Credentials Management

.changes/next-release/Bug Fix-7c5a454e-97e7-4f9e-91b7-c215d978f3c8.json

@@ -0,0 +1,4 @@
+{
+    "type": "Bug Fix",
+    "description": "Fixed an issue where invalid credentials were reused until VS Code was closed and re-opened, even if the credentials source was updated. It is no longer necessary to restart VS Code. (#705)"
+}

.changes/next-release/Feature-1c091dfc-c519-4fa1-8f1a-7ab8d7db214b.json

@@ -0,0 +1,4 @@
+{
+    "type": "Feature",
+    "description": "When credentials are invalid a notification is shown. To help diagnose these situations, a button was added to the notification that can open the logs."
+}

.changes/next-release/Feature-681f79db-6ef7-4172-9f5a-52b42c93ede6.json

@@ -0,0 +1,4 @@
+{
+    "type": "Feature",
+    "description": "When changes are made to Shared Credentials files, they will be picked up by the Toolkit the next time credentials are selected during the 'Connect to AWS' command."
+}

.changes/next-release/Feature-8fac7fd9-cdfb-4a82-8dba-31a1da5197b7.json

@@ -0,0 +1,4 @@
+{
+    "type": "Feature",
+    "description": "Credentials were previously shown by their Shared Credentials profile names. They are now displayed in a \"type:name\" format, to better indicate the type of Credentials being used, and to support additional Credentials types in the future. Shared Credentials are shown with the type \"profile\"."
+}

package.nls.json

@@ -87,8 +87,9 @@
     "AWS.log.invalidLevel": "Invalid log level: {0}",
     "AWS.message.loading": "Loading...",
     "AWS.message.credentials.error": "There was an issue trying to use credentials profile {0}: {1}",
-    "AWS.message.credentials.invalidProfile": "Credentials profile {0} is invalid",
-    "AWS.message.credentials.invalidProfile.help": "Get Help...",
+    "AWS.message.credentials.invalid": "Invalid Credentials {0}, see logs for more information.",
+    "AWS.message.credentials.invalid.help": "Get Help...",
+    "AWS.message.credentials.invalid.logs": "View logs...",
     "AWS.message.enterProfileName": "Enter the name of the credential profile to use",
     "AWS.message.info.cloudFormation.delete": "Deleted CloudFormation Stack {0}",
     "AWS.message.error.cloudFormation.delete": "An error occurred while deleting CloudFormation Stack {0}. Please check the stack events on the AWS Console",

src/awsexplorer/defaultRegion.ts

@@ -9,7 +9,6 @@ const localize = nls.loadMessageBundle()
 import * as vscode from 'vscode'
 import { AwsContext } from '../shared/awsContext'
 import { extensionSettingsPrefix } from '../shared/constants'
-import { DefaultCredentialsFileReaderWriter } from '../shared/credentials/defaultCredentialsFileReaderWriter'
 import { AwsExplorer } from './awsExplorer'
 
 /**
@@ -51,9 +50,7 @@ export async function checkExplorerForDefaultRegion(
     awsContext: AwsContext,
     awsExplorer: AwsExplorer
 ): Promise<void> {
-    const credentialReaderWriter = new DefaultCredentialsFileReaderWriter()
-
-    const profileRegion = await credentialReaderWriter.getDefaultRegion(profileName)
+    const profileRegion = awsContext.getCredentialDefaultRegion()
     if (!profileRegion) {
         return
     }

src/credentials/activation.ts

@@ -9,6 +9,8 @@ import { profileSettingKey } from '../shared/constants'
 import { CredentialsProfileMru } from '../shared/credentials/credentialsProfileMru'
 import { SettingsConfiguration } from '../shared/settingsConfiguration'
 import { LoginManager } from './loginManager'
+import { CREDENTIALS_PROVIDER_ID_SEPARATOR, makeCredentialsProviderId } from './providers/credentialsProviderId'
+import { SharedCredentialsProvider } from './providers/sharedCredentialsProvider'
 
 export interface CredentialsInitializeParameters {
     extensionContext: vscode.ExtensionContext
@@ -29,8 +31,17 @@ export async function loginWithMostRecentCredentials(
     toolkitSettings: SettingsConfiguration,
     loginManager: LoginManager
 ): Promise<void> {
-    const previousCredentialsId = toolkitSettings.readSetting(profileSettingKey, '')
+    let previousCredentialsId = toolkitSettings.readSetting<string>(profileSettingKey, '')
     if (previousCredentialsId) {
+        // Migrate from older Toolkits - If the last providerId isn't in the new CredentialProviderId format,
+        // treat it like a Shared Crdentials Provider.
+        if (previousCredentialsId.indexOf(CREDENTIALS_PROVIDER_ID_SEPARATOR) === -1) {
+            previousCredentialsId = makeCredentialsProviderId({
+                credentialType: SharedCredentialsProvider.getCredentialsType(),
+                credentialTypeId: previousCredentialsId
+            })
+        }
+
         await loginManager.login(previousCredentialsId)
     } else {
         await loginManager.logout()

src/credentials/credentialsCreator.ts

@@ -6,27 +6,13 @@
 import * as nls from 'vscode-nls'
 const localize = nls.loadMessageBundle()
 
-import * as AWS from 'aws-sdk'
 import * as vscode from 'vscode'
 
 const ERROR_MESSAGE_USER_CANCELLED = localize(
     'AWS.error.mfa.userCancelled',
     'User cancelled entering authentication code'
 )
 
-export async function createCredentials(profileName: string): Promise<AWS.Credentials> {
-    const provider = new AWS.CredentialProviderChain([
-        () => new AWS.ProcessCredentials({ profile: profileName }),
-        () =>
-            new AWS.SharedIniFileCredentials({
-                profile: profileName,
-                tokenCodeFn: async (mfaSerial, callback) => await getMfaTokenFromUser(mfaSerial, profileName, callback)
-            })
-    ])
-
-    return provider.resolvePromise()
-}
-
 /**
  * @description Prompts user for MFA token
  *

src/credentials/credentialsStore.ts

@@ -5,11 +5,16 @@
 
 import * as AWS from 'aws-sdk'
 
+interface CredentialsData {
+    credentials: AWS.Credentials
+    credentialsHashCode: number
+}
+
 /**
  * Simple cache for credentials
  */
 export class CredentialsStore {
-    private readonly credentialsCache: { [key: string]: AWS.Credentials }
+    private readonly credentialsCache: { [key: string]: CredentialsData }
 
     public constructor() {
         this.credentialsCache = {}
@@ -19,26 +24,33 @@ export class CredentialsStore {
      * Returns undefined if credentials are not stored for given ID
      */
     public async getCredentials(credentialsId: string): Promise<AWS.Credentials | undefined> {
-        return this.credentialsCache[credentialsId]
+        return this.credentialsCache[credentialsId]?.credentials
     }
 
     /**
      * If credentials are not stored, the provided create function is called. Created credentials are then stored.
      */
     public async getCredentialsOrCreate(
         credentialsId: string,
-        createCredentialsFn: (credentialsId: string) => Promise<AWS.Credentials>
+        createCredentialsFn: (credentialsId: string) => Promise<CredentialsData>
     ): Promise<AWS.Credentials> {
-        let credentials = await this.getCredentials(credentialsId)
+        const credentials = await this.getCredentials(credentialsId)
 
         if (credentials) {
             return credentials
         }
 
-        credentials = await createCredentialsFn(credentialsId)
-        this.credentialsCache[credentialsId] = credentials
+        const newCredentials = await createCredentialsFn(credentialsId)
+        this.credentialsCache[credentialsId] = newCredentials
+
+        return newCredentials.credentials
+    }
 
-        return credentials
+    /**
+     * Returns undefined if credentials are not stored for given ID
+     */
+    public getCredentialsHashCode(credentialsId: string): number | undefined {
+        return this.credentialsCache[credentialsId]?.credentialsHashCode
     }
 
     /**

src/credentials/loginManager.ts

@@ -1,14 +1,19 @@
 /*!
- * Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import * as nls from 'vscode-nls'
+const localize = nls.loadMessageBundle()
+
+import * as vscode from 'vscode'
 import { AwsContext } from '../shared/awsContext'
+import { credentialHelpUrl } from '../shared/constants'
 import { getAccountId } from '../shared/credentials/accountId'
-import { UserCredentialsUtils } from '../shared/credentials/userCredentialsUtils'
 import { getLogger } from '../shared/logger'
-import { createCredentials } from './credentialsCreator'
 import { CredentialsStore } from './credentialsStore'
+import { CredentialsProvider } from './providers/credentialsProvider'
+import { CredentialsProviderManager } from './providers/credentialsProviderManager'
 
 export class LoginManager {
     private readonly credentialsStore: CredentialsStore = new CredentialsStore()
@@ -21,31 +26,40 @@ export class LoginManager {
      */
     public async login(credentialsId: string): Promise<void> {
         try {
-            const credentials = await this.credentialsStore.getCredentialsOrCreate(credentialsId, createCredentials)
+            const provider = await CredentialsProviderManager.getInstance().getCredentialsProvider(credentialsId)
+            if (!provider) {
+                throw new Error(`Could not find Credentials Provider for ${credentialsId}`)
+            }
+
+            await this.updateCredentialsStore(credentialsId, provider)
+
+            const credentials = await this.credentialsStore.getCredentials(credentialsId)
             if (!credentials) {
                 throw new Error(`No credentials found for id ${credentialsId}`)
             }
 
             // TODO : Get a region relevant to the partition for these credentials -- https://github.com/aws/aws-toolkit-vscode/issues/188
             const accountId = await getAccountId(credentials, 'us-east-1')
-
             if (!accountId) {
                 throw new Error('Could not determine Account Id for credentials')
             }
 
             await this.awsContext.setCredentials({
                 credentials: credentials,
                 credentialsId: credentialsId,
-                accountId: accountId
+                accountId: accountId,
+                defaultRegion: provider.getDefaultRegion()
             })
         } catch (err) {
-            getLogger().error('Error logging in', err as Error)
+            getLogger().error(
+                `Error trying to connect to AWS with Credentials Provider ${credentialsId}. Toolkit will now disconnect from AWS.`,
+                err as Error
+            )
             this.credentialsStore.invalidateCredentials(credentialsId)
 
             await this.logout()
 
-            // tslint:disable-next-line: no-floating-promises
-            UserCredentialsUtils.notifyUserCredentialsAreBad(credentialsId)
+            this.notifyUserInvalidCredentials(credentialsId)
         }
     }
 
@@ -55,4 +69,45 @@ export class LoginManager {
     public async logout(): Promise<void> {
         await this.awsContext.setCredentials(undefined)
     }
+
+    /**
+     * Updates the CredentialsStore if the credentials are considered different
+     */
+    private async updateCredentialsStore(credentialsId: string, provider: CredentialsProvider): Promise<void> {
+        const currentHash = this.credentialsStore.getCredentialsHashCode(credentialsId)
+        if (provider.getHashCode() !== currentHash) {
+            getLogger().verbose(`Credentials for ${credentialsId} have changed, using updated credentials.`)
+            this.credentialsStore.invalidateCredentials(credentialsId)
+        }
+
+        await this.credentialsStore.getCredentialsOrCreate(credentialsId, async () => {
+            return {
+                credentials: await provider.getCredentials(),
+                credentialsHashCode: provider.getHashCode()
+            }
+        })
+    }
+
+    private notifyUserInvalidCredentials(credentialProviderId: string) {
+        const getHelp = localize('AWS.message.credentials.invalid.help', 'Get Help...')
+        const viewLogs = localize('AWS.message.credentials.invalid.logs', 'View logs...')
+
+        vscode.window
+            .showErrorMessage(
+                localize(
+                    'AWS.message.credentials.invalid',
+                    'Invalid Credentials {0}, see logs for more information.',
+                    credentialProviderId
+                ),
+                getHelp,
+                viewLogs
+            )
+            .then((selection: string | undefined) => {
+                if (selection === getHelp) {
+                    vscode.env.openExternal(vscode.Uri.parse(credentialHelpUrl))
+                } else if (selection === viewLogs) {
+                    vscode.commands.executeCommand('aws.viewLogs')
+                }
+            })
+    }
 }

src/credentials/providers/credentialsProvider.ts

@@ -0,0 +1,11 @@
+/*!
+ * Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export interface CredentialsProvider {
+    getCredentialsProviderId(): string
+    getDefaultRegion(): string | undefined
+    getHashCode(): number
+    getCredentials(): Promise<AWS.Credentials>
+}

src/credentials/providers/credentialsProviderFactory.ts

@@ -0,0 +1,50 @@
+/*!
+ * Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { CredentialsProvider } from './credentialsProvider'
+
+/**
+ * Responsible for producing CredentialsProvider objects for a Credential Type
+ */
+export interface CredentialsProviderFactory {
+    getCredentialType(): string
+    listProviders(): CredentialsProvider[]
+    getProvider(credentialsProviderId: string): CredentialsProvider | undefined
+    refresh(): Promise<void>
+}
+
+export abstract class BaseCredentialsProviderFactory<T extends CredentialsProvider>
+    implements CredentialsProviderFactory {
+    protected providers: T[] = []
+    public abstract getCredentialType(): string
+
+    public listProviders(): T[] {
+        return [...this.providers]
+    }
+
+    public getProvider(credentialsProviderId: string): CredentialsProvider | undefined {
+        for (const provider of this.providers) {
+            if (provider.getCredentialsProviderId() === credentialsProviderId) {
+                return provider
+            }
+        }
+
+        return undefined
+    }
+
+    public abstract async refresh(): Promise<void>
+
+    protected addProvider(provider: T) {
+        this.providers.push(provider)
+    }
+
+    protected removeProvider(provider: T) {
+        this.providers = this.providers.filter(x => x !== provider)
+    }
+
+    protected resetProviders() {
+        this.providers = []
+    }
+}

src/credentials/providers/credentialsProviderId.ts

@@ -0,0 +1,30 @@
+/*!
+ * Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export const CREDENTIALS_PROVIDER_ID_SEPARATOR = ':'
+
+export interface CredentialsProviderIdComponents {
+    credentialType: string
+    credentialTypeId: string
+}
+
+export function makeCredentialsProviderIdComponents(credentialsProviderId: string): CredentialsProviderIdComponents {
+    const chunks = credentialsProviderId.split(CREDENTIALS_PROVIDER_ID_SEPARATOR)
+
+    if (chunks.length !== 2) {
+        throw new Error(`Unexpected credentialsProviderId format: ${credentialsProviderId}`)
+    }
+
+    return {
+        credentialType: chunks[0],
+        credentialTypeId: chunks[1]
+    }
+}
+
+export function makeCredentialsProviderId(credentialsProviderIdComponents: CredentialsProviderIdComponents): string {
+    return [credentialsProviderIdComponents.credentialType, credentialsProviderIdComponents.credentialTypeId].join(
+        CREDENTIALS_PROVIDER_ID_SEPARATOR
+    )
+}