feat(rt): standalone sso credentials provider

[aajtodd]

Issue #

#252

Description of changes

• Adds a projection to aws-config to embed a custom SSO service (trimmed down with only the required operation to implement the provider)
• Implements a standalone SSO credentials provider (based on the generated/embedded service client)
• Refactor CachedCredentialsProvider to be implemented in Kotlin
  • Existing issues would prevent the caching provider from working with a pure Kotlin credentials provider and without it users are going to hit the disk every time the provider is asked for credentials (as required by spec).

IMPORTANT: This provider is NOT yet integrated into the default chain or the profile provider. You must instantiate it directly to use it. See #461

e.g.

fun main():Unit = runBlocking {

    val ssoProvider = SsoCredentialsProvider(
        accountId = "<your-account-id>",
        roleName = "<your-role-to-assume>",
        startUrl = "<your-portal-start-url>",
        ssoRegion = "<region-sso-is-hosted-in>"
    )
    val provider = CachedCredentialsProvider(ssoProvider)
    S3Client {
        region = "us-east-2"
        credentialsProvider = provider
    }.use { client ->

        println("buckets:")
        client.listBuckets {  }.buckets?.forEach {
            println("$it")
        }
    }
}

Tested by setting up SSO per the directions, using the CLI to configure/initiate the login flow, and testing against STS GetCallerIdentity.
* NOTE: The AWS SSO service can act as an identity provider so there is no need to setup an external one. Just turn on AWS Organizations, enable SSO, add a user, and it should be usable.

fun main():Unit = runBlocking {

    val ssoProvider = SsoCredentialsProvider(
        accountId = "<your-account-id>",
        roleName = "<your-role-to-assume>",
        startUrl = "<your-portal-start-url>",
        ssoRegion = "<region-sso-is-hosted-in>"
    )
    val provider = CachedCredentialsProvider(ssoProvider)
    StsClient{
        region = "us-east-2"
        credentialsProvider = provider
    }.use { client ->
        val resp = client.getCallerIdentity {}

        println("Account: ${resp.account}")
        println("UserID: ${resp.userId}")
        println("ARN: ${resp.arn}")
    }
}

Should see the SSO role and user in the output.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

A new generated diff is ready to view: __generated-main...__generated-feat-sso-provider

[github-actions]

A new generated diff is ready to view: __generated-main...__generated-feat-sso-provider

[sonarqubecloud]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
3 Code Smells

No Coverage information
14.4% Duplication