Add STS assume role and web identity credential providers #352
Conversation
|
I didn't setup the cross-repo branches for this so the |
| */ | ||
| public class StsAssumeRoleCredentialsProvider public constructor( | ||
| credentialsProvider: CredentialsProvider, | ||
| roleArn: String? = null, |
There was a problem hiding this comment.
correctness
Aren't some of these required? If so I think we should make them required arguments.
| } | ||
|
|
||
| // Adapt SDK credential provider to CRT version | ||
| internal fun adapt(credentialsProvider: CredentialsProvider): CredentialsProviderCrt = |
There was a problem hiding this comment.
sigh the amount of layers here is painful and admittedly hard to follow at times (nothing you did wrong of course)
| // Adapt SDK credential provider to CRT version | ||
| internal fun CredentialsProvider.toCrtCredentialsProvider(): CredentialsProviderCrt = | ||
| object : CredentialsProviderCrt { | ||
| override fun close() { } | ||
|
|
||
| override suspend fun getCredentials(): Credentials { | ||
| val credentials = this@toCrtCredentialsProvider.getCredentials() | ||
| return Credentials(credentials.accessKeyId, credentials.secretAccessKey, credentials.sessionToken) | ||
| } | ||
|
|
||
| override suspend fun waitForShutdown() { } | ||
| } |
There was a problem hiding this comment.
Correctness: Doesn't this already exist as CredentialsProviderCrtProxy?
There was a problem hiding this comment.
It surely does, nice catch
| override val crtProvider: StsAssumeRoleCredentialsProviderCrt = StsAssumeRoleCredentialsProviderCrt.build { | ||
| clientBootstrap = SdkDefaultIO.ClientBootstrap | ||
| tlsContext = SdkDefaultIO.TlsContext | ||
| this.credentialsProvider = CredentialsProviderCrtProxy(credentialsProvider) |
There was a problem hiding this comment.
Comment: Now that I'm looking at the usage of the CRT proxy a little closer I believe there may be room for improvement. We've got CrtCredentialsProvider for wrapping CRT in SDK and we've got CredentialsProviderCrtProxy for wrapping SDK in CRT. But if someone passes in a CrtCredentialsProvider to this STS impl, we don't need to re-wrap it as CRT...we can just unwrap it from SDK right?
I think we may need a new helper method in CrtCredentialUtils.kt:
internal fun asCrt(sdkProvider: CredentialsProvider): CredentialsProviderCrt = when (sdkProvider) {
is CrtCredentialsProvider -> sdkProvider.crtProvider
else -> CredentialsProviderCrtProxy(sdkProvider)
}
3 participants
Issue #
#325
#19
Description of changes
aws-crt-kotlincredential providers: sts assume role and sts web identityScope
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.