aws/credential: Add credential_process provider

aws/credentials/processcreds/testdata/expired.json

@@ -0,0 +1,7 @@
+{
+    "Version": 1, 
+    "AccessKeyId": "accessKey", 
+    "SecretAccessKey": "secret", 
+    "SessionToken": "tokenDefault", 
+    "Expiration": "2000-01-01T00:00:00-00:00"
+}

aws/credentials/processcreds/testdata/malformed.json

@@ -0,0 +1,2 @@
+{
+    "Version": 1

aws/credentials/processcreds/testdata/missingkey.json

@@ -0,0 +1,4 @@
+{
+    "Version": 1,
+    "AccessKeyId": "accesskey"
+}

aws/credentials/processcreds/testdata/missingsecret.json

@@ -0,0 +1,4 @@
+{
+    "Version": 1, 
+    "SecretAccessKey": "secretkey"
+}

aws/credentials/processcreds/testdata/nonexpire.json

@@ -0,0 +1,6 @@
+{
+    "Version": 1, 
+    "AccessKeyId": "accessKey", 
+    "SecretAccessKey": "secret", 
+    "SessionToken": "nonDefaultToken"
+}

aws/credentials/processcreds/testdata/shconfig.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = cat ./testdata/expired.json
+
+[profile non_expire]
+credential_process = cat ./testdata/nonexpire.json 
+
+[profile not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = cat ./testdata/verybad.json 

aws/credentials/processcreds/testdata/shconfig_win.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = type .\testdata\expired.json
+
+[profile non_expire]
+credential_process = type .\testdata\nonexpire.json
+
+[profile not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = type .\testdata\verybad.json 

aws/credentials/processcreds/testdata/shcred.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = cat ./testdata/expired.json
+
+[non_expire]
+credential_process = cat ./testdata/nonexpire.json 
+
+[not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = cat ./testdata/verybad.json 

aws/credentials/processcreds/testdata/shcred_win.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = type .\testdata\expired.json
+
+[non_expire]
+credential_process = type .\testdata\nonexpire.json
+
+[not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = type .\testdata\verybad.json 

aws/credentials/processcreds/testdata/static.json

@@ -0,0 +1,5 @@
+{
+    "Version":1,
+    "AccessKeyId":"accesskey",
+    "SecretAccessKey":"secretkey"
+}

aws/credentials/processcreds/testdata/verybad.json

@@ -0,0 +1,5 @@
+{
+    "Version":1,
+    "AccessKeyId":"veryBadAccessKeyID",
+    "SecretAccessKey":"veryBadSecretAccessKey"
+}

aws/credentials/processcreds/testdata/wrongversion.json

@@ -0,0 +1,3 @@
+{
+    "Version": 2
+}

aws/session/session.go

@@ -14,6 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/client"
 	"github.com/aws/aws-sdk-go/aws/corehandlers"
 	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/credentials/processcreds"
 	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
 	"github.com/aws/aws-sdk-go/aws/csm"
 	"github.com/aws/aws-sdk-go/aws/defaults"
@@ -534,6 +535,10 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config, envCfg envConfig, sharedCfg share
 			cfg.Credentials = credentials.NewStaticCredentialsFromCreds(
 				sharedCfg.Creds,
 			)
+		} else if len(sharedCfg.CredentialProcess) > 0 {
+			cfg.Credentials = processcreds.NewCredentials(
+				sharedCfg.CredentialProcess,
+			)
 		} else {
 			// Fallback to default credentials provider, include mock errors
 			// for the credential chain so user can identify why credentials

aws/session/shared_config.go

@@ -28,6 +28,8 @@ const (
 
 	// endpoint discovery group
 	enableEndpointDiscoveryKey = `endpoint_discovery_enabled` // optional
+	// External Credential Process
+	credentialProcessKey = `credential_process`
 
 	// DefaultSharedConfigProfile is the default profile to be used when
 	// loading configuration from the config files if another profile name
@@ -60,6 +62,9 @@ type sharedConfig struct {
 	AssumeRole       assumeRoleConfig
 	AssumeRoleSource *sharedConfig
 
+	// An external process to request credentials
+	CredentialProcess string
+
 	// Region is the region the SDK should use for looking up AWS service endpoints
 	// and signing requests.
 	//
@@ -223,6 +228,11 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile) e
 		}
 	}
 
+	// `credential_process`
+	if credProc := section.String(credentialProcessKey); len(credProc) > 0 {
+		cfg.CredentialProcess = credProc
+	}
+
 	// Region
 	if v := section.String(regionKey); len(v) > 0 {
 		cfg.Region = v