Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified
📁 ..	-	2025-05-25 12:27
📄 chain_provider.go package credentials import ( "github.com/aws/aws-sdk-go/aws/awserr" ) var ( // ErrNoValidProvidersFoundInChain Is returned when there are no valid // providers in the ChainProvider. // // This has been deprecated. For verbose error messaging set // aws.Config.CredentialsChainVerboseErrors to true. ErrNoValidProvidersFoundInChain = awserr.New("NoCredentialProviders", `no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors`, nil) ) // A ChainProvider will search for a provider which returns credentials // and cache that provider until Retrieve is called again. // // The ChainProvider provides a way of chaining multiple providers together // which will pick the first available using priority order of the Providers // in the list. // // If none of the Providers retrieve valid credentials Value, ChainProvider's // Retrieve() will return the error ErrNoValidProvidersFoundInChain. // // If a Provider is found which returns valid credentials Value ChainProvider // will cache that Provider for all calls to IsExpired(), until Retrieve is // called again. // // Example of ChainProvider to be used with an EnvProvider and EC2RoleProvider. // In this example EnvProvider will first check if any credentials are available // via the environment variables. If there are none ChainProvider will check // the next Provider in the list, EC2RoleProvider in this case. If EC2RoleProvider // does not return any credentials ChainProvider will return the error // ErrNoValidProvidersFoundInChain // // creds := credentials.NewChainCredentials( // []credentials.Provider{ // &credentials.EnvProvider{}, // &ec2rolecreds.EC2RoleProvider{ // Client: ec2metadata.New(sess), // }, // }) // // // Usage of ChainCredentials with aws.Config // svc := ec2.New(session.Must(session.NewSession(&aws.Config{ // Credentials: creds, // }))) // type ChainProvider struct { Providers []Provider curr Provider VerboseErrors bool } // NewChainCredentials returns a pointer to a new Credentials object // wrapping a chain of providers. func NewChainCredentials(providers []Provider) Credentials { return NewCredentials(&ChainProvider{ Providers: append([]Provider{}, providers...), }) } // Retrieve returns the credentials value or error if no provider returned // without error. // // If a provider is found it will be cached and any calls to IsExpired() // will return the expired state of the cached provider. func (c ChainProvider) Retrieve() (Value, error) { var errs []error for _, p := range c.Providers { creds, err := p.Retrieve() if err == nil { c.curr = p return creds, nil } errs = append(errs, err) } c.curr = nil var err error err = ErrNoValidProvidersFoundInChain if c.VerboseErrors { err = awserr.NewBatchError("NoCredentialProviders", "no valid providers in chain", errs) } return Value{}, err } // IsExpired will returned the expired state of the currently cached provider // if there is one. If there is no current provider, true will be returned. func (c *ChainProvider) IsExpired() bool { if c.curr != nil { return c.curr.IsExpired() } return true }	3.19 KB	2025-05-25 12:27
📄 chain_provider_test.go package credentials import ( "reflect" "testing" "github.com/aws/aws-sdk-go/aws/awserr" ) type secondStubProvider struct { creds Value expired bool err error } func (s secondStubProvider) Retrieve() (Value, error) { s.expired = false s.creds.ProviderName = "secondStubProvider" return s.creds, s.err } func (s secondStubProvider) IsExpired() bool { return s.expired } func TestChainProviderWithNames(t testing.T) { p := &ChainProvider{ Providers: []Provider{ &stubProvider{err: awserr.New("FirstError", "first provider error", nil)}, &stubProvider{err: awserr.New("SecondError", "second provider error", nil)}, &secondStubProvider{ creds: Value{ AccessKeyID: "AKIF", SecretAccessKey: "NOSECRET", SessionToken: "", }, }, &stubProvider{ creds: Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "", }, }, }, } creds, err := p.Retrieve() if err != nil { t.Errorf("Expect no error, got %v", err) } if e, a := "secondStubProvider", creds.ProviderName; e != a { t.Errorf("Expect provider name to match, %v got, %v", e, a) } // Also check credentials if e, a := "AKIF", creds.AccessKeyID; e != a { t.Errorf("Expect access key ID to match, %v got %v", e, a) } if e, a := "NOSECRET", creds.SecretAccessKey; e != a { t.Errorf("Expect secret access key to match, %v got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expect session token to be empty, %v", v) } } func TestChainProviderGet(t testing.T) { p := &ChainProvider{ Providers: []Provider{ &stubProvider{err: awserr.New("FirstError", "first provider error", nil)}, &stubProvider{err: awserr.New("SecondError", "second provider error", nil)}, &stubProvider{ creds: Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "", }, }, }, } creds, err := p.Retrieve() if err != nil { t.Errorf("Expect no error, got %v", err) } if e, a := "AKID", creds.AccessKeyID; e != a { t.Errorf("Expect access key ID to match, %v got %v", e, a) } if e, a := "SECRET", creds.SecretAccessKey; e != a { t.Errorf("Expect secret access key to match, %v got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expect session token to be empty, %v", v) } } func TestChainProviderIsExpired(t testing.T) { stubProvider := &stubProvider{expired: true} p := &ChainProvider{ Providers: []Provider{ stubProvider, }, } if !p.IsExpired() { t.Errorf("Expect expired to be true before any Retrieve") } _, err := p.Retrieve() if err != nil { t.Errorf("Expect no error, got %v", err) } if p.IsExpired() { t.Errorf("Expect not expired after retrieve") } stubProvider.expired = true if !p.IsExpired() { t.Errorf("Expect return of expired provider") } _, err = p.Retrieve() if err != nil { t.Errorf("Expect no error, got %v", err) } if p.IsExpired() { t.Errorf("Expect not expired after retrieve") } } func TestChainProviderWithNoProvider(t testing.T) { p := &ChainProvider{ Providers: []Provider{}, } if !p.IsExpired() { t.Errorf("Expect expired with no providers") } _, err := p.Retrieve() if e, a := ErrNoValidProvidersFoundInChain, err; e != a { t.Errorf("Expect no providers error returned, %v, got %v", e, a) } } func TestChainProviderWithNoValidProvider(t testing.T) { errs := []error{ awserr.New("FirstError", "first provider error", nil), awserr.New("SecondError", "second provider error", nil), } p := &ChainProvider{ Providers: []Provider{ &stubProvider{err: errs[0]}, &stubProvider{err: errs[1]}, }, } if !p.IsExpired() { t.Errorf("Expect expired with no providers") } _, err := p.Retrieve() if e, a := ErrNoValidProvidersFoundInChain, err; e != a { t.Errorf("Expect no providers error returned, %v, got %v", e, a) } } func TestChainProviderWithNoValidProviderWithVerboseEnabled(t testing.T) { errs := []error{ awserr.New("FirstError", "first provider error", nil), awserr.New("SecondError", "second provider error", nil), } p := &ChainProvider{ VerboseErrors: true, Providers: []Provider{ &stubProvider{err: errs[0]}, &stubProvider{err: errs[1]}, }, } if !p.IsExpired() { t.Errorf("Expect expired with no providers") } _, err := p.Retrieve() expectErr := awserr.NewBatchError("NoCredentialProviders", "no valid providers in chain", errs) if e, a := expectErr, err; !reflect.DeepEqual(e, a) { t.Errorf("Expect no providers error returned, %v, got %v", e, a) } }	4.46 KB	2025-05-25 12:27
📄 context_background_go1.5.go //go:build !go1.7 // +build !go1.7 package credentials import ( "github.com/aws/aws-sdk-go/internal/context" ) // backgroundContext returns a context that will never be canceled, has no // values, and no deadline. This context is used by the SDK to provide // backwards compatibility with non-context API operations and functionality. // // Go 1.6 and before: // This context function is equivalent to context.Background in the Go stdlib. // // Go 1.7 and later: // The context returned will be the value returned by context.Background() // // See https://golang.org/pkg/context for more information on Contexts. func backgroundContext() Context { return context.BackgroundCtx }	684 B	2025-05-25 12:27
📄 context_background_go1.7.go //go:build go1.7 // +build go1.7 package credentials import "context" // backgroundContext returns a context that will never be canceled, has no // values, and no deadline. This context is used by the SDK to provide // backwards compatibility with non-context API operations and functionality. // // Go 1.6 and before: // This context function is equivalent to context.Background in the Go stdlib. // // Go 1.7 and later: // The context returned will be the value returned by context.Background() // // See https://golang.org/pkg/context for more information on Contexts. func backgroundContext() Context { return context.Background() }	641 B	2025-05-25 12:27
📄 context_go1.5.go //go:build !go1.9 // +build !go1.9 package credentials import "time" // Context is an copy of the Go v1.7 stdlib's context.Context interface. // It is represented as a SDK interface to enable you to use the "WithContext" // API methods with Go v1.6 and a Context type such as golang.org/x/net/context. // // This type, aws.Context, and context.Context are equivalent. // // See https://golang.org/pkg/context on how to use contexts. type Context interface { // Deadline returns the time when work done on behalf of this context // should be canceled. Deadline returns ok==false when no deadline is // set. Successive calls to Deadline return the same results. Deadline() (deadline time.Time, ok bool) // Done returns a channel that's closed when work done on behalf of this // context should be canceled. Done may return nil if this context can // never be canceled. Successive calls to Done return the same value. Done() <-chan struct{} // Err returns a non-nil error value after Done is closed. Err returns // Canceled if the context was canceled or DeadlineExceeded if the // context's deadline passed. No other values for Err are defined. // After Done is closed, successive calls to Err return the same value. Err() error // Value returns the value associated with this context for key, or nil // if no value is associated with key. Successive calls to Value with // the same key returns the same result. // // Use context values only for request-scoped data that transits // processes and API boundaries, not for passing optional parameters to // functions. Value(key interface{}) interface{} }	1.59 KB	2025-05-25 12:27
📄 context_go1.9.go //go:build go1.9 // +build go1.9 package credentials import "context" // Context is an alias of the Go stdlib's context.Context interface. // It can be used within the SDK's API operation "WithContext" methods. // // This type, aws.Context, and context.Context are equivalent. // // See https://golang.org/pkg/context on how to use contexts. type Context = context.Context	376 B	2025-05-25 12:27
📄 credentials.go // Package credentials provides credential retrieval and management // // The Credentials is the primary method of getting access to and managing // credentials Values. Using dependency injection retrieval of the credential // values is handled by a object which satisfies the Provider interface. // // By default the Credentials.Get() will cache the successful result of a // Provider's Retrieve() until Provider.IsExpired() returns true. At which // point Credentials will call Provider's Retrieve() to get new credential Value. // // The Provider is responsible for determining when credentials Value have expired. // It is also important to note that Credentials will always call Retrieve the // first time Credentials.Get() is called. // // Example of using the environment variable credentials. // // creds := credentials.NewEnvCredentials() // // // Retrieve the credentials value // credValue, err := creds.Get() // if err != nil { // // handle error // } // // Example of forcing credentials to expire and be refreshed on the next Get(). // This may be helpful to proactively expire credentials and refresh them sooner // than they would naturally expire on their own. // // creds := credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{}) // creds.Expire() // credsValue, err := creds.Get() // // New credentials will be retrieved instead of from cache. // // // Custom Provider // // Each Provider built into this package also provides a helper method to generate // a Credentials pointer setup with the provider. To use a custom Provider just // create a type which satisfies the Provider interface and pass it to the // NewCredentials method. // // type MyProvider struct{} // func (m MyProvider) Retrieve() (Value, error) {...} // func (m MyProvider) IsExpired() bool {...} // // creds := credentials.NewCredentials(&MyProvider{}) // credValue, err := creds.Get() // package credentials import ( "fmt" "sync" "time" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/internal/sync/singleflight" ) // AnonymousCredentials is an empty Credential object that can be used as // dummy placeholder credentials for requests that do not need signed. // // This Credentials can be used to configure a service to not sign requests // when making service API calls. For example, when accessing public // s3 buckets. // // svc := s3.New(session.Must(session.NewSession(&aws.Config{ // Credentials: credentials.AnonymousCredentials, // }))) // // Access public S3 buckets. var AnonymousCredentials = NewStaticCredentials("", "", "") // A Value is the AWS credentials value for individual credential fields. type Value struct { // AWS Access key ID AccessKeyID string // AWS Secret Access Key SecretAccessKey string // AWS Session Token SessionToken string // Provider used to get credentials ProviderName string } // HasKeys returns if the credentials Value has both AccessKeyID and // SecretAccessKey value set. func (v Value) HasKeys() bool { return len(v.AccessKeyID) != 0 && len(v.SecretAccessKey) != 0 } // A Provider is the interface for any component which will provide credentials // Value. A provider is required to manage its own Expired state, and what to // be expired means. // // The Provider should not need to implement its own mutexes, because // that will be managed by Credentials. type Provider interface { // Retrieve returns nil if it successfully retrieved the value. // Error is returned if the value were not obtainable, or empty. Retrieve() (Value, error) // IsExpired returns if the credentials are no longer valid, and need // to be retrieved. IsExpired() bool } // ProviderWithContext is a Provider that can retrieve credentials with a Context type ProviderWithContext interface { Provider RetrieveWithContext(Context) (Value, error) } // An Expirer is an interface that Providers can implement to expose the expiration // time, if known. If the Provider cannot accurately provide this info, // it should not implement this interface. type Expirer interface { // The time at which the credentials are no longer valid ExpiresAt() time.Time } // An ErrorProvider is a stub credentials provider that always returns an error // this is used by the SDK when construction a known provider is not possible // due to an error. type ErrorProvider struct { // The error to be returned from Retrieve Err error // The provider name to set on the Retrieved returned Value ProviderName string } // Retrieve will always return the error that the ErrorProvider was created with. func (p ErrorProvider) Retrieve() (Value, error) { return Value{ProviderName: p.ProviderName}, p.Err } // IsExpired will always return not expired. func (p ErrorProvider) IsExpired() bool { return false } // A Expiry provides shared expiration logic to be used by credentials // providers to implement expiry functionality. // // The best method to use this struct is as an anonymous field within the // provider's struct. // // Example: // type EC2RoleProvider struct { // Expiry // ... // } type Expiry struct { // The date/time when to expire on expiration time.Time // If set will be used by IsExpired to determine the current time. // Defaults to time.Now if CurrentTime is not set. Available for testing // to be able to mock out the current time. CurrentTime func() time.Time } // SetExpiration sets the expiration IsExpired will check when called. // // If window is greater than 0 the expiration time will be reduced by the // window value. // // Using a window is helpful to trigger credentials to expire sooner than // the expiration time given to ensure no requests are made with expired // tokens. func (e Expiry) SetExpiration(expiration time.Time, window time.Duration) { // Passed in expirations should have the monotonic clock values stripped. // This ensures time comparisons will be based on wall-time. e.expiration = expiration.Round(0) if window > 0 { e.expiration = e.expiration.Add(-window) } } // IsExpired returns if the credentials are expired. func (e Expiry) IsExpired() bool { curTime := e.CurrentTime if curTime == nil { curTime = time.Now } return e.expiration.Before(curTime()) } // ExpiresAt returns the expiration time of the credential func (e Expiry) ExpiresAt() time.Time { return e.expiration } // A Credentials provides concurrency safe retrieval of AWS credentials Value. // Credentials will cache the credentials value until they expire. Once the value // expires the next Get will attempt to retrieve valid credentials. // // Credentials is safe to use across multiple goroutines and will manage the // synchronous state so the Providers do not need to implement their own // synchronization. // // The first Credentials.Get() will always call Provider.Retrieve() to get the // first instance of the credentials Value. All calls to Get() after that // will return the cached credentials Value until IsExpired() returns true. type Credentials struct { sf singleflight.Group m sync.RWMutex creds Value provider Provider } // NewCredentials returns a pointer to a new Credentials with the provider set. func NewCredentials(provider Provider) Credentials { c := &Credentials{ provider: provider, } return c } // GetWithContext returns the credentials value, or error if the credentials // Value failed to be retrieved. Will return early if the passed in context is // canceled. // // Will return the cached credentials Value if it has not expired. If the // credentials Value has expired the Provider's Retrieve() will be called // to refresh the credentials. // // If Credentials.Expire() was called the credentials Value will be force // expired, and the next call to Get() will cause them to be refreshed. // // Passed in Context is equivalent to aws.Context, and context.Context. func (c Credentials) GetWithContext(ctx Context) (Value, error) { // Check if credentials are cached, and not expired. select { case curCreds, ok := <-c.asyncIsExpired(): // ok will only be true, of the credentials were not expired. ok will // be false and have no value if the credentials are expired. if ok { return curCreds, nil } case <-ctx.Done(): return Value{}, awserr.New("RequestCanceled", "request context canceled", ctx.Err()) } // Cannot pass context down to the actual retrieve, because the first // context would cancel the whole group when there is not direct // association of items in the group. resCh := c.sf.DoChan("", func() (interface{}, error) { return c.singleRetrieve(&suppressedContext{ctx}) }) select { case res := <-resCh: return res.Val.(Value), res.Err case <-ctx.Done(): return Value{}, awserr.New("RequestCanceled", "request context canceled", ctx.Err()) } } func (c Credentials) singleRetrieve(ctx Context) (interface{}, error) { c.m.Lock() defer c.m.Unlock() if curCreds := c.creds; !c.isExpiredLocked(curCreds) { return curCreds, nil } var creds Value var err error if p, ok := c.provider.(ProviderWithContext); ok { creds, err = p.RetrieveWithContext(ctx) } else { creds, err = c.provider.Retrieve() } if err == nil { c.creds = creds } return creds, err } // Get returns the credentials value, or error if the credentials Value failed // to be retrieved. // // Will return the cached credentials Value if it has not expired. If the // credentials Value has expired the Provider's Retrieve() will be called // to refresh the credentials. // // If Credentials.Expire() was called the credentials Value will be force // expired, and the next call to Get() will cause them to be refreshed. func (c Credentials) Get() (Value, error) { return c.GetWithContext(backgroundContext()) } // Expire expires the credentials and forces them to be retrieved on the // next call to Get(). // // This will override the Provider's expired state, and force Credentials // to call the Provider's Retrieve(). func (c Credentials) Expire() { c.m.Lock() defer c.m.Unlock() c.creds = Value{} } // IsExpired returns if the credentials are no longer valid, and need // to be retrieved. // // If the Credentials were forced to be expired with Expire() this will // reflect that override. func (c Credentials) IsExpired() bool { c.m.RLock() defer c.m.RUnlock() return c.isExpiredLocked(c.creds) } // asyncIsExpired returns a channel of credentials Value. If the channel is // closed the credentials are expired and credentials value are not empty. func (c Credentials) asyncIsExpired() <-chan Value { ch := make(chan Value, 1) go func() { c.m.RLock() defer c.m.RUnlock() if curCreds := c.creds; !c.isExpiredLocked(curCreds) { ch <- curCreds } close(ch) }() return ch } // isExpiredLocked helper method wrapping the definition of expired credentials. func (c Credentials) isExpiredLocked(creds interface{}) bool { return creds == nil \|\| creds.(Value) == Value{} \|\| c.provider.IsExpired() } // ExpiresAt provides access to the functionality of the Expirer interface of // the underlying Provider, if it supports that interface. Otherwise, it returns // an error. func (c Credentials) ExpiresAt() (time.Time, error) { c.m.RLock() defer c.m.RUnlock() expirer, ok := c.provider.(Expirer) if !ok { return time.Time{}, awserr.New("ProviderNotExpirer", fmt.Sprintf("provider %s does not support ExpiresAt()", c.creds.ProviderName), nil) } if c.creds == (Value{}) { // set expiration time to the distant past return time.Time{}, nil } return expirer.ExpiresAt(), nil } type suppressedContext struct { Context } func (s suppressedContext) Deadline() (deadline time.Time, ok bool) { return time.Time{}, false } func (s suppressedContext) Done() <-chan struct{} { return nil } func (s *suppressedContext) Err() error { return nil }	11.63 KB	2025-05-25 12:27
📄 credentials_bench_test.go //go:build go1.9 // +build go1.9 package credentials import ( "fmt" "strconv" "sync" "testing" "time" ) func BenchmarkCredentials_Get(b testing.B) { stub := &stubProvider{} cases := []int{1, 10, 100, 500, 1000, 10000} for _, c := range cases { b.Run(strconv.Itoa(c), func(b testing.B) { creds := NewCredentials(stub) var wg sync.WaitGroup wg.Add(c) for i := 0; i < c; i++ { go func() { for j := 0; j < b.N; j++ { v, err := creds.Get() if err != nil { b.Errorf("expect no error %v, %v", v, err) } } wg.Done() }() } b.ResetTimer() wg.Wait() }) } } func BenchmarkCredentials_Get_Expire(b testing.B) { p := &blockProvider{} expRates := []int{10000, 1000, 100} cases := []int{1, 10, 100, 500, 1000, 10000} for _, expRate := range expRates { for _, c := range cases { b.Run(fmt.Sprintf("%d-%d", expRate, c), func(b testing.B) { creds := NewCredentials(p) var wg sync.WaitGroup wg.Add(c) for i := 0; i < c; i++ { go func(id int) { for j := 0; j < b.N; j++ { v, err := creds.Get() if err != nil { b.Errorf("expect no error %v, %v", v, err) } // periodically expire creds to cause rwlock if id == 0 && j%expRate == 0 { creds.Expire() } } wg.Done() }(i) } b.ResetTimer() wg.Wait() }) } } } type blockProvider struct { creds Value expired bool err error } func (s blockProvider) Retrieve() (Value, error) { s.expired = false s.creds.ProviderName = "blockProvider" time.Sleep(time.Millisecond) return s.creds, s.err } func (s blockProvider) IsExpired() bool { return s.expired }	1.67 KB	2025-05-25 12:27
📄 credentials_go1.7_test.go //go:build go1.7 // +build go1.7 package credentials import ( "context" "testing" ) func TestCredentialsGetWithContext(t testing.T) { stub := &stubProviderConcurrent{ stubProvider: stubProvider{ creds: Value{ AccessKeyID: "AKIDEXAMPLE", SecretAccessKey: "KEYEXAMPLE", }, }, done: make(chan struct{}), } c := NewCredentials(stub) ctx, cancel1 := context.WithCancel(context.Background()) ctx1 := &ContextWaiter{Context: ctx, waiting: make(chan struct{}, 1)} ctx2 := &ContextWaiter{Context: context.Background(), waiting: make(chan struct{}, 1)} var err1, err2 error var creds1, creds2 Value done1 := make(chan struct{}) go func() { creds1, err1 = c.GetWithContext(ctx1) close(done1) }() <-ctx1.waiting <-ctx1.waiting done2 := make(chan struct{}) go func() { creds2, err2 = c.GetWithContext(ctx2) close(done2) }() <-ctx2.waiting cancel1() <-done1 close(stub.done) <-done2 if err1 == nil { t.Errorf("expect first to have error") } if creds1.HasKeys() { t.Errorf("expect first not to have keys, %v", creds1) } if err2 != nil { t.Errorf("expect second not to have error, %v", err2) } if !creds2.HasKeys() { t.Errorf("expect second to have keys") } } type ContextWaiter struct { context.Context waiting chan struct{} } func (c ContextWaiter) Done() <-chan struct{} { go func() { c.waiting <- struct{}{} }() return c.Context.Done() }	1.39 KB	2025-05-25 12:27
📄 credentials_test.go package credentials import ( "math/rand" "sync" "testing" "time" "github.com/aws/aws-sdk-go/aws/awserr" ) type stubProvider struct { creds Value retrievedCount int expired bool err error } func (s stubProvider) Retrieve() (Value, error) { s.retrievedCount++ s.expired = false s.creds.ProviderName = "stubProvider" return s.creds, s.err } func (s stubProvider) IsExpired() bool { return s.expired } func TestCredentialsGet(t testing.T) { c := NewCredentials(&stubProvider{ creds: Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "", }, expired: true, }) creds, err := c.Get() if err != nil { t.Errorf("Expected no error, got %v", err) } if e, a := "AKID", creds.AccessKeyID; e != a { t.Errorf("Expect access key ID to match, %v got %v", e, a) } if e, a := "SECRET", creds.SecretAccessKey; e != a { t.Errorf("Expect secret access key to match, %v got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expect session token to be empty, %v", v) } } func TestCredentialsGetWithError(t testing.T) { c := NewCredentials(&stubProvider{err: awserr.New("provider error", "", nil), expired: true}) _, err := c.Get() if e, a := "provider error", err.(awserr.Error).Code(); e != a { t.Errorf("Expected provider error, %v got %v", e, a) } } func TestCredentialsExpire(t testing.T) { stub := &stubProvider{} c := NewCredentials(stub) stub.expired = false if !c.IsExpired() { t.Errorf("Expected to start out expired") } c.Expire() if !c.IsExpired() { t.Errorf("Expected to be expired") } c.Get() if c.IsExpired() { t.Errorf("Expected not to be expired") } stub.expired = true if !c.IsExpired() { t.Errorf("Expected to be expired") } } type MockProvider struct { Expiry } func (MockProvider) Retrieve() (Value, error) { return Value{}, nil } func TestCredentialsGetWithProviderName(t testing.T) { stub := &stubProvider{} c := NewCredentials(stub) creds, err := c.Get() if err != nil { t.Errorf("Expected no error, got %v", err) } if e, a := creds.ProviderName, "stubProvider"; e != a { t.Errorf("Expected provider name to match, %v got %v", e, a) } } func TestCredentialsIsExpired_Race(t testing.T) { creds := NewChainCredentials([]Provider{&MockProvider{}}) starter := make(chan struct{}) var wg sync.WaitGroup wg.Add(10) for i := 0; i < 10; i++ { go func() { defer wg.Done() <-starter for i := 0; i < 100; i++ { creds.IsExpired() } }() } close(starter) wg.Wait() } func TestCredentialsExpiresAt_NoExpirer(t testing.T) { stub := &stubProvider{} c := NewCredentials(stub) _, err := c.ExpiresAt() if e, a := "ProviderNotExpirer", err.(awserr.Error).Code(); e != a { t.Errorf("Expected provider error, %v got %v", e, a) } } type stubProviderExpirer struct { stubProvider expiration time.Time } func (s stubProviderExpirer) ExpiresAt() time.Time { return s.expiration } func TestCredentialsExpiresAt_HasExpirer(t testing.T) { stub := &stubProviderExpirer{} c := NewCredentials(stub) // fetch initial credentials so that forceRefresh is set false _, err := c.Get() if err != nil { t.Errorf("Unexpecte error: %v", err) } stub.expiration = time.Unix(rand.Int63(), 0) expiration, err := c.ExpiresAt() if err != nil { t.Errorf("Expected no error, got %v", err) } if stub.expiration != expiration { t.Errorf("Expected matching expiration, %v got %v", stub.expiration, expiration) } c.Expire() expiration, err = c.ExpiresAt() if err != nil { t.Errorf("Expected no error, got %v", err) } if !expiration.IsZero() { t.Errorf("Expected distant past expiration, got %v", expiration) } } type stubProviderConcurrent struct { stubProvider done chan struct{} } func (s stubProviderConcurrent) Retrieve() (Value, error) { <-s.done return s.stubProvider.Retrieve() } func TestCredentialsGetConcurrent(t testing.T) { stub := &stubProviderConcurrent{ done: make(chan struct{}), } c := NewCredentials(stub) done := make(chan struct{}) for i := 0; i < 2; i++ { go func() { c.Get() done <- struct{}{} }() } // Validates that a single call to Retrieve is shared between two calls to Get stub.done <- struct{}{} <-done <-done } type stubProviderRefreshable struct { creds Value expired bool hasRetrieved bool } func (s stubProviderRefreshable) Retrieve() (Value, error) { // On first retrieval, return the creds that this provider was created with. // On subsequent retrievals, return new refreshed credentials. if !s.hasRetrieved { s.expired = true s.hasRetrieved = true } else { s.creds = Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "NEW_SESSION", } s.expired = false time.Sleep(10 * time.Millisecond) } return s.creds, nil } func (s stubProviderRefreshable) IsExpired() bool { return s.expired } func TestCredentialsGet_RefreshableProviderRace(t testing.T) { stub := &stubProviderRefreshable{ creds: Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "OLD_SESSION", }, } c := NewCredentials(stub) // The first Get() causes stubProviderRefreshable to consider its // OLD_SESSION credentials expired on subsequent retrievals. creds, err := c.Get() if err != nil { t.Errorf("Expected no error, got %v", err) } if e, a := "OLD_SESSION", creds.SessionToken; e != a { t.Errorf("Expect session token to match, %v got %v", e, a) } // Since stubProviderRefreshable considers its OLD_SESSION credentials // expired, all subsequent calls to Get() should retrieve NEW_SESSION creds. var wg sync.WaitGroup wg.Add(100) for i := 0; i < 100; i++ { go func() { defer wg.Done() creds, err := c.Get() if err != nil { t.Errorf("Expected no error, got %v", err) } if c.IsExpired() { t.Errorf("not expect expired") } if e, a := "NEW_SESSION", creds.SessionToken; e != a { t.Errorf("Expect session token to match, %v got %v", e, a) } }() } wg.Wait() }	5.93 KB	2025-05-25 12:27
📁 ec2rolecreds	-	2025-05-25 12:27
📁 endpointcreds	-	2025-05-25 12:27
📄 env_provider.go package credentials import ( "os" "github.com/aws/aws-sdk-go/aws/awserr" ) // EnvProviderName provides a name of Env provider const EnvProviderName = "EnvProvider" var ( // ErrAccessKeyIDNotFound is returned when the AWS Access Key ID can't be // found in the process's environment. ErrAccessKeyIDNotFound = awserr.New("EnvAccessKeyNotFound", "AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY not found in environment", nil) // ErrSecretAccessKeyNotFound is returned when the AWS Secret Access Key // can't be found in the process's environment. ErrSecretAccessKeyNotFound = awserr.New("EnvSecretNotFound", "AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY not found in environment", nil) ) // A EnvProvider retrieves credentials from the environment variables of the // running process. Environment credentials never expire. // // Environment variables used: // // * Access Key ID: AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY // // * Secret Access Key: AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY type EnvProvider struct { retrieved bool } // NewEnvCredentials returns a pointer to a new Credentials object // wrapping the environment variable provider. func NewEnvCredentials() Credentials { return NewCredentials(&EnvProvider{}) } // Retrieve retrieves the keys from the environment. func (e EnvProvider) Retrieve() (Value, error) { e.retrieved = false id := os.Getenv("AWS_ACCESS_KEY_ID") if id == "" { id = os.Getenv("AWS_ACCESS_KEY") } secret := os.Getenv("AWS_SECRET_ACCESS_KEY") if secret == "" { secret = os.Getenv("AWS_SECRET_KEY") } if id == "" { return Value{ProviderName: EnvProviderName}, ErrAccessKeyIDNotFound } if secret == "" { return Value{ProviderName: EnvProviderName}, ErrSecretAccessKeyNotFound } e.retrieved = true return Value{ AccessKeyID: id, SecretAccessKey: secret, SessionToken: os.Getenv("AWS_SESSION_TOKEN"), ProviderName: EnvProviderName, }, nil } // IsExpired returns if the credentials have been retrieved. func (e *EnvProvider) IsExpired() bool { return !e.retrieved }	1.99 KB	2025-05-25 12:27
📄 env_provider_test.go package credentials import ( "os" "testing" "github.com/aws/aws-sdk-go/internal/sdktesting" ) func TestEnvProviderRetrieve(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_ACCESS_KEY_ID", "access") os.Setenv("AWS_SECRET_ACCESS_KEY", "secret") os.Setenv("AWS_SESSION_TOKEN", "token") e := EnvProvider{} creds, err := e.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "access", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "token", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestEnvProviderIsExpired(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_ACCESS_KEY_ID", "access") os.Setenv("AWS_SECRET_ACCESS_KEY", "secret") os.Setenv("AWS_SESSION_TOKEN", "token") e := EnvProvider{} if !e.IsExpired() { t.Errorf("Expect creds to be expired before retrieve.") } _, err := e.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e.IsExpired() { t.Errorf("Expect creds to not be expired after retrieve.") } } func TestEnvProviderNoAccessKeyID(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_SECRET_ACCESS_KEY", "secret") e := EnvProvider{} _, err := e.Retrieve() if e, a := ErrAccessKeyIDNotFound, err; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestEnvProviderNoSecretAccessKey(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_ACCESS_KEY_ID", "access") e := EnvProvider{} _, err := e.Retrieve() if e, a := ErrSecretAccessKeyNotFound, err; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestEnvProviderAlternateNames(t *testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_ACCESS_KEY", "access") os.Setenv("AWS_SECRET_KEY", "secret") e := EnvProvider{} creds, err := e.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "access", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expected no token, %v", v) } }	2.35 KB	2025-05-25 12:27
📄 example.ini [default] aws_access_key_id = accessKey aws_secret_access_key = secret aws_session_token = token [no_token] aws_access_key_id = accessKey aws_secret_access_key = secret [with_colon] aws_access_key_id: accessKey aws_secret_access_key: secret	243 B	2025-05-25 12:27
📁 plugincreds	-	2025-05-25 12:27
📁 processcreds	-	2025-05-25 12:27
📄 shared_credentials_provider.go package credentials import ( "fmt" "os" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/internal/ini" "github.com/aws/aws-sdk-go/internal/shareddefaults" ) // SharedCredsProviderName provides a name of SharedCreds provider const SharedCredsProviderName = "SharedCredentialsProvider" var ( // ErrSharedCredentialsHomeNotFound is emitted when the user directory cannot be found. ErrSharedCredentialsHomeNotFound = awserr.New("UserHomeNotFound", "user home directory not found.", nil) ) // A SharedCredentialsProvider retrieves access key pair (access key ID, // secret access key, and session token if present) credentials from the current // user's home directory, and keeps track if those credentials are expired. // // Profile ini file example: $HOME/.aws/credentials type SharedCredentialsProvider struct { // Path to the shared credentials file. // // If empty will look for "AWS_SHARED_CREDENTIALS_FILE" env variable. If the // env value is empty will default to current user's home directory. // Linux/OSX: "$HOME/.aws/credentials" // Windows: "%USERPROFILE%\.aws\credentials" Filename string // AWS Profile to extract credentials from the shared credentials file. If empty // will default to environment variable "AWS_PROFILE" or "default" if // environment variable is also not set. Profile string // retrieved states if the credentials have been successfully retrieved. retrieved bool } // NewSharedCredentials returns a pointer to a new Credentials object // wrapping the Profile file provider. func NewSharedCredentials(filename, profile string) Credentials { return NewCredentials(&SharedCredentialsProvider{ Filename: filename, Profile: profile, }) } // Retrieve reads and extracts the shared credentials from the current // users home directory. func (p SharedCredentialsProvider) Retrieve() (Value, error) { p.retrieved = false filename, err := p.filename() if err != nil { return Value{ProviderName: SharedCredsProviderName}, err } creds, err := loadProfile(filename, p.profile()) if err != nil { return Value{ProviderName: SharedCredsProviderName}, err } p.retrieved = true return creds, nil } // IsExpired returns if the shared credentials have expired. func (p SharedCredentialsProvider) IsExpired() bool { return !p.retrieved } // loadProfiles loads from the file pointed to by shared credentials filename for profile. // The credentials retrieved from the profile will be returned or error. Error will be // returned if it fails to read from the file, or the data is invalid. func loadProfile(filename, profile string) (Value, error) { config, err := ini.OpenFile(filename) if err != nil { return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to load shared credentials file", err) } iniProfile, ok := config.GetSection(profile) if !ok { return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to get profile", nil) } id := iniProfile.String("aws_access_key_id") if len(id) == 0 { return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsAccessKey", fmt.Sprintf("shared credentials %s in %s did not contain aws_access_key_id", profile, filename), nil) } secret := iniProfile.String("aws_secret_access_key") if len(secret) == 0 { return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsSecret", fmt.Sprintf("shared credentials %s in %s did not contain aws_secret_access_key", profile, filename), nil) } // Default to empty string if not found token := iniProfile.String("aws_session_token") return Value{ AccessKeyID: id, SecretAccessKey: secret, SessionToken: token, ProviderName: SharedCredsProviderName, }, nil } // filename returns the filename to use to read AWS shared credentials. // // Will return an error if the user's home directory path cannot be found. func (p SharedCredentialsProvider) filename() (string, error) { if len(p.Filename) != 0 { return p.Filename, nil } if p.Filename = os.Getenv("AWS_SHARED_CREDENTIALS_FILE"); len(p.Filename) != 0 { return p.Filename, nil } if home := shareddefaults.UserHomeDir(); len(home) == 0 { // Backwards compatibility of home directly not found error being returned. // This error is too verbose, failure when opening the file would of been // a better error to return. return "", ErrSharedCredentialsHomeNotFound } p.Filename = shareddefaults.SharedCredentialsFilename() return p.Filename, nil } // profile returns the AWS shared credentials profile. If empty will read // environment variable "AWS_PROFILE". If that is not set profile will // return "default". func (p *SharedCredentialsProvider) profile() string { if p.Profile == "" { p.Profile = os.Getenv("AWS_PROFILE") } if p.Profile == "" { p.Profile = "default" } return p.Profile }	4.79 KB	2025-05-25 12:27
📄 shared_credentials_provider_test.go package credentials import ( "os" "path/filepath" "testing" "github.com/aws/aws-sdk-go/internal/sdktesting" "github.com/aws/aws-sdk-go/internal/shareddefaults" ) func TestSharedCredentialsProvider(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() p := SharedCredentialsProvider{Filename: "example.ini", Profile: ""} creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "accessKey", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "token", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestSharedCredentialsProviderIsExpired(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() p := SharedCredentialsProvider{Filename: "example.ini", Profile: ""} if !p.IsExpired() { t.Errorf("Expect creds to be expired before retrieve") } _, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if p.IsExpired() { t.Errorf("Expect creds to not be expired after retrieve") } } func TestSharedCredentialsProviderWithAWS_SHARED_CREDENTIALS_FILE(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_SHARED_CREDENTIALS_FILE", "example.ini") p := SharedCredentialsProvider{} creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "accessKey", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "token", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestSharedCredentialsProviderWithAWS_SHARED_CREDENTIALS_FILEAbsPath(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() wd, err := os.Getwd() if err != nil { t.Errorf("expect no error, got %v", err) } os.Setenv("AWS_SHARED_CREDENTIALS_FILE", filepath.Join(wd, "example.ini")) p := SharedCredentialsProvider{} creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "accessKey", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "token", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestSharedCredentialsProviderWithAWS_PROFILE(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_PROFILE", "no_token") p := SharedCredentialsProvider{Filename: "example.ini", Profile: ""} creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "accessKey", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expect no token, %v", v) } } func TestSharedCredentialsProviderWithoutTokenFromProfile(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() p := SharedCredentialsProvider{Filename: "example.ini", Profile: "no_token"} creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "accessKey", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expect no token, %v", v) } } func TestSharedCredentialsProviderColonInCredFile(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() p := SharedCredentialsProvider{Filename: "example.ini", Profile: "with_colon"} creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "accessKey", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expect no token, %v", v) } } func TestSharedCredentialsProvider_DefaultFilename(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("USERPROFILE", "profile_dir") os.Setenv("HOME", "home_dir") // default filename and profile p := SharedCredentialsProvider{} filename, err := p.filename() if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := shareddefaults.SharedCredentialsFilename(), filename; e != a { t.Errorf("expect %q filename, got %q", e, a) } } func BenchmarkSharedCredentialsProvider(b *testing.B) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() p := SharedCredentialsProvider{Filename: "example.ini", Profile: ""} _, err := p.Retrieve() if err != nil { b.Fatal(err) } b.ResetTimer() for i := 0; i < b.N; i++ { _, err := p.Retrieve() if err != nil { b.Fatal(err) } } }	4.97 KB	2025-05-25 12:27
📁 ssocreds	-	2025-05-25 12:27
📄 static_provider.go package credentials import ( "github.com/aws/aws-sdk-go/aws/awserr" ) // StaticProviderName provides a name of Static provider const StaticProviderName = "StaticProvider" var ( // ErrStaticCredentialsEmpty is emitted when static credentials are empty. ErrStaticCredentialsEmpty = awserr.New("EmptyStaticCreds", "static credentials are empty", nil) ) // A StaticProvider is a set of credentials which are set programmatically, // and will never expire. type StaticProvider struct { Value } // NewStaticCredentials returns a pointer to a new Credentials object // wrapping a static credentials value provider. Token is only required // for temporary security credentials retrieved via STS, otherwise an empty // string can be passed for this parameter. func NewStaticCredentials(id, secret, token string) Credentials { return NewCredentials(&StaticProvider{Value: Value{ AccessKeyID: id, SecretAccessKey: secret, SessionToken: token, }}) } // NewStaticCredentialsFromCreds returns a pointer to a new Credentials object // wrapping the static credentials value provide. Same as NewStaticCredentials // but takes the creds Value instead of individual fields func NewStaticCredentialsFromCreds(creds Value) Credentials { return NewCredentials(&StaticProvider{Value: creds}) } // Retrieve returns the credentials or error if the credentials are invalid. func (s StaticProvider) Retrieve() (Value, error) { if s.AccessKeyID == "" \|\| s.SecretAccessKey == "" { return Value{ProviderName: StaticProviderName}, ErrStaticCredentialsEmpty } if len(s.Value.ProviderName) == 0 { s.Value.ProviderName = StaticProviderName } return s.Value, nil } // IsExpired returns if the credentials are expired. // // For StaticProvider, the credentials never expired. func (s StaticProvider) IsExpired() bool { return false }	1.8 KB	2025-05-25 12:27
📄 static_provider_test.go package credentials import ( "testing" ) func TestStaticProviderGet(t testing.T) { s := StaticProvider{ Value: Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "", }, } creds, err := s.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "AKID", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SECRET", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("Expect no session token, %v", v) } } func TestStaticProviderIsExpired(t testing.T) { s := StaticProvider{ Value: Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "", }, } if s.IsExpired() { t.Errorf("Expect static credentials to never expire") } }	839 B	2025-05-25 12:27
📁 stscreds	-	2025-05-25 12:27

Edit File:

Terminal