Account ID endpoint routing #3031
Conversation
Codecov ReportAttention:
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## develop #3031 +/- ##
===========================================
+ Coverage 93.46% 93.50% +0.04%
===========================================
Files 66 66
Lines 14007 14129 +122
===========================================
+ Hits 13091 13212 +121
- Misses 916 917 +1
☔ View full report in Codecov by Sentry. |
dlm6693
force-pushed
the
account-id-endpoints
branch
from
7ae7209
to
9f5f79d
Compare
dlm6693
force-pushed
the
account-id-endpoints
branch
3 times, most recently
from
8335a05
to
b3b5034
Compare
dlm6693
force-pushed
the
account-id-endpoints
branch
from
281f87f
to
189f2a0
Compare
…plify resolution branching logic
…param on a ruleset
dlm6693
force-pushed
the
account-id-endpoints
branch
from
363b96c
to
83017c5
Compare
tests/unit/test_credentials.py
Outdated
| def test_account_id_refresh(self): | ||
| metadata = self.metadata.copy() | ||
| metadata['account_id'] = '123456789012' | ||
| self.refresher.return_value = metadata | ||
| self.mock_time.return_value = datetime.now(tzlocal()) | ||
| self.assertTrue(self.creds.refresh_needed()) | ||
| self.assertEqual(self.creds.account_id, '123456789012') |
There was a problem hiding this comment.
This test is a little opaque at first glance. We should make it clear that it's setting the account ID on an otherwise unset pair of credentials during refresh. That could be done with a few word docstring and asserting self.creds.account_id is None before mocking.
There was a problem hiding this comment.
Accessing self.creds.account_id triggers the refresh. I've updated to change the expiry time so we can refresh again and set account ID the second time.
There was a problem hiding this comment.
Since there is extra work required to trigger a refresh twice in the same test, I refactored to make the unset check a separate test.
…o only builtin resolver is checking conditions
|
Resolving for inclusion at a later date. |
Adds the ability for AWS services to route customers to account ID-specific endpoints. This PR can be reviewed in two parts.
Part 1 (commits 1-2)
Adds
account_idas an optional input toCredentials,RefreshableCredentialsandReadOnlyCredentials. It is also added toDeferredRefreshableCredentialsas an internal variable.It is resolved to a non-null value when possible in a number of supported credential providers:
AssumeRoleProvider/AssumeRoleWithWebIdentityProvider: parsed fromAssumedRoleUser.Arnin assume role response.SSOProvider: sourced fromsso_account_idprofile parameter in AWS config fileEnvProvider: sourced fromAWS_ACCOUNT_IDenvironment variableConfigProvider: sourced fromaws_account_idprofile parameter in AWS config fileSharedCredentialsProvider: sourced fromaws_account_idprofile parameter in AWS shared credentials fileProcessProvider: sourced fromAccountIdparameter returned in credential process response oraws_account_idprofile parameter if the former isn't available.It can also be configured statically to a botocore client via the
aws_account_idarg inSession.create_clientor theaccount_idarg inSession.set_credentialsPart 2 (commits 3-4)
Adds the config setting
account_id_endpoint_modeand used during endpoint resolution. When enabled and configured in a service's ruleset, the endpoint resolver will attempt to resolveAccountIdas an input parameter to the endpoint provider.Aws::Auth::AccountIddefaulting toNone. If the config setting is enabled, the parameter is configured in the ruleset and the builtin hasn't been set during thebefore-endpoint-resolutionevent, account ID will be resolved from credentials.account_id_endpoint_modearepreferred,requiredanddisabled(case sensitive). Defaults topreferredif not supplied by a customer.UNSIGNEDrequests and presigned URLsUpdates since opening the PR
CredentialBuiltinResolveris responsible for actually resolving the account ID value (and future credential builtin values). If/when other types of builtin resolvers are required they will all be passed toEndpointBuiltinResolver. This construct has one public APIresolvewhich is called by the ruleset resolver.