured using `when_supported` and `when_required` options - in code using ResponseChecksumValidation, in shared config using response_checksum_validation, or as env variable using AWS_RESPONSE_CHECKSUM_VALIDATION.
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.11 (2025-01-14)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.10 (2025-01-10)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.9 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.8 (2025-01-08)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.7 (2024-12-19)
* **Bug Fix**: Fix improper use of printf-style functions.

View file

@ -83,6 +83,12 @@ var defaultAWSConfigResolvers = []awsConfigResolver{
// Sets the AccountIDEndpointMode if present in env var or shared config profile
resolveAccountIDEndpointMode,
// Sets the RequestChecksumCalculation if present in env var or shared config profile
resolveRequestChecksumCalculation,
// Sets the ResponseChecksumValidation if present in env var or shared config profile
resolveResponseChecksumValidation,
}
// A Config represents a generic configuration value or set of values. This type
@ -212,7 +218,7 @@ func resolveConfigLoaders(options *LoadOptions) []loader {
loaders[0] = loadEnvConfig
// specification of a profile should cause a load failure if it doesn't exist
if os.Getenv(awsProfileEnvVar) != "" || options.SharedConfigProfile != "" {
if os.Getenv(awsProfileEnv) != "" || options.SharedConfigProfile != "" {
loaders[1] = loadSharedConfig
} else {
loaders[1] = loadSharedConfigIgnoreNotExist

View file

@ -5,7 +5,6 @@ import (
"context"
"fmt"
"io"
"io/ioutil"
"os"
"strconv"
"strings"
@ -21,86 +20,89 @@ const CredentialsSourceName = "EnvConfigCredentials"
// Environment variables that will be read for configuration values.
const (
awsAccessKeyIDEnvVar = "AWS_ACCESS_KEY_ID"
awsAccessKeyEnvVar = "AWS_ACCESS_KEY"
awsAccessKeyIDEnv = "AWS_ACCESS_KEY_ID"
awsAccessKeyEnv = "AWS_ACCESS_KEY"
awsSecretAccessKeyEnvVar = "AWS_SECRET_ACCESS_KEY"
awsSecretKeyEnvVar = "AWS_SECRET_KEY"
awsSecretAccessKeyEnv = "AWS_SECRET_ACCESS_KEY"
awsSecretKeyEnv = "AWS_SECRET_KEY"
awsSessionTokenEnvVar = "AWS_SESSION_TOKEN"
awsSessionTokenEnv = "AWS_SESSION_TOKEN"
awsContainerCredentialsEndpointEnvVar = "AWS_CONTAINER_CREDENTIALS_FULL_URI"
awsContainerCredentialsRelativePathEnvVar = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
awsContainerPProviderAuthorizationEnvVar = "AWS_CONTAINER_AUTHORIZATION_TOKEN"
awsContainerCredentialsFullURIEnv = "AWS_CONTAINER_CREDENTIALS_FULL_URI"
awsContainerCredentialsRelativeURIEnv = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
awsContainerAuthorizationTokenEnv = "AWS_CONTAINER_AUTHORIZATION_TOKEN"
awsRegionEnvVar = "AWS_REGION"
awsDefaultRegionEnvVar = "AWS_DEFAULT_REGION"
awsRegionEnv = "AWS_REGION"
awsDefaultRegionEnv = "AWS_DEFAULT_REGION"
awsProfileEnvVar = "AWS_PROFILE"
awsDefaultProfileEnvVar = "AWS_DEFAULT_PROFILE"
awsProfileEnv = "AWS_PROFILE"
awsDefaultProfileEnv = "AWS_DEFAULT_PROFILE"
awsSharedCredentialsFileEnvVar = "AWS_SHARED_CREDENTIALS_FILE"
awsSharedCredentialsFileEnv = "AWS_SHARED_CREDENTIALS_FILE"
awsConfigFileEnvVar = "AWS_CONFIG_FILE"
awsConfigFileEnv = "AWS_CONFIG_FILE"
awsCustomCABundleEnvVar = "AWS_CA_BUNDLE"
awsCABundleEnv = "AWS_CA_BUNDLE"
awsWebIdentityTokenFilePathEnvVar = "AWS_WEB_IDENTITY_TOKEN_FILE"
awsWebIdentityTokenFileEnv = "AWS_WEB_IDENTITY_TOKEN_FILE"
awsRoleARNEnvVar = "AWS_ROLE_ARN"
awsRoleSessionNameEnvVar = "AWS_ROLE_SESSION_NAME"
awsRoleARNEnv = "AWS_ROLE_ARN"
awsRoleSessionNameEnv = "AWS_ROLE_SESSION_NAME"
awsEnableEndpointDiscoveryEnvVar = "AWS_ENABLE_ENDPOINT_DISCOVERY"
awsEnableEndpointDiscoveryEnv = "AWS_ENABLE_ENDPOINT_DISCOVERY"
awsS3UseARNRegionEnvVar = "AWS_S3_USE_ARN_REGION"
awsS3UseARNRegionEnv = "AWS_S3_USE_ARN_REGION"
awsEc2MetadataServiceEndpointModeEnvVar = "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE"
awsEc2MetadataServiceEndpointModeEnv = "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE"
awsEc2MetadataServiceEndpointEnvVar = "AWS_EC2_METADATA_SERVICE_ENDPOINT"
awsEc2MetadataServiceEndpointEnv = "AWS_EC2_METADATA_SERVICE_ENDPOINT"
awsEc2MetadataDisabled = "AWS_EC2_METADATA_DISABLED"
awsEc2MetadataV1DisabledEnvVar = "AWS_EC2_METADATA_V1_DISABLED"
awsEc2MetadataDisabledEnv = "AWS_EC2_METADATA_DISABLED"
awsEc2MetadataV1DisabledEnv = "AWS_EC2_METADATA_V1_DISABLED"
awsS3DisableMultiRegionAccessPointEnvVar = "AWS_S3_DISABLE_MULTIREGION_ACCESS_POINTS"
awsS3DisableMultiRegionAccessPointsEnv = "AWS_S3_DISABLE_MULTIREGION_ACCESS_POINTS"
awsUseDualStackEndpoint = "AWS_USE_DUALSTACK_ENDPOINT"
awsUseDualStackEndpointEnv = "AWS_USE_DUALSTACK_ENDPOINT"
awsUseFIPSEndpoint = "AWS_USE_FIPS_ENDPOINT"
awsUseFIPSEndpointEnv = "AWS_USE_FIPS_ENDPOINT"
awsDefaultMode = "AWS_DEFAULTS_MODE"
awsDefaultsModeEnv = "AWS_DEFAULTS_MODE"
awsRetryMaxAttempts = "AWS_MAX_ATTEMPTS"
awsRetryMode = "AWS_RETRY_MODE"
awsSdkAppID = "AWS_SDK_UA_APP_ID"
awsMaxAttemptsEnv = "AWS_MAX_ATTEMPTS"
awsRetryModeEnv = "AWS_RETRY_MODE"
awsSdkUaAppIDEnv = "AWS_SDK_UA_APP_ID"
awsIgnoreConfiguredEndpoints = "AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"
awsEndpointURL = "AWS_ENDPOINT_URL"
awsIgnoreConfiguredEndpointURLEnv = "AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"
awsEndpointURLEnv = "AWS_ENDPOINT_URL"
awsDisableRequestCompression = "AWS_DISABLE_REQUEST_COMPRESSION"
awsRequestMinCompressionSizeBytes = "AWS_REQUEST_MIN_COMPRESSION_SIZE_BYTES"
awsDisableRequestCompressionEnv = "AWS_DISABLE_REQUEST_COMPRESSION"
awsRequestMinCompressionSizeBytesEnv = "AWS_REQUEST_MIN_COMPRESSION_SIZE_BYTES"
awsS3DisableExpressSessionAuthEnv = "AWS_S3_DISABLE_EXPRESS_SESSION_AUTH"
awsAccountIDEnv = "AWS_ACCOUNT_ID"
awsAccountIDEndpointModeEnv = "AWS_ACCOUNT_ID_ENDPOINT_MODE"
awsRequestChecksumCalculation = "AWS_REQUEST_CHECKSUM_CALCULATION"
awsResponseChecksumValidation = "AWS_RESPONSE_CHECKSUM_VALIDATION"
)
var (
credAccessEnvKeys = []string{
awsAccessKeyIDEnvVar,
awsAccessKeyEnvVar,
awsAccessKeyIDEnv,
awsAccessKeyEnv,
}
credSecretEnvKeys = []string{
awsSecretAccessKeyEnvVar,
awsSecretKeyEnvVar,
awsSecretAccessKeyEnv,
awsSecretKeyEnv,
}
regionEnvKeys = []string{
awsRegionEnvVar,
awsDefaultRegionEnvVar,
awsRegionEnv,
awsDefaultRegionEnv,
}
profileEnvKeys = []string{
awsProfileEnvVar,
awsDefaultProfileEnvVar,
awsProfileEnv,
awsDefaultProfileEnv,
}
)
@ -296,6 +298,12 @@ type EnvConfig struct {
// Indicates whether account ID will be required/ignored in endpoint2.0 routing
AccountIDEndpointMode aws.AccountIDEndpointMode
// Indicates whether request checksum should be calculated
RequestChecksumCalculation aws.RequestChecksumCalculation
// Indicates whether response checksum should be validated
ResponseChecksumValidation aws.ResponseChecksumValidation
}
// loadEnvConfig reads configuration values from the OS's environment variables.
@ -316,79 +324,79 @@ func NewEnvConfig() (EnvConfig, error) {
setStringFromEnvVal(&creds.SecretAccessKey, credSecretEnvKeys)
if creds.HasKeys() {
creds.AccountID = os.Getenv(awsAccountIDEnv)
creds.SessionToken = os.Getenv(awsSessionTokenEnvVar)
creds.SessionToken = os.Getenv(awsSessionTokenEnv)
cfg.Credentials = creds
}
cfg.ContainerCredentialsEndpoint = os.Getenv(awsContainerCredentialsEndpointEnvVar)
cfg.ContainerCredentialsRelativePath = os.Getenv(awsContainerCredentialsRelativePathEnvVar)
cfg.ContainerAuthorizationToken = os.Getenv(awsContainerPProviderAuthorizationEnvVar)
cfg.ContainerCredentialsEndpoint = os.Getenv(awsContainerCredentialsFullURIEnv)
cfg.ContainerCredentialsRelativePath = os.Getenv(awsContainerCredentialsRelativeURIEnv)
cfg.ContainerAuthorizationToken = os.Getenv(awsContainerAuthorizationTokenEnv)
setStringFromEnvVal(&cfg.Region, regionEnvKeys)
setStringFromEnvVal(&cfg.SharedConfigProfile, profileEnvKeys)
cfg.SharedCredentialsFile = os.Getenv(awsSharedCredentialsFileEnvVar)
cfg.SharedConfigFile = os.Getenv(awsConfigFileEnvVar)
cfg.SharedCredentialsFile = os.Getenv(awsSharedCredentialsFileEnv)
cfg.SharedConfigFile = os.Getenv(awsConfigFileEnv)
cfg.CustomCABundle = os.Getenv(awsCustomCABundleEnvVar)
cfg.CustomCABundle = os.Getenv(awsCABundleEnv)
cfg.WebIdentityTokenFilePath = os.Getenv(awsWebIdentityTokenFilePathEnvVar)
cfg.WebIdentityTokenFilePath = os.Getenv(awsWebIdentityTokenFileEnv)
cfg.RoleARN = os.Getenv(awsRoleARNEnvVar)
cfg.RoleSessionName = os.Getenv(awsRoleSessionNameEnvVar)
cfg.RoleARN = os.Getenv(awsRoleARNEnv)
cfg.RoleSessionName = os.Getenv(awsRoleSessionNameEnv)
cfg.AppID = os.Getenv(awsSdkAppID)
cfg.AppID = os.Getenv(awsSdkUaAppIDEnv)
if err := setBoolPtrFromEnvVal(&cfg.DisableRequestCompression, []string{awsDisableRequestCompression}); err != nil {
if err := setBoolPtrFromEnvVal(&cfg.DisableRequestCompression, []string{awsDisableRequestCompressionEnv}); err != nil {
return cfg, err
}
if err := setInt64PtrFromEnvVal(&cfg.RequestMinCompressSizeBytes, []string{awsRequestMinCompressionSizeBytes}, smithyrequestcompression.MaxRequestMinCompressSizeBytes); err != nil {
if err := setInt64PtrFromEnvVal(&cfg.RequestMinCompressSizeBytes, []string{awsRequestMinCompressionSizeBytesEnv}, smithyrequestcompression.MaxRequestMinCompressSizeBytes); err != nil {
return cfg, err
}
if err := setEndpointDiscoveryTypeFromEnvVal(&cfg.EnableEndpointDiscovery, []string{awsEnableEndpointDiscoveryEnvVar}); err != nil {
if err := setEndpointDiscoveryTypeFromEnvVal(&cfg.EnableEndpointDiscovery, []string{awsEnableEndpointDiscoveryEnv}); err != nil {
return cfg, err
}
if err := setBoolPtrFromEnvVal(&cfg.S3UseARNRegion, []string{awsS3UseARNRegionEnvVar}); err != nil {
if err := setBoolPtrFromEnvVal(&cfg.S3UseARNRegion, []string{awsS3UseARNRegionEnv}); err != nil {
return cfg, err
}
setEC2IMDSClientEnableState(&cfg.EC2IMDSClientEnableState, []string{awsEc2MetadataDisabled})
if err := setEC2IMDSEndpointMode(&cfg.EC2IMDSEndpointMode, []string{awsEc2MetadataServiceEndpointModeEnvVar}); err != nil {
setEC2IMDSClientEnableState(&cfg.EC2IMDSClientEnableState, []string{awsEc2MetadataDisabledEnv})
if err := setEC2IMDSEndpointMode(&cfg.EC2IMDSEndpointMode, []string{awsEc2MetadataServiceEndpointModeEnv}); err != nil {
return cfg, err
}
cfg.EC2IMDSEndpoint = os.Getenv(awsEc2MetadataServiceEndpointEnvVar)
if err := setBoolPtrFromEnvVal(&cfg.EC2IMDSv1Disabled, []string{awsEc2MetadataV1DisabledEnvVar}); err != nil {
cfg.EC2IMDSEndpoint = os.Getenv(awsEc2MetadataServiceEndpointEnv)
if err := setBoolPtrFromEnvVal(&cfg.EC2IMDSv1Disabled, []string{awsEc2MetadataV1DisabledEnv}); err != nil {
return cfg, err
}
if err := setBoolPtrFromEnvVal(&cfg.S3DisableMultiRegionAccessPoints, []string{awsS3DisableMultiRegionAccessPointEnvVar}); err != nil {
if err := setBoolPtrFromEnvVal(&cfg.S3DisableMultiRegionAccessPoints, []string{awsS3DisableMultiRegionAccessPointsEnv}); err != nil {
return cfg, err
}
if err := setUseDualStackEndpointFromEnvVal(&cfg.UseDualStackEndpoint, []string{awsUseDualStackEndpoint}); err != nil {
if err := setUseDualStackEndpointFromEnvVal(&cfg.UseDualStackEndpoint, []string{awsUseDualStackEndpointEnv}); err != nil {
return cfg, err
}
if err := setUseFIPSEndpointFromEnvVal(&cfg.UseFIPSEndpoint, []string{awsUseFIPSEndpoint}); err != nil {
if err := setUseFIPSEndpointFromEnvVal(&cfg.UseFIPSEndpoint, []string{awsUseFIPSEndpointEnv}); err != nil {
return cfg, err
}
if err := setDefaultsModeFromEnvVal(&cfg.DefaultsMode, []string{awsDefaultMode}); err != nil {
if err := setDefaultsModeFromEnvVal(&cfg.DefaultsMode, []string{awsDefaultsModeEnv}); err != nil {
return cfg, err
}
if err := setIntFromEnvVal(&cfg.RetryMaxAttempts, []string{awsRetryMaxAttempts}); err != nil {
if err := setIntFromEnvVal(&cfg.RetryMaxAttempts, []string{awsMaxAttemptsEnv}); err != nil {
return cfg, err
}
if err := setRetryModeFromEnvVal(&cfg.RetryMode, []string{awsRetryMode}); err != nil {
if err := setRetryModeFromEnvVal(&cfg.RetryMode, []string{awsRetryModeEnv}); err != nil {
return cfg, err
}
setStringFromEnvVal(&cfg.BaseEndpoint, []string{awsEndpointURL})
setStringFromEnvVal(&cfg.BaseEndpoint, []string{awsEndpointURLEnv})
if err := setBoolPtrFromEnvVal(&cfg.IgnoreConfiguredEndpoints, []string{awsIgnoreConfiguredEndpoints}); err != nil {
if err := setBoolPtrFromEnvVal(&cfg.IgnoreConfiguredEndpoints, []string{awsIgnoreConfiguredEndpointURLEnv}); err != nil {
return cfg, err
}
@ -400,6 +408,13 @@ func NewEnvConfig() (EnvConfig, error) {
return cfg, err
}
if err := setRequestChecksumCalculationFromEnvVal(&cfg.RequestChecksumCalculation, []string{awsRequestChecksumCalculation}); err != nil {
return cfg, err
}
if err := setResponseChecksumValidationFromEnvVal(&cfg.ResponseChecksumValidation, []string{awsResponseChecksumValidation}); err != nil {
return cfg, err
}
return cfg, nil
}
@ -432,6 +447,14 @@ func (c EnvConfig) getAccountIDEndpointMode(context.Context) (aws.AccountIDEndpo
return c.AccountIDEndpointMode, len(c.AccountIDEndpointMode) > 0, nil
}
func (c EnvConfig) getRequestChecksumCalculation(context.Context) (aws.RequestChecksumCalculation, bool, error) {
return c.RequestChecksumCalculation, c.RequestChecksumCalculation > 0, nil
}
func (c EnvConfig) getResponseChecksumValidation(context.Context) (aws.ResponseChecksumValidation, bool, error) {
return c.ResponseChecksumValidation, c.ResponseChecksumValidation > 0, nil
}
// GetRetryMaxAttempts returns the value of AWS_MAX_ATTEMPTS if was specified,
// and not 0.
func (c EnvConfig) GetRetryMaxAttempts(ctx context.Context) (int, bool, error) {
@ -528,6 +551,45 @@ func setAIDEndPointModeFromEnvVal(m *aws.AccountIDEndpointMode, keys []string) e
return nil
}
func setRequestChecksumCalculationFromEnvVal(m *aws.RequestChecksumCalculation, keys []string) error {
for _, k := range keys {
value := os.Getenv(k)
if len(value) == 0 {
continue
}
switch strings.ToLower(value) {
case checksumWhenSupported:
*m = aws.RequestChecksumCalculationWhenSupported
case checksumWhenRequired:
*m = aws.RequestChecksumCalculationWhenRequired
default:
return fmt.Errorf("invalid value for environment variable, %s=%s, must be when_supported/when_required", k, value)
}
}
return nil
}
func setResponseChecksumValidationFromEnvVal(m *aws.ResponseChecksumValidation, keys []string) error {
for _, k := range keys {
value := os.Getenv(k)
if len(value) == 0 {
continue
}
switch strings.ToLower(value) {
case checksumWhenSupported:
*m = aws.ResponseChecksumValidationWhenSupported
case checksumWhenRequired:
*m = aws.ResponseChecksumValidationWhenRequired
default:
return fmt.Errorf("invalid value for environment variable, %s=%s, must be when_supported/when_required", k, value)
}
}
return nil
}
// GetRegion returns the AWS Region if set in the environment. Returns an empty
// string if not set.
func (c EnvConfig) getRegion(ctx context.Context) (string, bool, error) {
@ -584,7 +646,7 @@ func (c EnvConfig) getCustomCABundle(context.Context) (io.Reader, bool, error) {
return nil, false, nil
}
b, err := ioutil.ReadFile(c.CustomCABundle)
b, err := os.ReadFile(c.CustomCABundle)
if err != nil {
return nil, false, err
}
@ -608,7 +670,7 @@ func (c EnvConfig) getBaseEndpoint(context.Context) (string, bool, error) {
// GetServiceBaseEndpoint is used to retrieve a normalized SDK ID for use
// with configured endpoints.
func (c EnvConfig) GetServiceBaseEndpoint(ctx context.Context, sdkID string) (string, bool, error) {
if endpt := os.Getenv(fmt.Sprintf("%s_%s", awsEndpointURL, normalizeEnv(sdkID))); endpt != "" {
if endpt := os.Getenv(fmt.Sprintf("%s_%s", awsEndpointURLEnv, normalizeEnv(sdkID))); endpt != "" {
return endpt, true, nil
}
return "", false, nil

View file

@ -3,4 +3,4 @@
package config
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.28.7"
const goModuleVersion = "1.29.10"

View file

@ -216,8 +216,15 @@ type LoadOptions struct {
// Whether S3 Express auth is disabled.
S3DisableExpressAuth *bool
// Whether account id should be built into endpoint resolution
AccountIDEndpointMode aws.AccountIDEndpointMode
// Specify if request checksum should be calculated
RequestChecksumCalculation aws.RequestChecksumCalculation
// Specifies if response checksum should be validated
ResponseChecksumValidation aws.ResponseChecksumValidation
// Service endpoint override. This value is not necessarily final and is
// passed to the service's EndpointResolverV2 for further delegation.
BaseEndpoint string
@ -288,6 +295,14 @@ func (o LoadOptions) getAccountIDEndpointMode(ctx context.Context) (aws.AccountI
return o.AccountIDEndpointMode, len(o.AccountIDEndpointMode) > 0, nil
}
func (o LoadOptions) getRequestChecksumCalculation(ctx context.Context) (aws.RequestChecksumCalculation, bool, error) {
return o.RequestChecksumCalculation, o.RequestChecksumCalculation > 0, nil
}
func (o LoadOptions) getResponseChecksumValidation(ctx context.Context) (aws.ResponseChecksumValidation, bool, error) {
return o.ResponseChecksumValidation, o.ResponseChecksumValidation > 0, nil
}
func (o LoadOptions) getBaseEndpoint(context.Context) (string, bool, error) {
return o.BaseEndpoint, o.BaseEndpoint != "", nil
}
@ -357,6 +372,26 @@ func WithAccountIDEndpointMode(m aws.AccountIDEndpointMode) LoadOptionsFunc {
}
}
// WithRequestChecksumCalculation is a helper function to construct functional options
// that sets RequestChecksumCalculation on config's LoadOptions
func WithRequestChecksumCalculation(c aws.RequestChecksumCalculation) LoadOptionsFunc {
return func(o *LoadOptions) error {
if c > 0 {
o.RequestChecksumCalculation = c
}
return nil
}
}
// WithResponseChecksumValidation is a helper function to construct functional options
// that sets ResponseChecksumValidation on config's LoadOptions
func WithResponseChecksumValidation(v aws.ResponseChecksumValidation) LoadOptionsFunc {
return func(o *LoadOptions) error {
o.ResponseChecksumValidation = v
return nil
}
}
// getDefaultRegion returns DefaultRegion from config's LoadOptions
func (o LoadOptions) getDefaultRegion(ctx context.Context) (string, bool, error) {
if len(o.DefaultRegion) == 0 {

View file

@ -242,6 +242,40 @@ func getAccountIDEndpointMode(ctx context.Context, configs configs) (value aws.A
return
}
// requestChecksumCalculationProvider provides access to the RequestChecksumCalculation
type requestChecksumCalculationProvider interface {
getRequestChecksumCalculation(context.Context) (aws.RequestChecksumCalculation, bool, error)
}
func getRequestChecksumCalculation(ctx context.Context, configs configs) (value aws.RequestChecksumCalculation, found bool, err error) {
for _, cfg := range configs {
if p, ok := cfg.(requestChecksumCalculationProvider); ok {
value, found, err = p.getRequestChecksumCalculation(ctx)
if err != nil || found {
break
}
}
}
return
}
// responseChecksumValidationProvider provides access to the ResponseChecksumValidation
type responseChecksumValidationProvider interface {
getResponseChecksumValidation(context.Context) (aws.ResponseChecksumValidation, bool, error)
}
func getResponseChecksumValidation(ctx context.Context, configs configs) (value aws.ResponseChecksumValidation, found bool, err error) {
for _, cfg := range configs {
if p, ok := cfg.(responseChecksumValidationProvider); ok {
value, found, err = p.getResponseChecksumValidation(ctx)
if err != nil || found {
break
}
}
}
return
}
// ec2IMDSRegionProvider provides access to the ec2 imds region
// configuration value
type ec2IMDSRegionProvider interface {

View file

@ -182,6 +182,36 @@ func resolveAccountIDEndpointMode(ctx context.Context, cfg *aws.Config, configs
return nil
}
// resolveRequestChecksumCalculation extracts the RequestChecksumCalculation from the configs slice's
// SharedConfig or EnvConfig
func resolveRequestChecksumCalculation(ctx context.Context, cfg *aws.Config, configs configs) error {
c, found, err := getRequestChecksumCalculation(ctx, configs)
if err != nil {
return err
}
if !found {
c = aws.RequestChecksumCalculationWhenSupported
}
cfg.RequestChecksumCalculation = c
return nil
}
// resolveResponseValidation extracts the ResponseChecksumValidation from the configs slice's
// SharedConfig or EnvConfig
func resolveResponseChecksumValidation(ctx context.Context, cfg *aws.Config, configs configs) error {
c, found, err := getResponseChecksumValidation(ctx, configs)
if err != nil {
return err
}
if !found {
c = aws.ResponseChecksumValidationWhenSupported
}
cfg.ResponseChecksumValidation = c
return nil
}
// resolveDefaultRegion extracts the first instance of a default region and sets `aws.Config.Region` to the default
// region if region had not been resolved from other sources.
func resolveDefaultRegion(ctx context.Context, cfg *aws.Config, configs configs) error {

View file

@ -112,13 +112,15 @@ func resolveCredentialChain(ctx context.Context, cfg *aws.Config, configs config
switch {
case sharedProfileSet:
err = resolveCredsFromProfile(ctx, cfg, envConfig, sharedConfig, other)
ctx, err = resolveCredsFromProfile(ctx, cfg, envConfig, sharedConfig, other)
case envConfig.Credentials.HasKeys():
cfg.Credentials = credentials.StaticCredentialsProvider{Value: envConfig.Credentials}
ctx = addCredentialSource(ctx, aws.CredentialSourceEnvVars)
cfg.Credentials = credentials.StaticCredentialsProvider{Value: envConfig.Credentials, Source: getCredentialSources(ctx)}
case len(envConfig.WebIdentityTokenFilePath) > 0:
ctx = addCredentialSource(ctx, aws.CredentialSourceEnvVarsSTSWebIDToken)
err = assumeWebIdentity(ctx, cfg, envConfig.WebIdentityTokenFilePath, envConfig.RoleARN, envConfig.RoleSessionName, configs)
default:
err = resolveCredsFromProfile(ctx, cfg, envConfig, sharedConfig, other)
ctx, err = resolveCredsFromProfile(ctx, cfg, envConfig, sharedConfig, other)
}
if err != nil {
return err
@ -133,53 +135,71 @@ func resolveCredentialChain(ctx context.Context, cfg *aws.Config, configs config
return nil
}
func resolveCredsFromProfile(ctx context.Context, cfg *aws.Config, envConfig *EnvConfig, sharedConfig *SharedConfig, configs configs) (err error) {
func resolveCredsFromProfile(ctx context.Context, cfg *aws.Config, envConfig *EnvConfig, sharedConfig *SharedConfig, configs configs) (ctx2 context.Context, err error) {
switch {
case sharedConfig.Source != nil:
ctx = addCredentialSource(ctx, aws.CredentialSourceProfileSourceProfile)
// Assume IAM role with credentials source from a different profile.
err = resolveCredsFromProfile(ctx, cfg, envConfig, sharedConfig.Source, configs)
ctx, err = resolveCredsFromProfile(ctx, cfg, envConfig, sharedConfig.Source, configs)
case sharedConfig.Credentials.HasKeys():
// Static Credentials from Shared Config/Credentials file.
ctx = addCredentialSource(ctx, aws.CredentialSourceProfile)
cfg.Credentials = credentials.StaticCredentialsProvider{
Value: sharedConfig.Credentials,
Value: sharedConfig.Credentials,
Source: getCredentialSources(ctx),
}
case len(sharedConfig.CredentialSource) != 0:
err = resolveCredsFromSource(ctx, cfg, envConfig, sharedConfig, configs)
ctx = addCredentialSource(ctx, aws.CredentialSourceProfileNamedProvider)
ctx, err = resolveCredsFromSource(ctx, cfg, envConfig, sharedConfig, configs)
case len(sharedConfig.WebIdentityTokenFile) != 0:
// Credentials from Assume Web Identity token require an IAM Role, and
// that roll will be assumed. May be wrapped with another assume role
// via SourceProfile.
return assumeWebIdentity(ctx, cfg, sharedConfig.WebIdentityTokenFile, sharedConfig.RoleARN, sharedConfig.RoleSessionName, configs)
ctx = addCredentialSource(ctx, aws.CredentialSourceProfileSTSWebIDToken)
return ctx, assumeWebIdentity(ctx, cfg, sharedConfig.WebIdentityTokenFile, sharedConfig.RoleARN, sharedConfig.RoleSessionName, configs)
case sharedConfig.hasSSOConfiguration():
if sharedConfig.hasLegacySSOConfiguration() {
ctx = addCredentialSource(ctx, aws.CredentialSourceProfileSSOLegacy)
ctx = addCredentialSource(ctx, aws.CredentialSourceSSOLegacy)
} else {
ctx = addCredentialSource(ctx, aws.CredentialSourceSSO)
}
if sharedConfig.SSOSession != nil {
ctx = addCredentialSource(ctx, aws.CredentialSourceProfileSSO)
}
err = resolveSSOCredentials(ctx, cfg, sharedConfig, configs)
case len(sharedConfig.CredentialProcess) != 0:
// Get credentials from CredentialProcess
ctx = addCredentialSource(ctx, aws.CredentialSourceProfileProcess)
ctx = addCredentialSource(ctx, aws.CredentialSourceProcess)
err = processCredentials(ctx, cfg, sharedConfig, configs)
case len(envConfig.ContainerCredentialsRelativePath) != 0:
ctx = addCredentialSource(ctx, aws.CredentialSourceHTTP)
err = resolveHTTPCredProvider(ctx, cfg, ecsContainerURI(envConfig.ContainerCredentialsRelativePath), envConfig.ContainerAuthorizationToken, configs)
case len(envConfig.ContainerCredentialsEndpoint) != 0:
ctx = addCredentialSource(ctx, aws.CredentialSourceHTTP)
err = resolveLocalHTTPCredProvider(ctx, cfg, envConfig.ContainerCredentialsEndpoint, envConfig.ContainerAuthorizationToken, configs)
default:
ctx = addCredentialSource(ctx, aws.CredentialSourceIMDS)
err = resolveEC2RoleCredentials(ctx, cfg, configs)
}
if err != nil {
return err
return ctx, err
}
if len(sharedConfig.RoleARN) > 0 {
return credsFromAssumeRole(ctx, cfg, sharedConfig, configs)
return ctx, credsFromAssumeRole(ctx, cfg, sharedConfig, configs)
}
return nil
return ctx, nil
}
func resolveSSOCredentials(ctx context.Context, cfg *aws.Config, sharedConfig *SharedConfig, configs configs) error {
@ -198,6 +218,10 @@ func resolveSSOCredentials(ctx context.Context, cfg *aws.Config, sharedConfig *S
cfgCopy := cfg.Copy()
options = append(options, func(o *ssocreds.Options) {
o.CredentialSources = getCredentialSources(ctx)
})
if sharedConfig.SSOSession != nil {
ssoTokenProviderOptionsFn, found, err := getSSOTokenProviderOptions(ctx, configs)
if err != nil {
@ -242,6 +266,10 @@ func processCredentials(ctx context.Context, cfg *aws.Config, sharedConfig *Shar
opts = append(opts, options)
}
opts = append(opts, func(o *processcreds.Options) {
o.CredentialSources = getCredentialSources(ctx)
})
cfg.Credentials = processcreds.NewProvider(sharedConfig.CredentialProcess, opts...)
return nil
@ -323,6 +351,7 @@ func resolveHTTPCredProvider(ctx context.Context, cfg *aws.Config, url, authToke
if cfg.Retryer != nil {
options.Retryer = cfg.Retryer()
}
options.CredentialSources = getCredentialSources(ctx)
},
}
@ -346,28 +375,31 @@ func resolveHTTPCredProvider(ctx context.Context, cfg *aws.Config, url, authToke
return nil
}
func resolveCredsFromSource(ctx context.Context, cfg *aws.Config, envConfig *EnvConfig, sharedCfg *SharedConfig, configs configs) (err error) {
func resolveCredsFromSource(ctx context.Context, cfg *aws.Config, envConfig *EnvConfig, sharedCfg *SharedConfig, configs configs) (context.Context, error) {
switch sharedCfg.CredentialSource {
case credSourceEc2Metadata:
return resolveEC2RoleCredentials(ctx, cfg, configs)
ctx = addCredentialSource(ctx, aws.CredentialSourceIMDS)
return ctx, resolveEC2RoleCredentials(ctx, cfg, configs)
case credSourceEnvironment:
cfg.Credentials = credentials.StaticCredentialsProvider{Value: envConfig.Credentials}
ctx = addCredentialSource(ctx, aws.CredentialSourceHTTP)
cfg.Credentials = credentials.StaticCredentialsProvider{Value: envConfig.Credentials, Source: getCredentialSources(ctx)}
case credSourceECSContainer:
ctx = addCredentialSource(ctx, aws.CredentialSourceHTTP)
if len(envConfig.ContainerCredentialsRelativePath) != 0 {
return resolveHTTPCredProvider(ctx, cfg, ecsContainerURI(envConfig.ContainerCredentialsRelativePath), envConfig.ContainerAuthorizationToken, configs)
return ctx, resolveHTTPCredProvider(ctx, cfg, ecsContainerURI(envConfig.ContainerCredentialsRelativePath), envConfig.ContainerAuthorizationToken, configs)
}
if len(envConfig.ContainerCredentialsEndpoint) != 0 {
return resolveLocalHTTPCredProvider(ctx, cfg, envConfig.ContainerCredentialsEndpoint, envConfig.ContainerAuthorizationToken, configs)
return ctx, resolveLocalHTTPCredProvider(ctx, cfg, envConfig.ContainerCredentialsEndpoint, envConfig.ContainerAuthorizationToken, configs)
}
return fmt.Errorf("EcsContainer was specified as the credential_source, but neither 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' or AWS_CONTAINER_CREDENTIALS_FULL_URI' was set")
return ctx, fmt.Errorf("EcsContainer was specified as the credential_source, but neither 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' or AWS_CONTAINER_CREDENTIALS_FULL_URI' was set")
default:
return fmt.Errorf("credential_source values must be EcsContainer, Ec2InstanceMetadata, or Environment")
return ctx, fmt.Errorf("credential_source values must be EcsContainer, Ec2InstanceMetadata, or Environment")
}
return nil
return ctx, nil
}
func resolveEC2RoleCredentials(ctx context.Context, cfg *aws.Config, configs configs) error {
@ -386,6 +418,7 @@ func resolveEC2RoleCredentials(ctx context.Context, cfg *aws.Config, configs con
if o.Client == nil {
o.Client = imds.NewFromConfig(*cfg)
}
o.CredentialSources = getCredentialSources(ctx)
})
provider := ec2rolecreds.New(optFns...)
@ -394,7 +427,6 @@ func resolveEC2RoleCredentials(ctx context.Context, cfg *aws.Config, configs con
if err != nil {
return err
}
return nil
}
@ -473,6 +505,10 @@ func assumeWebIdentity(ctx context.Context, cfg *aws.Config, filepath string, ro
RoleARN: roleARN,
}
optFns = append(optFns, func(options *stscreds.WebIdentityRoleOptions) {
options.CredentialSources = getCredentialSources(ctx)
})
for _, fn := range optFns {
fn(&opts)
}
@ -494,6 +530,8 @@ func assumeWebIdentity(ctx context.Context, cfg *aws.Config, filepath string, ro
}
func credsFromAssumeRole(ctx context.Context, cfg *aws.Config, sharedCfg *SharedConfig, configs configs) (err error) {
// resolve credentials early
credentialSources := getCredentialSources(ctx)
optFns := []func(*stscreds.AssumeRoleOptions){
func(options *stscreds.AssumeRoleOptions) {
options.RoleSessionName = sharedCfg.RoleSessionName
@ -511,6 +549,9 @@ func credsFromAssumeRole(ctx context.Context, cfg *aws.Config, sharedCfg *Shared
if len(sharedCfg.MFASerial) != 0 {
options.SerialNumber = aws.String(sharedCfg.MFASerial)
}
// add existing credential chain
options.CredentialSources = credentialSources
},
}
@ -533,7 +574,6 @@ func credsFromAssumeRole(ctx context.Context, cfg *aws.Config, sharedCfg *Shared
return AssumeRoleTokenProviderNotSetError{}
}
}
cfg.Credentials = stscreds.NewAssumeRoleProvider(sts.NewFromConfig(*cfg), sharedCfg.RoleARN, optFns...)
return nil
@ -567,3 +607,21 @@ func wrapWithCredentialsCache(
return aws.NewCredentialsCache(provider, optFns...), nil
}
// credentialSource stores the chain of providers that was used to create an instance of
// a credentials provider on the context
type credentialSource struct{}
func addCredentialSource(ctx context.Context, source aws.CredentialSource) context.Context {
existing, ok := ctx.Value(credentialSource{}).([]aws.CredentialSource)
if !ok {
existing = []aws.CredentialSource{source}
} else {
existing = append(existing, source)
}
return context.WithValue(ctx, credentialSource{}, existing)
}
func getCredentialSources(ctx context.Context) []aws.CredentialSource {
return ctx.Value(credentialSource{}).([]aws.CredentialSource)
}

View file

@ -118,6 +118,11 @@ const (
accountIDKey = "aws_account_id"
accountIDEndpointMode = "account_id_endpoint_mode"
requestChecksumCalculationKey = "request_checksum_calculation"
responseChecksumValidationKey = "response_checksum_validation"
checksumWhenSupported = "when_supported"
checksumWhenRequired = "when_required"
)
// defaultSharedConfigProfile allows for swapping the default profile for testing
@ -346,6 +351,12 @@ type SharedConfig struct {
S3DisableExpressAuth *bool
AccountIDEndpointMode aws.AccountIDEndpointMode
// RequestChecksumCalculation indicates if the request checksum should be calculated
RequestChecksumCalculation aws.RequestChecksumCalculation
// ResponseChecksumValidation indicates if the response checksum should be validated
ResponseChecksumValidation aws.ResponseChecksumValidation
}
func (c SharedConfig) getDefaultsMode(ctx context.Context) (value aws.DefaultsMode, ok bool, err error) {
@ -1133,6 +1144,13 @@ func (c *SharedConfig) setFromIniSection(profile string, section ini.Section) er
return fmt.Errorf("failed to load %s from shared config, %w", accountIDEndpointMode, err)
}
if err := updateRequestChecksumCalculation(&c.RequestChecksumCalculation, section, requestChecksumCalculationKey); err != nil {
return fmt.Errorf("failed to load %s from shared config, %w", requestChecksumCalculationKey, err)
}
if err := updateResponseChecksumValidation(&c.ResponseChecksumValidation, section, responseChecksumValidationKey); err != nil {
return fmt.Errorf("failed to load %s from shared config, %w", responseChecksumValidationKey, err)
}
// Shared Credentials
creds := aws.Credentials{
AccessKeyID: section.String(accessKeyIDKey),
@ -1207,6 +1225,42 @@ func updateAIDEndpointMode(m *aws.AccountIDEndpointMode, sec ini.Section, key st
return nil
}
func updateRequestChecksumCalculation(m *aws.RequestChecksumCalculation, sec ini.Section, key string) error {
if !sec.Has(key) {
return nil
}
v := sec.String(key)
switch strings.ToLower(v) {
case checksumWhenSupported:
*m = aws.RequestChecksumCalculationWhenSupported
case checksumWhenRequired:
*m = aws.RequestChecksumCalculationWhenRequired
default:
return fmt.Errorf("invalid value for shared config profile field, %s=%s, must be when_supported/when_required", key, v)
}
return nil
}
func updateResponseChecksumValidation(m *aws.ResponseChecksumValidation, sec ini.Section, key string) error {
if !sec.Has(key) {
return nil
}
v := sec.String(key)
switch strings.ToLower(v) {
case checksumWhenSupported:
*m = aws.ResponseChecksumValidationWhenSupported
case checksumWhenRequired:
*m = aws.ResponseChecksumValidationWhenRequired
default:
return fmt.Errorf("invalid value for shared config profile field, %s=%s, must be when_supported/when_required", key, v)
}
return nil
}
func (c SharedConfig) getRequestMinCompressSizeBytes(ctx context.Context) (int64, bool, error) {
if c.RequestMinCompressSizeBytes == nil {
return 0, false, nil
@ -1225,6 +1279,14 @@ func (c SharedConfig) getAccountIDEndpointMode(ctx context.Context) (aws.Account
return c.AccountIDEndpointMode, len(c.AccountIDEndpointMode) > 0, nil
}
func (c SharedConfig) getRequestChecksumCalculation(ctx context.Context) (aws.RequestChecksumCalculation, bool, error) {
return c.RequestChecksumCalculation, c.RequestChecksumCalculation > 0, nil
}
func (c SharedConfig) getResponseChecksumValidation(ctx context.Context) (aws.ResponseChecksumValidation, bool, error) {
return c.ResponseChecksumValidation, c.ResponseChecksumValidation > 0, nil
}
func updateDefaultsMode(mode *aws.DefaultsMode, section ini.Section, key string) error {
if !section.Has(key) {
return nil

View file

@ -1,3 +1,65 @@
# v1.17.63 (2025-03-24)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.62 (2025-03-04.2)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.61 (2025-02-27)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.60 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.59 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.58 (2025-02-04)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.57 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.56 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.55 (2025-01-24)
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.17.54 (2025-01-17)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.53 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.52 (2025-01-14)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.51 (2025-01-10)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.50 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.49 (2025-01-08)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.17.48 (2024-12-19)
* **Bug Fix**: Fix improper use of printf-style functions.

View file

@ -47,6 +47,10 @@ type Options struct {
//
// If nil, the provider will default to the EC2 IMDS client.
Client GetMetadataAPIClient
// The chain of providers that was used to create this provider
// These values are for reporting purposes and are not meant to be set up directly
CredentialSources []aws.CredentialSource
}
// New returns an initialized Provider value configured to retrieve
@ -227,3 +231,11 @@ func requestCred(ctx context.Context, client GetMetadataAPIClient, credsName str
return respCreds, nil
}
// ProviderSources returns the credential chain that was used to construct this provider
func (p *Provider) ProviderSources() []aws.CredentialSource {
if p.options.CredentialSources == nil {
return []aws.CredentialSource{aws.CredentialSourceIMDS}
} // If no source has been set, assume this is used directly which means just call to assume role
return p.options.CredentialSources
}

View file

@ -98,6 +98,10 @@ type Options struct {
//
// Will override AuthorizationToken if configured
AuthorizationTokenProvider AuthTokenProvider
// The chain of providers that was used to create this provider
// These values are for reporting purposes and are not meant to be set up directly
CredentialSources []aws.CredentialSource
}
// AuthTokenProvider defines an interface to dynamically load a value to be passed
@ -191,3 +195,13 @@ func (p *Provider) resolveAuthToken() (string, error) {
return authToken, nil
}
var _ aws.CredentialProviderSource = (*Provider)(nil)
// ProviderSources returns the credential chain that was used to construct this provider
func (p *Provider) ProviderSources() []aws.CredentialSource {
if p.options.CredentialSources == nil {
return []aws.CredentialSource{aws.CredentialSourceHTTP}
}
return p.options.CredentialSources
}

View file

@ -3,4 +3,4 @@
package credentials
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.17.48"
const goModuleVersion = "1.17.63"

View file

@ -57,6 +57,9 @@ type Provider struct {
type Options struct {
// Timeout limits the time a process can run.
Timeout time.Duration
// The chain of providers that was used to create this provider
// These values are for reporting purposes and are not meant to be set up directly
CredentialSources []aws.CredentialSource
}
// NewCommandBuilder provides the interface for specifying how command will be
@ -274,6 +277,14 @@ func (p *Provider) executeCredentialProcess(ctx context.Context) ([]byte, error)
return out, nil
}
// ProviderSources returns the credential chain that was used to construct this provider
func (p *Provider) ProviderSources() []aws.CredentialSource {
if p.options.CredentialSources == nil {
return []aws.CredentialSource{aws.CredentialSourceProcess}
}
return p.options.CredentialSources
}
func executeCommand(cmd *exec.Cmd, exec chan error) {
// Start the command
err := cmd.Start()

View file

@ -49,6 +49,10 @@ type Options struct {
// Used by the SSOCredentialProvider if a token configuration
// profile is used in the shared config
SSOTokenProvider *SSOTokenProvider
// The chain of providers that was used to create this provider.
// These values are for reporting purposes and are not meant to be set up directly
CredentialSources []aws.CredentialSource
}
// Provider is an AWS credential provider that retrieves temporary AWS
@ -133,6 +137,14 @@ func (p *Provider) Retrieve(ctx context.Context) (aws.Credentials, error) {
}, nil
}
// ProviderSources returns the credential chain that was used to construct this provider
func (p *Provider) ProviderSources() []aws.CredentialSource {
if p.options.CredentialSources == nil {
return []aws.CredentialSource{aws.CredentialSourceSSO}
}
return p.options.CredentialSources
}
// InvalidTokenError is the error type that is returned if loaded token has
// expired or is otherwise invalid. To refresh the SSO session run AWS SSO
// login with the corresponding profile.

View file

@ -22,6 +22,16 @@ func (*StaticCredentialsEmptyError) Error() string {
// never expire.
type StaticCredentialsProvider struct {
Value aws.Credentials
// These values are for reporting purposes and are not meant to be set up directly
Source []aws.CredentialSource
}
// ProviderSources returns the credential chain that was used to construct this provider
func (s StaticCredentialsProvider) ProviderSources() []aws.CredentialSource {
if s.Source == nil {
return []aws.CredentialSource{aws.CredentialSourceCode} // If no source has been set, assume this is used directly which means hardcoded creds
}
return s.Source
}
// NewStaticCredentialsProvider return a StaticCredentialsProvider initialized with the AWS

View file

@ -247,6 +247,10 @@ type AssumeRoleOptions struct {
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
// in the IAM User Guide. This parameter is optional.
TransitiveTagKeys []string
// The chain of providers that was used to create this provider
// These values are for reporting purposes and are not meant to be set up directly
CredentialSources []aws.CredentialSource
}
// NewAssumeRoleProvider constructs and returns a credentials provider that
@ -324,3 +328,11 @@ func (p *AssumeRoleProvider) Retrieve(ctx context.Context) (aws.Credentials, err
AccountID: accountID,
}, nil
}
// ProviderSources returns the credential chain that was used to construct this provider
func (p *AssumeRoleProvider) ProviderSources() []aws.CredentialSource {
if p.options.CredentialSources == nil {
return []aws.CredentialSource{aws.CredentialSourceSTSAssumeRole}
} // If no source has been set, assume this is used directly which means just call to assume role
return append(p.options.CredentialSources, aws.CredentialSourceSTSAssumeRole)
}

View file

@ -64,6 +64,10 @@ type WebIdentityRoleOptions struct {
// want to use as managed session policies. The policies must exist in the
// same account as the role.
PolicyARNs []types.PolicyDescriptorType
// The chain of providers that was used to create this provider
// These values are for reporting purposes and are not meant to be set up directly
CredentialSources []aws.CredentialSource
}
// IdentityTokenRetriever is an interface for retrieving a JWT
@ -167,3 +171,11 @@ func getAccountID(u *types.AssumedRoleUser) string {
}
return parts[4]
}
// ProviderSources returns the credential chain that was used to construct this provider
func (p *WebIdentityRoleProvider) ProviderSources() []aws.CredentialSource {
if p.options.CredentialSources == nil {
return []aws.CredentialSource{aws.CredentialSourceSTSAssumeRoleWebID}
}
return p.options.CredentialSources
}

View file

@ -1,3 +1,37 @@
# v1.16.30 (2025-02-27)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.16.29 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.16.28 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.16.27 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.16.26 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.16.25 (2025-01-24)
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.16.24 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.16.23 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.16.22 (2024-12-19)
* **Dependency Update**: Updated to the latest SDK module versions

View file

@ -3,4 +3,4 @@
package imds
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.16.22"
const goModuleVersion = "1.16.30"

View file

@ -1,3 +1,37 @@
# v1.3.34 (2025-02-27)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.3.33 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.3.32 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.3.31 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.3.30 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.3.29 (2025-01-24)
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.3.28 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.3.27 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.3.26 (2024-12-19)
* **Dependency Update**: Updated to the latest SDK module versions

View file

@ -3,4 +3,4 @@
package configsources
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.3.26"
const goModuleVersion = "1.3.34"

View file

@ -47,6 +47,9 @@
"ap-southeast-5" : {
"description" : "Asia Pacific (Malaysia)"
},
"ap-southeast-7" : {
"description" : "Asia Pacific (Thailand)"
},
"aws-global" : {
"description" : "AWS Standard global region"
},
@ -89,6 +92,9 @@
"me-south-1" : {
"description" : "Middle East (Bahrain)"
},
"mx-central-1" : {
"description" : "Mexico (Central)"
},
"sa-east-1" : {
"description" : "South America (Sao Paulo)"
},
@ -217,7 +223,17 @@
"supportsFIPS" : true
},
"regionRegex" : "^us\\-isof\\-\\w+\\-\\d+$",
"regions" : { }
"regions" : {
"aws-iso-f-global" : {
"description" : "AWS ISOF global region"
},
"us-isof-east-1" : {
"description" : "US ISOF EAST"
},
"us-isof-south-1" : {
"description" : "US ISOF SOUTH"
}
}
} ],
"version" : "1.1"
}

View file

@ -1,3 +1,37 @@
# v2.6.34 (2025-02-27)
* **Dependency Update**: Updated to the latest SDK module versions
# v2.6.33 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v2.6.32 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v2.6.31 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v2.6.30 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v2.6.29 (2025-01-24)
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v2.6.28 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v2.6.27 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v2.6.26 (2024-12-19)
* **Bug Fix**: Fix improper use of printf-style functions.

View file

@ -3,4 +3,4 @@
package endpoints
// goModuleVersion is the tagged release for this module
const goModuleVersion = "2.6.26"
const goModuleVersion = "2.6.34"

View file

@ -1,3 +1,11 @@
# v1.8.3 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
# v1.8.2 (2025-01-24)
* **Bug Fix**: Refactor filepath.Walk to filepath.WalkDir
# v1.8.1 (2024-08-15)
* **Dependency Update**: Bump minimum Go version to 1.21.

View file

@ -3,4 +3,4 @@
package ini
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.8.1"
const goModuleVersion = "1.8.3"

View file

@ -1,3 +1,11 @@
# v1.12.3 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
# v1.12.2 (2025-01-24)
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.12.1 (2024-11-18)
* **Dependency Update**: Update to smithy-go v1.22.1.

View file

@ -3,4 +3,4 @@
package acceptencoding
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.12.1"
const goModuleVersion = "1.12.3"

View file

@ -1,3 +1,37 @@
# v1.12.15 (2025-02-27)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.12.14 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.12.13 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.12.12 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.12.11 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.12.10 (2025-01-24)
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.12.9 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.12.8 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.12.7 (2024-12-19)
* **Dependency Update**: Updated to the latest SDK module versions

View file

@ -3,4 +3,4 @@
package presignedurl
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.12.7"
const goModuleVersion = "1.12.15"

View file

@ -1,3 +1,46 @@
# v1.25.1 (2025-03-04.2)
* **Bug Fix**: Add assurance test for operation order.
# v1.25.0 (2025-02-27)
* **Feature**: Track credential providers via User-Agent Feature ids
* **Dependency Update**: Updated to the latest SDK module versions
# v1.24.16 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.24.15 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.24.14 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.24.13 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.24.12 (2025-01-24)
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.24.11 (2025-01-17)
* **Bug Fix**: Fix bug where credentials weren't refreshed during retry loop.
# v1.24.10 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.24.9 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.24.8 (2024-12-19)
* **Dependency Update**: Updated to the latest SDK module versions

View file

@ -684,7 +684,7 @@ func addRetry(stack *middleware.Stack, o Options) error {
m.LogAttempts = o.ClientLogMode.IsRetries()
m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sso")
})
if err := stack.Finalize.Insert(attempt, "Signing", middleware.Before); err != nil {
if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
return err
}
if err := stack.Finalize.Insert(&retry.MetricsHeader{}, attempt.ID(), middleware.After); err != nil {
@ -761,6 +761,37 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error {
return nil
}
type setCredentialSourceMiddleware struct {
ua *awsmiddleware.RequestUserAgent
options Options
}
func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" }
func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
out middleware.BuildOutput, metadata middleware.Metadata, err error,
) {
asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource)
if !ok {
return next.HandleBuild(ctx, in)
}
providerSources := asProviderSource.ProviderSources()
for _, source := range providerSources {
m.ua.AddCredentialsSource(source)
}
return next.HandleBuild(ctx, in)
}
func addCredentialSource(stack *middleware.Stack, options Options) error {
ua, err := getOrAddRequestUserAgent(stack)
if err != nil {
return err
}
mw := setCredentialSourceMiddleware{ua: ua, options: options}
return stack.Build.Insert(&mw, "UserAgent", middleware.Before)
}
func resolveTracerProvider(options *Options) {
if options.TracerProvider == nil {
options.TracerProvider = &tracing.NopTracerProvider{}

View file

@ -123,6 +123,9 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpGetRoleCredentialsValidationMiddleware(stack); err != nil {
return err
}

View file

@ -128,6 +128,9 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpListAccountRolesValidationMiddleware(stack); err != nil {
return err
}

View file

@ -127,6 +127,9 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpListAccountsValidationMiddleware(stack); err != nil {
return err
}

View file

@ -122,6 +122,9 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpLogoutValidationMiddleware(stack); err != nil {
return err
}

View file

@ -25,11 +25,12 @@
"protocol_test.go",
"serializers.go",
"snapshot_test.go",
"sra_operation_order_test.go",
"types/errors.go",
"types/types.go",
"validators.go"
],
"go": "1.15",
"go": "1.22",
"module": "github.com/aws/aws-sdk-go-v2/service/sso",
"unstable": false
}

View file

@ -3,4 +3,4 @@
package sso
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.24.8"
const goModuleVersion = "1.25.1"

View file

@ -1,3 +1,51 @@
# v1.29.2 (2025-03-24)
* No change notes available for this release.
# v1.29.1 (2025-03-04.2)
* **Bug Fix**: Add assurance test for operation order.
# v1.29.0 (2025-02-27)
* **Feature**: Track credential providers via User-Agent Feature ids
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.15 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.14 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.13 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.12 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.11 (2025-01-24)
* **Documentation**: Fixed typos in the descriptions.
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.28.10 (2025-01-17)
* **Bug Fix**: Fix bug where credentials weren't refreshed during retry loop.
# v1.28.9 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.8 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.28.7 (2024-12-19)
* **Dependency Update**: Updated to the latest SDK module versions

View file

@ -684,7 +684,7 @@ func addRetry(stack *middleware.Stack, o Options) error {
m.LogAttempts = o.ClientLogMode.IsRetries()
m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/ssooidc")
})
if err := stack.Finalize.Insert(attempt, "Signing", middleware.Before); err != nil {
if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
return err
}
if err := stack.Finalize.Insert(&retry.MetricsHeader{}, attempt.ID(), middleware.After); err != nil {
@ -761,6 +761,37 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error {
return nil
}
type setCredentialSourceMiddleware struct {
ua *awsmiddleware.RequestUserAgent
options Options
}
func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" }
func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
out middleware.BuildOutput, metadata middleware.Metadata, err error,
) {
asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource)
if !ok {
return next.HandleBuild(ctx, in)
}
providerSources := asProviderSource.ProviderSources()
for _, source := range providerSources {
m.ua.AddCredentialsSource(source)
}
return next.HandleBuild(ctx, in)
}
func addCredentialSource(stack *middleware.Stack, options Options) error {
ua, err := getOrAddRequestUserAgent(stack)
if err != nil {
return err
}
mw := setCredentialSourceMiddleware{ua: ua, options: options}
return stack.Build.Insert(&mw, "UserAgent", middleware.Before)
}
func resolveTracerProvider(options *Options) {
if options.TracerProvider == nil {
options.TracerProvider = &tracing.NopTracerProvider{}

View file

@ -12,7 +12,7 @@ import (
// Creates and returns access and refresh tokens for clients that are
// authenticated using client secrets. The access token can be used to fetch
// short-term credentials for the assigned AWS accounts or to access application
// short-lived credentials for the assigned AWS accounts or to access application
// APIs using bearer authentication.
func (c *Client) CreateToken(ctx context.Context, params *CreateTokenInput, optFns ...func(*Options)) (*CreateTokenOutput, error) {
if params == nil {
@ -43,22 +43,21 @@ type CreateTokenInput struct {
// This member is required.
ClientSecret *string
// Supports the following OAuth grant types: Device Code and Refresh Token.
// Specify either of the following values, depending on the grant type that you
// want:
// Supports the following OAuth grant types: Authorization Code, Device Code, and
// Refresh Token. Specify one of the following values, depending on the grant type
// that you want:
//
// * Authorization Code - authorization_code
//
// * Device Code - urn:ietf:params:oauth:grant-type:device_code
//
// * Refresh Token - refresh_token
//
// For information about how to obtain the device code, see the StartDeviceAuthorization topic.
//
// This member is required.
GrantType *string
// Used only when calling this API for the Authorization Code grant type. The
// short-term code is used to identify this authorization request. This grant type
// is currently unsupported for the CreateTokenAPI.
// short-lived code is used to identify this authorization request.
Code *string
// Used only when calling this API for the Authorization Code grant type. This
@ -66,9 +65,9 @@ type CreateTokenInput struct {
// challenge value the client passed at authorization time.
CodeVerifier *string
// Used only when calling this API for the Device Code grant type. This short-term
// code is used to identify this authorization request. This comes from the result
// of the StartDeviceAuthorizationAPI.
// Used only when calling this API for the Device Code grant type. This
// short-lived code is used to identify this authorization request. This comes from
// the result of the StartDeviceAuthorizationAPI.
DeviceCode *string
// Used only when calling this API for the Authorization Code grant type. This
@ -77,7 +76,7 @@ type CreateTokenInput struct {
RedirectUri *string
// Used only when calling this API for the Refresh Token grant type. This token is
// used to refresh short-term tokens, such as the access token, that might expire.
// used to refresh short-lived tokens, such as the access token, that might expire.
//
// For more information about the features and limitations of the current IAM
// Identity Center OIDC implementation, see Considerations for Using this Guide in
@ -195,6 +194,9 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpCreateTokenValidationMiddleware(stack); err != nil {
return err
}

View file

@ -12,7 +12,7 @@ import (
// Creates and returns access and refresh tokens for clients and applications that
// are authenticated using IAM entities. The access token can be used to fetch
// short-term credentials for the assigned Amazon Web Services accounts or to
// short-lived credentials for the assigned Amazon Web Services accounts or to
// access application APIs using bearer authentication.
func (c *Client) CreateTokenWithIAM(ctx context.Context, params *CreateTokenWithIAMInput, optFns ...func(*Options)) (*CreateTokenWithIAMOutput, error) {
if params == nil {
@ -59,7 +59,7 @@ type CreateTokenWithIAMInput struct {
Assertion *string
// Used only when calling this API for the Authorization Code grant type. This
// short-term code is used to identify this authorization request. The code is
// short-lived code is used to identify this authorization request. The code is
// obtained through a redirect from IAM Identity Center to a redirect URI persisted
// in the Authorization Code GrantOptions for the application.
Code *string
@ -75,7 +75,7 @@ type CreateTokenWithIAMInput struct {
RedirectUri *string
// Used only when calling this API for the Refresh Token grant type. This token is
// used to refresh short-term tokens, such as the access token, that might expire.
// used to refresh short-lived tokens, such as the access token, that might expire.
//
// For more information about the features and limitations of the current IAM
// Identity Center OIDC implementation, see Considerations for Using this Guide in
@ -226,6 +226,9 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpCreateTokenWithIAMValidationMiddleware(stack); err != nil {
return err
}

View file

@ -10,9 +10,9 @@ import (
smithyhttp "github.com/aws/smithy-go/transport/http"
)
// Registers a client with IAM Identity Center. This allows clients to initiate
// device authorization. The output should be persisted for reuse through many
// authentication requests.
// Registers a public client with IAM Identity Center. This allows clients to
// perform authorization using the authorization code grant with Proof Key for Code
// Exchange (PKCE) or the device code grant.
func (c *Client) RegisterClient(ctx context.Context, params *RegisterClientInput, optFns ...func(*Options)) (*RegisterClientOutput, error) {
if params == nil {
params = &RegisterClientInput{}
@ -48,7 +48,15 @@ type RegisterClientInput struct {
EntitledApplicationArn *string
// The list of OAuth 2.0 grant types that are defined by the client. This list is
// used to restrict the token granting flows available to the client.
// used to restrict the token granting flows available to the client. Supports the
// following OAuth 2.0 grant types: Authorization Code, Device Code, and Refresh
// Token.
//
// * Authorization Code - authorization_code
//
// * Device Code - urn:ietf:params:oauth:grant-type:device_code
//
// * Refresh Token - refresh_token
GrantTypes []string
// The IAM Identity Center Issuer URL associated with an instance of IAM Identity
@ -156,6 +164,9 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpRegisterClientValidationMiddleware(stack); err != nil {
return err
}

View file

@ -146,6 +146,9 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpStartDeviceAuthorizationValidationMiddleware(stack); err != nil {
return err
}

View file

@ -8,9 +8,12 @@
// Center. The service also enables the client to fetch the users access token
// upon successful authentication and authorization with IAM Identity Center.
//
// IAM Identity Center uses the sso and identitystore API namespaces.
// # API namespaces
//
// # Considerations for Using This Guide
// IAM Identity Center uses the sso and identitystore API namespaces. IAM Identity
// Center OpenID Connect uses the sso-oidc namespace.
//
// # Considerations for using this guide
//
// Before you begin using this guide, we recommend that you first review the
// following important information about how the IAM Identity Center OIDC service

View file

@ -25,11 +25,12 @@
"protocol_test.go",
"serializers.go",
"snapshot_test.go",
"sra_operation_order_test.go",
"types/errors.go",
"types/types.go",
"validators.go"
],
"go": "1.15",
"go": "1.22",
"module": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
"unstable": false
}

View file

@ -3,4 +3,4 @@
package ssooidc
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.28.7"
const goModuleVersion = "1.29.2"

View file

@ -227,6 +227,14 @@ var defaultPartitions = endpoints.Partitions{
Region: "ap-southeast-4",
},
},
endpoints.EndpointKey{
Region: "ap-southeast-5",
}: endpoints.Endpoint{
Hostname: "oidc.ap-southeast-5.amazonaws.com",
CredentialScope: endpoints.CredentialScope{
Region: "ap-southeast-5",
},
},
endpoints.EndpointKey{
Region: "ca-central-1",
}: endpoints.Endpoint{

View file

@ -1,3 +1,61 @@
# v1.33.17 (2025-03-04.2)
* **Bug Fix**: Add assurance test for operation order.
# v1.33.16 (2025-02-27)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.33.15 (2025-02-18)
* **Bug Fix**: Bump go version to 1.22
* **Dependency Update**: Updated to the latest SDK module versions
# v1.33.14 (2025-02-05)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.33.13 (2025-02-04)
* No change notes available for this release.
# v1.33.12 (2025-01-31)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.33.11 (2025-01-30)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.33.10 (2025-01-24)
* **Dependency Update**: Updated to the latest SDK module versions
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
# v1.33.9 (2025-01-17)
* **Bug Fix**: Fix bug where credentials weren't refreshed during retry loop.
# v1.33.8 (2025-01-15)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.33.7 (2025-01-14)
* No change notes available for this release.
# v1.33.6 (2025-01-10)
* **Documentation**: Fixed typos in the descriptions.
# v1.33.5 (2025-01-09)
* **Dependency Update**: Updated to the latest SDK module versions
# v1.33.4 (2025-01-08)
* No change notes available for this release.
# v1.33.3 (2024-12-19)
* **Dependency Update**: Updated to the latest SDK module versions

View file

@ -688,7 +688,7 @@ func addRetry(stack *middleware.Stack, o Options) error {
m.LogAttempts = o.ClientLogMode.IsRetries()
m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sts")
})
if err := stack.Finalize.Insert(attempt, "Signing", middleware.Before); err != nil {
if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
return err
}
if err := stack.Finalize.Insert(&retry.MetricsHeader{}, attempt.ID(), middleware.After); err != nil {
@ -765,6 +765,37 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error {
return nil
}
type setCredentialSourceMiddleware struct {
ua *awsmiddleware.RequestUserAgent
options Options
}
func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" }
func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
out middleware.BuildOutput, metadata middleware.Metadata, err error,
) {
asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource)
if !ok {
return next.HandleBuild(ctx, in)
}
providerSources := asProviderSource.ProviderSources()
for _, source := range providerSources {
m.ua.AddCredentialsSource(source)
}
return next.HandleBuild(ctx, in)
}
func addCredentialSource(stack *middleware.Stack, options Options) error {
ua, err := getOrAddRequestUserAgent(stack)
if err != nil {
return err
}
mw := setCredentialSourceMiddleware{ua: ua, options: options}
return stack.Build.Insert(&mw, "UserAgent", middleware.Before)
}
func resolveTracerProvider(options *Options) {
if options.TracerProvider == nil {
options.TracerProvider = &tracing.NopTracerProvider{}

View file

@ -295,7 +295,7 @@ type AssumeRoleInput struct {
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can also
// include underscores or any of the following characters: =,.@-. You cannot use a
// include underscores or any of the following characters: +=,.@-. You cannot use a
// value that begins with the text aws: . This prefix is reserved for Amazon Web
// Services internal use.
//
@ -478,6 +478,9 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpAssumeRoleValidationMiddleware(stack); err != nil {
return err
}

View file

@ -410,6 +410,9 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpAssumeRoleWithSAMLValidationMiddleware(stack); err != nil {
return err
}

View file

@ -198,8 +198,9 @@ type AssumeRoleWithWebIdentityInput struct {
// identity provider. Your application must get this token by authenticating the
// user who is using your application with a web identity provider before the
// application makes an AssumeRoleWithWebIdentity call. Timestamps in the token
// must be formatted as either an integer or a long integer. Only tokens with RSA
// algorithms (RS256) are supported.
// must be formatted as either an integer or a long integer. Tokens must be signed
// using either RSA keys (RS256, RS384, or RS512) or ECDSA keys (ES256, ES384, or
// ES512).
//
// This member is required.
WebIdentityToken *string
@ -429,6 +430,9 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpAssumeRoleWithWebIdentityValidationMiddleware(stack); err != nil {
return err
}

View file

@ -12,14 +12,14 @@ import (
)
// Returns a set of short term credentials you can use to perform privileged tasks
// in a member account.
// on a member account in your organization.
//
// Before you can launch a privileged session, you must have enabled centralized
// root access in your organization. For steps to enable this feature, see [Centralize root access for member accounts]in the
// IAM User Guide.
// Before you can launch a privileged session, you must have centralized root
// access in your organization. For steps to enable this feature, see [Centralize root access for member accounts]in the IAM
// User Guide.
//
// The global endpoint is not supported for AssumeRoot. You must send this request
// to a Regional STS endpoint. For more information, see [Endpoints].
// The STS global endpoint is not supported for AssumeRoot. You must send this
// request to a Regional STS endpoint. For more information, see [Endpoints].
//
// You can track AssumeRoot in CloudTrail logs to determine what actions were
// performed in a session. For more information, see [Track privileged tasks in CloudTrail]in the IAM User Guide.
@ -51,8 +51,7 @@ type AssumeRootInput struct {
// The identity based policy that scopes the session to the privileged tasks that
// can be performed. You can use one of following Amazon Web Services managed
// policies to scope root session actions. You can add additional customer managed
// policies to further limit the permissions for the root session.
// policies to scope root session actions.
//
// [IAMAuditRootUserCredentials]
//
@ -176,6 +175,9 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpAssumeRootValidationMiddleware(stack); err != nil {
return err
}

View file

@ -147,6 +147,9 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpDecodeAuthorizationMessageValidationMiddleware(stack); err != nil {
return err
}

View file

@ -138,6 +138,9 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpGetAccessKeyInfoValidationMiddleware(stack); err != nil {
return err
}

View file

@ -129,6 +129,9 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = stack.Initialize.Add(newServiceMetadataMiddleware_opGetCallerIdentity(options.Region), middleware.Before); err != nil {
return err
}

View file

@ -351,6 +351,9 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = addOpGetFederationTokenValidationMiddleware(stack); err != nil {
return err
}

View file

@ -200,6 +200,9 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
if err = addUserAgentRetryMode(stack, options); err != nil {
return err
}
if err = addCredentialSource(stack, options); err != nil {
return err
}
if err = stack.Initialize.Add(newServiceMetadataMiddleware_opGetSessionToken(options.Region), middleware.Before); err != nil {
return err
}

View file

@ -32,11 +32,12 @@
"protocol_test.go",
"serializers.go",
"snapshot_test.go",
"sra_operation_order_test.go",
"types/errors.go",
"types/types.go",
"validators.go"
],
"go": "1.15",
"go": "1.22",
"module": "github.com/aws/aws-sdk-go-v2/service/sts",
"unstable": false
}

View file

@ -3,4 +3,4 @@
package sts
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.33.3"
const goModuleVersion = "1.33.17"

View file

@ -175,6 +175,9 @@ var defaultPartitions = endpoints.Partitions{
endpoints.EndpointKey{
Region: "ap-southeast-5",
}: endpoints.Endpoint{},
endpoints.EndpointKey{
Region: "ap-southeast-7",
}: endpoints.Endpoint{},
endpoints.EndpointKey{
Region: "aws-global",
}: endpoints.Endpoint{
@ -222,6 +225,9 @@ var defaultPartitions = endpoints.Partitions{
endpoints.EndpointKey{
Region: "me-south-1",
}: endpoints.Endpoint{},
endpoints.EndpointKey{
Region: "mx-central-1",
}: endpoints.Endpoint{},
endpoints.EndpointKey{
Region: "sa-east-1",
}: endpoints.Endpoint{},
@ -438,6 +444,14 @@ var defaultPartitions = endpoints.Partitions{
},
RegionRegex: partitionRegexp.AwsIsoF,
IsRegionalized: true,
Endpoints: endpoints.Endpoints{
endpoints.EndpointKey{
Region: "us-isof-east-1",
}: endpoints.Endpoint{},
endpoints.EndpointKey{
Region: "us-isof-south-1",
}: endpoints.Endpoint{},
},
},
{
ID: "aws-us-gov",

View file

@ -1,3 +1,13 @@
# Release (2025-01-21)
## General Highlights
* **Dependency Update**: Updated to the latest SDK module versions
## Module Highlights
* `github.com/aws/smithy-go`: v1.22.2
* **Bug Fix**: Fix HTTP metrics data race.
* **Bug Fix**: Replace usages of deprecated ioutil package.
# Release (2024-11-15)
## General Highlights

View file

@ -39,6 +39,37 @@ To send us a pull request, please:
GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
[creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
### Changelog Documents
(You can SKIP this step if you are only changing the code generator, and not the runtime).
When submitting a pull request please include a changelog file on a folder named `.changelog`.
These are used to generate the content `CHANGELOG.md` and Release Notes. The format of the file is as follows:
```
{
"id": "12345678-1234-1234-1234-123456789012"
"type": "bugfix"
"collapse": true
"description": "Fix improper use of printf-style functions.",
"modules": [
"."
]
}
```
* id: a UUID. This should also be used for the name of the file, so if your id is `12345678-1234-1234-1234-123456789012` the file should be named `12345678-1234-1234-1234-123456789012.json/`
* type: one of the following:
* bugfix: Fixing an existing bug
* Feature: Adding a new feature to an existing service
* Release: Releasing a new module
* Dependency: Updating dependencies
* Announcement: Making an announcement, like deprecation of a module
* collapse: whether this change should appear separately on the release notes on every module listed on `modules` (`"collapse": false`), or if it should show up as a single entry (`"collapse": true`)
* For the smithy-go repository this should always be `false`
* description: Description of this change. Most of the times is the same as the title of the PR
* modules: which Go modules does this change impact. The root module is expressed as "."
## Finding contributions to work on
Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.

View file

@ -98,5 +98,12 @@ module-version:
##############
.PHONY: install-changelog
external-changelog:
mkdir -p .changelog
cp changelog-template.json .changelog/00000000-0000-0000-0000-000000000000.json
@echo "Generate a new UUID and update the file at .changelog/00000000-0000-0000-0000-000000000000.json"
@echo "Make sure to rename the file with your new id, like .changelog/12345678-1234-1234-1234-123456789012.json"
@echo "See CONTRIBUTING.md 'Changelog Documents' and an example at https://github.com/aws/smithy-go/pull/543/files"
install-changelog:
go install ${REPOTOOLS_MODULE}/cmd/changelog@${REPOTOOLS_VERSION}

View file

@ -0,0 +1,9 @@
{
"id": "00000000-0000-0000-0000-000000000000",
"type": "feature|bugfix|dependency",
"description": "Description of your changes",
"collapse": false,
"modules": [
"."
]
}

View file

@ -3,4 +3,4 @@
package smithy
// goModuleVersion is the tagged release for this module
const goModuleVersion = "1.22.1"
const goModuleVersion = "1.22.2"

View file

@ -69,7 +69,7 @@ func ValidPortNumber(port string) bool {
return true
}
// ValidHostLabel returns whether the label is a valid RFC 3986 host abel.
// ValidHostLabel returns whether the label is a valid RFC 3986 host label.
func ValidHostLabel(label string) bool {
if l := len(label); l == 0 || l > 63 {
return false

View file

@ -5,6 +5,7 @@ import (
"crypto/tls"
"net/http"
"net/http/httptrace"
"sync/atomic"
"time"
"github.com/aws/smithy-go/metrics"
@ -42,10 +43,10 @@ type timedClientDo struct {
}
func (c *timedClientDo) Do(r *http.Request) (*http.Response, error) {
c.hm.doStart = now()
c.hm.doStart.Store(now())
resp, err := c.ClientDo.Do(r)
c.hm.DoRequestDuration.Record(r.Context(), elapsed(c.hm.doStart))
c.hm.DoRequestDuration.Record(r.Context(), c.hm.doStart.Elapsed())
return resp, err
}
@ -58,10 +59,10 @@ type httpMetrics struct {
DoRequestDuration metrics.Float64Histogram // client.http.do_request_duration
TimeToFirstByte metrics.Float64Histogram // client.http.time_to_first_byte
doStart time.Time
dnsStart time.Time
connectStart time.Time
tlsStart time.Time
doStart safeTime
dnsStart safeTime
connectStart safeTime
tlsStart safeTime
}
func newHTTPMetrics(meter metrics.Meter) (*httpMetrics, error) {
@ -115,15 +116,15 @@ func newHTTPMetrics(meter metrics.Meter) (*httpMetrics, error) {
}
func (m *httpMetrics) DNSStart(httptrace.DNSStartInfo) {
m.dnsStart = now()
m.dnsStart.Store(now())
}
func (m *httpMetrics) ConnectStart(string, string) {
m.connectStart = now()
m.connectStart.Store(now())
}
func (m *httpMetrics) TLSHandshakeStart() {
m.tlsStart = now()
m.tlsStart.Store(now())
}
func (m *httpMetrics) GotConn(ctx context.Context) func(httptrace.GotConnInfo) {
@ -140,25 +141,25 @@ func (m *httpMetrics) PutIdleConn(ctx context.Context) func(error) {
func (m *httpMetrics) DNSDone(ctx context.Context) func(httptrace.DNSDoneInfo) {
return func(httptrace.DNSDoneInfo) {
m.DNSLookupDuration.Record(ctx, elapsed(m.dnsStart))
m.DNSLookupDuration.Record(ctx, m.dnsStart.Elapsed())
}
}
func (m *httpMetrics) ConnectDone(ctx context.Context) func(string, string, error) {
return func(string, string, error) {
m.ConnectDuration.Record(ctx, elapsed(m.connectStart))
m.ConnectDuration.Record(ctx, m.connectStart.Elapsed())
}
}
func (m *httpMetrics) TLSHandshakeDone(ctx context.Context) func(tls.ConnectionState, error) {
return func(tls.ConnectionState, error) {
m.TLSHandshakeDuration.Record(ctx, elapsed(m.tlsStart))
m.TLSHandshakeDuration.Record(ctx, m.tlsStart.Elapsed())
}
}
func (m *httpMetrics) GotFirstResponseByte(ctx context.Context) func() {
return func() {
m.TimeToFirstByte.Record(ctx, elapsed(m.doStart))
m.TimeToFirstByte.Record(ctx, m.doStart.Elapsed())
}
}
@ -177,8 +178,21 @@ func (m *httpMetrics) addConnIdle(ctx context.Context, incr int64) {
})
}
func elapsed(start time.Time) float64 {
type safeTime struct {
atomic.Value // time.Time
}
func (st *safeTime) Store(v time.Time) {
st.Value.Store(v)
}
func (st *safeTime) Load() time.Time {
t, _ := st.Value.Load().(time.Time)
return t
}
func (st *safeTime) Elapsed() float64 {
end := now()
elapsed := end.Sub(start)
elapsed := end.Sub(st.Load())
return float64(elapsed) / 1e9
}

View file

@ -2,10 +2,10 @@ package http
import (
"context"
"io"
"github.com/aws/smithy-go/logging"
"github.com/aws/smithy-go/middleware"
"io"
"io/ioutil"
)
// AddErrorCloseResponseBodyMiddleware adds the middleware to automatically
@ -30,7 +30,7 @@ func (m *errorCloseResponseBodyMiddleware) HandleDeserialize(
if err != nil {
if resp, ok := out.RawResponse.(*Response); ok && resp != nil && resp.Body != nil {
// Consume the full body to prevent TCP connection resets on some platforms
_, _ = io.Copy(ioutil.Discard, resp.Body)
_, _ = io.Copy(io.Discard, resp.Body)
// Do not validate that the response closes successfully.
resp.Body.Close()
}
@ -64,7 +64,7 @@ func (m *closeResponseBody) HandleDeserialize(
if resp, ok := out.RawResponse.(*Response); ok {
// Consume the full body to prevent TCP connection resets on some platforms
_, copyErr := io.Copy(ioutil.Discard, resp.Body)
_, copyErr := io.Copy(io.Discard, resp.Body)
if copyErr != nil {
middleware.GetLogger(ctx).Logf(logging.Warn, "failed to discard remaining HTTP response body, this may affect connection reuse")
}

View file

@ -4,7 +4,6 @@ import (
"context"
"fmt"
"io"
"io/ioutil"
"net/http"
"net/url"
"strings"
@ -167,7 +166,7 @@ func (r *Request) Build(ctx context.Context) *http.Request {
switch stream := r.stream.(type) {
case *io.PipeReader:
req.Body = ioutil.NopCloser(stream)
req.Body = io.NopCloser(stream)
req.ContentLength = -1
default:
// HTTP Client Request must only have a non-nil body if the
@ -175,7 +174,7 @@ func (r *Request) Build(ctx context.Context) *http.Request {
// Client will interpret a non-nil body and ContentLength 0 as
// "unknown". This is unwanted behavior.
if req.ContentLength != 0 && r.stream != nil {
req.Body = iointernal.NewSafeReadCloser(ioutil.NopCloser(stream))
req.Body = iointernal.NewSafeReadCloser(io.NopCloser(stream))
}
}