Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 client_tls_cert_test.go //go:build go1.9 // +build go1.9 package session import ( "crypto/x509" "io" "net/http" "os" "strings" "testing" "time" "github.com/aws/aws-sdk-go/awstesting" ) func TestNewSession_WithClientTLSCert(t testing.T) { type testCase struct { // Params setup func(certFilename, keyFilename string) (Options, func(), error) ExpectErr string } cases := map[string]testCase{ "env": { setup: func(certFilename, keyFilename string) (Options, func(), error) { os.Setenv(useClientTLSCert[0], certFilename) os.Setenv(useClientTLSKey[0], keyFilename) return Options{}, func() {}, nil }, }, "env file not found": { setup: func(certFilename, keyFilename string) (Options, func(), error) { os.Setenv(useClientTLSCert[0], "some-cert-file-not-exists") os.Setenv(useClientTLSKey[0], "some-key-file-not-exists") return Options{}, func() {}, nil }, ExpectErr: "LoadClientTLSCertError", }, "env cert file only": { setup: func(certFilename, keyFilename string) (Options, func(), error) { os.Setenv(useClientTLSCert[0], certFilename) return Options{}, func() {}, nil }, ExpectErr: "must both be provided", }, "env key file only": { setup: func(certFilename, keyFilename string) (Options, func(), error) { os.Setenv(useClientTLSKey[0], keyFilename) return Options{}, func() {}, nil }, ExpectErr: "must both be provided", }, "session options": { setup: func(certFilename, keyFilename string) (Options, func(), error) { certFile, err := os.Open(certFilename) if err != nil { return Options{}, nil, err } keyFile, err := os.Open(keyFilename) if err != nil { return Options{}, nil, err } return Options{ ClientTLSCert: certFile, ClientTLSKey: keyFile, }, func() { certFile.Close() keyFile.Close() }, nil }, }, "session cert load error": { setup: func(certFilename, keyFilename string) (Options, func(), error) { certFile, err := os.Open(certFilename) if err != nil { return Options{}, nil, err } keyFile, err := os.Open(keyFilename) if err != nil { return Options{}, nil, err } stat, _ := certFile.Stat() return Options{ ClientTLSCert: io.LimitReader(certFile, stat.Size()/2), ClientTLSKey: keyFile, }, func() { certFile.Close() keyFile.Close() }, nil }, ExpectErr: "unable to load x509 key pair", }, "session key load error": { setup: func(certFilename, keyFilename string) (Options, func(), error) { certFile, err := os.Open(certFilename) if err != nil { return Options{}, nil, err } keyFile, err := os.Open(keyFilename) if err != nil { return Options{}, nil, err } stat, _ := keyFile.Stat() return Options{ ClientTLSCert: certFile, ClientTLSKey: io.LimitReader(keyFile, stat.Size()/2), }, func() { certFile.Close() keyFile.Close() }, nil }, ExpectErr: "unable to load x509 key pair", }, } for name, c := range cases { t.Run(name, func(t testing.T) { // Asserts restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() certFilename, keyFilename, err := awstesting.CreateClientTLSCertFiles() if err != nil { t.Fatalf("failed to create client certificate files, %v", err) } defer func() { if err := awstesting.CleanupTLSBundleFiles(certFilename, keyFilename); err != nil { t.Errorf("failed to cleanup client TLS cert files, %v", err) } }() opts, cleanup, err := c.setup(certFilename, keyFilename) if err != nil { t.Fatalf("test case failed setup, %v", err) } if cleanup != nil { defer cleanup() } server, err := awstesting.NewTLSClientCertServer(http.HandlerFunc( func(w http.ResponseWriter, r http.Request) { w.WriteHeader(200) })) if err != nil { t.Fatalf("failed to load session, %v", err) } server.StartTLS() defer server.Close() // Give server change to start time.Sleep(time.Second) // Load SDK session with options configured. sess, err := NewSessionWithOptions(opts) if len(c.ExpectErr) != 0 { if err == nil { t.Fatalf("expect error, got none") } if e, a := c.ExpectErr, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect error to contain %v, got %v", e, a) } return } if err != nil { t.Fatalf("expect no error, got %v", err) } // Clients need to add ca bundle for test service. p := x509.NewCertPool() p.AddCert(server.Certificate()) client := sess.Config.HTTPClient client.Transport.(http.Transport).TLSClientConfig.RootCAs = p // Send request req, _ := http.NewRequest("GET", server.URL, nil) resp, err := client.Do(req) if err != nil { t.Fatalf("failed to send request, %v", err) } if e, a := 200, resp.StatusCode; e != a { t.Errorf("expect %v status code, got %v", e, a) } }) } }	4.85 KB	2025-05-25 12:27
📄 credentials.go package session import ( "fmt" "os" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/credentials/processcreds" "github.com/aws/aws-sdk-go/aws/credentials/ssocreds" "github.com/aws/aws-sdk-go/aws/credentials/stscreds" "github.com/aws/aws-sdk-go/aws/defaults" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/internal/shareddefaults" "github.com/aws/aws-sdk-go/service/ssooidc" "github.com/aws/aws-sdk-go/service/sts" ) // CredentialsProviderOptions specifies additional options for configuring // credentials providers. type CredentialsProviderOptions struct { // WebIdentityRoleProviderOptions configures a WebIdentityRoleProvider, // such as setting its ExpiryWindow. WebIdentityRoleProviderOptions func(stscreds.WebIdentityRoleProvider) // ProcessProviderOptions configures a ProcessProvider, // such as setting its Timeout. ProcessProviderOptions func(processcreds.ProcessProvider) } func resolveCredentials(cfg aws.Config, envCfg envConfig, sharedCfg sharedConfig, handlers request.Handlers, sessOpts Options, ) (credentials.Credentials, error) { switch { case len(sessOpts.Profile) != 0: // User explicitly provided a Profile in the session's configuration // so load that profile from shared config first. // Github(aws/aws-sdk-go#2727) return resolveCredsFromProfile(cfg, envCfg, sharedCfg, handlers, sessOpts) case envCfg.Creds.HasKeys(): // Environment credentials return credentials.NewStaticCredentialsFromCreds(envCfg.Creds), nil case len(envCfg.WebIdentityTokenFilePath) != 0: // Web identity token from environment, RoleARN required to also be // set. return assumeWebIdentity(cfg, handlers, envCfg.WebIdentityTokenFilePath, envCfg.RoleARN, envCfg.RoleSessionName, sessOpts.CredentialsProviderOptions, ) default: // Fallback to the "default" credential resolution chain. return resolveCredsFromProfile(cfg, envCfg, sharedCfg, handlers, sessOpts) } } // WebIdentityEmptyRoleARNErr will occur if 'AWS_WEB_IDENTITY_TOKEN_FILE' was set but // 'AWS_ROLE_ARN' was not set. var WebIdentityEmptyRoleARNErr = awserr.New(stscreds.ErrCodeWebIdentity, "role ARN is not set", nil) // WebIdentityEmptyTokenFilePathErr will occur if 'AWS_ROLE_ARN' was set but // 'AWS_WEB_IDENTITY_TOKEN_FILE' was not set. var WebIdentityEmptyTokenFilePathErr = awserr.New(stscreds.ErrCodeWebIdentity, "token file path is not set", nil) func assumeWebIdentity(cfg aws.Config, handlers request.Handlers, filepath string, roleARN, sessionName string, credOptions CredentialsProviderOptions, ) (credentials.Credentials, error) { if len(filepath) == 0 { return nil, WebIdentityEmptyTokenFilePathErr } if len(roleARN) == 0 { return nil, WebIdentityEmptyRoleARNErr } svc := sts.New(&Session{ Config: cfg, Handlers: handlers.Copy(), }) var optFns []func(stscreds.WebIdentityRoleProvider) if credOptions != nil && credOptions.WebIdentityRoleProviderOptions != nil { optFns = append(optFns, credOptions.WebIdentityRoleProviderOptions) } p := stscreds.NewWebIdentityRoleProviderWithOptions(svc, roleARN, sessionName, stscreds.FetchTokenPath(filepath), optFns...) return credentials.NewCredentials(p), nil } func resolveCredsFromProfile(cfg aws.Config, envCfg envConfig, sharedCfg sharedConfig, handlers request.Handlers, sessOpts Options, ) (creds credentials.Credentials, err error) { switch { case sharedCfg.SourceProfile != nil: // Assume IAM role with credentials source from a different profile. creds, err = resolveCredsFromProfile(cfg, envCfg, sharedCfg.SourceProfile, handlers, sessOpts, ) case sharedCfg.Creds.HasKeys(): // Static Credentials from Shared Config/Credentials file. creds = credentials.NewStaticCredentialsFromCreds( sharedCfg.Creds, ) case len(sharedCfg.CredentialSource) != 0: creds, err = resolveCredsFromSource(cfg, envCfg, sharedCfg, handlers, sessOpts, ) case len(sharedCfg.WebIdentityTokenFile) != 0: // Credentials from Assume Web Identity token require an IAM Role, and // that roll will be assumed. May be wrapped with another assume role // via SourceProfile. return assumeWebIdentity(cfg, handlers, sharedCfg.WebIdentityTokenFile, sharedCfg.RoleARN, sharedCfg.RoleSessionName, sessOpts.CredentialsProviderOptions, ) case sharedCfg.hasSSOConfiguration(): creds, err = resolveSSOCredentials(cfg, sharedCfg, handlers) case len(sharedCfg.CredentialProcess) != 0: // Get credentials from CredentialProcess var optFns []func(processcreds.ProcessProvider) if sessOpts.CredentialsProviderOptions != nil && sessOpts.CredentialsProviderOptions.ProcessProviderOptions != nil { optFns = append(optFns, sessOpts.CredentialsProviderOptions.ProcessProviderOptions) } creds = processcreds.NewCredentials(sharedCfg.CredentialProcess, optFns...) default: // Fallback to default credentials provider, include mock errors for // the credential chain so user can identify why credentials failed to // be retrieved. creds = credentials.NewCredentials(&credentials.ChainProvider{ VerboseErrors: aws.BoolValue(cfg.CredentialsChainVerboseErrors), Providers: []credentials.Provider{ &credProviderError{ Err: awserr.New("EnvAccessKeyNotFound", "failed to find credentials in the environment.", nil), }, &credProviderError{ Err: awserr.New("SharedCredsLoad", fmt.Sprintf("failed to load profile, %s.", envCfg.Profile), nil), }, defaults.RemoteCredProvider(cfg, handlers), }, }) } if err != nil { return nil, err } if len(sharedCfg.RoleARN) > 0 { cfgCp := cfg cfgCp.Credentials = creds return credsFromAssumeRole(cfgCp, handlers, sharedCfg, sessOpts) } return creds, nil } func resolveSSOCredentials(cfg aws.Config, sharedCfg sharedConfig, handlers request.Handlers) (credentials.Credentials, error) { if err := sharedCfg.validateSSOConfiguration(); err != nil { return nil, err } var optFns []func(provider ssocreds.Provider) cfgCopy := cfg.Copy() if sharedCfg.SSOSession != nil { cfgCopy.Region = &sharedCfg.SSOSession.SSORegion cachedPath, err := ssocreds.StandardCachedTokenFilepath(sharedCfg.SSOSession.Name) if err != nil { return nil, err } // create oidcClient with AnonymousCredentials to avoid recursively resolving credentials mySession := Must(NewSession(&aws.Config{ Credentials: credentials.AnonymousCredentials, })) oidcClient := ssooidc.New(mySession, cfgCopy) tokenProvider := ssocreds.NewSSOTokenProvider(oidcClient, cachedPath) optFns = append(optFns, func(p ssocreds.Provider) { p.TokenProvider = tokenProvider p.CachedTokenFilepath = cachedPath }) } else { cfgCopy.Region = &sharedCfg.SSORegion } return ssocreds.NewCredentials( &Session{ Config: cfgCopy, Handlers: handlers.Copy(), }, sharedCfg.SSOAccountID, sharedCfg.SSORoleName, sharedCfg.SSOStartURL, optFns..., ), nil } // valid credential source values const ( credSourceEc2Metadata = "Ec2InstanceMetadata" credSourceEnvironment = "Environment" credSourceECSContainer = "EcsContainer" ) func resolveCredsFromSource(cfg aws.Config, envCfg envConfig, sharedCfg sharedConfig, handlers request.Handlers, sessOpts Options, ) (creds credentials.Credentials, err error) { switch sharedCfg.CredentialSource { case credSourceEc2Metadata: p := defaults.RemoteCredProvider(cfg, handlers) creds = credentials.NewCredentials(p) case credSourceEnvironment: creds = credentials.NewStaticCredentialsFromCreds(envCfg.Creds) case credSourceECSContainer: if len(os.Getenv(shareddefaults.ECSCredsProviderEnvVar)) == 0 { return nil, ErrSharedConfigECSContainerEnvVarEmpty } p := defaults.RemoteCredProvider(cfg, handlers) creds = credentials.NewCredentials(p) default: return nil, ErrSharedConfigInvalidCredSource } return creds, nil } func credsFromAssumeRole(cfg aws.Config, handlers request.Handlers, sharedCfg sharedConfig, sessOpts Options, ) (credentials.Credentials, error) { if len(sharedCfg.MFASerial) != 0 && sessOpts.AssumeRoleTokenProvider == nil { // AssumeRole Token provider is required if doing Assume Role // with MFA. return nil, AssumeRoleTokenProviderNotSetError{} } return stscreds.NewCredentials( &Session{ Config: &cfg, Handlers: handlers.Copy(), }, sharedCfg.RoleARN, func(opt stscreds.AssumeRoleProvider) { opt.RoleSessionName = sharedCfg.RoleSessionName if sessOpts.AssumeRoleDuration == 0 && sharedCfg.AssumeRoleDuration != nil && sharedCfg.AssumeRoleDuration/time.Minute > 15 { opt.Duration = sharedCfg.AssumeRoleDuration } else if sessOpts.AssumeRoleDuration != 0 { opt.Duration = sessOpts.AssumeRoleDuration } // Assume role with external ID if len(sharedCfg.ExternalID) > 0 { opt.ExternalID = aws.String(sharedCfg.ExternalID) } // Assume role with MFA if len(sharedCfg.MFASerial) > 0 { opt.SerialNumber = aws.String(sharedCfg.MFASerial) opt.TokenProvider = sessOpts.AssumeRoleTokenProvider } }, ), nil } // AssumeRoleTokenProviderNotSetError is an error returned when creating a // session when the MFAToken option is not set when shared config is configured // load assume a role with an MFA token. type AssumeRoleTokenProviderNotSetError struct{} // Code is the short id of the error. func (e AssumeRoleTokenProviderNotSetError) Code() string { return "AssumeRoleTokenProviderNotSetError" } // Message is the description of the error func (e AssumeRoleTokenProviderNotSetError) Message() string { return fmt.Sprintf("assume role with MFA enabled, but AssumeRoleTokenProvider session option not set.") } // OrigErr is the underlying error that caused the failure. func (e AssumeRoleTokenProviderNotSetError) OrigErr() error { return nil } // Error satisfies the error interface. func (e AssumeRoleTokenProviderNotSetError) Error() string { return awserr.SprintError(e.Code(), e.Message(), "", nil) } type credProviderError struct { Err error } func (c credProviderError) Retrieve() (credentials.Value, error) { return credentials.Value{}, c.Err } func (c credProviderError) IsExpired() bool { return true }	10.07 KB	2025-05-25 12:27
📄 credentials_test.go //go:build go1.7 // +build go1.7 package session import ( "fmt" "io/ioutil" "net/http" "net/http/httptest" "os" "path/filepath" "reflect" "runtime" "strconv" "strings" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/credentials/stscreds" "github.com/aws/aws-sdk-go/aws/defaults" "github.com/aws/aws-sdk-go/aws/endpoints" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/internal/sdktesting" "github.com/aws/aws-sdk-go/internal/shareddefaults" "github.com/aws/aws-sdk-go/private/protocol" "github.com/aws/aws-sdk-go/service/sts" ) func newEc2MetadataServer(key, secret string, closeAfterGetCreds bool) httptest.Server { var server httptest.Server server = httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, r http.Request) { if r.URL.Path == "/latest/meta-data/iam/security-credentials/RoleName" { w.Write([]byte(fmt.Sprintf(ec2MetadataResponse, key, secret))) if closeAfterGetCreds { go server.Close() } } else if r.URL.Path == "/latest/meta-data/iam/security-credentials/" { w.Write([]byte("RoleName")) } else { w.Write([]byte("")) } })) return server } func setupCredentialsEndpoints(t testing.T) (endpoints.Resolver, func()) { origECSEndpoint := shareddefaults.ECSContainerCredentialsURI ecsMetadataServer := httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, r http.Request) { if r.URL.Path == "/ECS" { w.Write([]byte(ecsResponse)) } else { w.Write([]byte("")) } })) shareddefaults.ECSContainerCredentialsURI = ecsMetadataServer.URL ec2MetadataServer := newEc2MetadataServer("ec2_key", "ec2_secret", false) stsServer := httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, r http.Request) { if err := r.ParseForm(); err != nil { w.WriteHeader(500) return } form := r.Form switch form.Get("Action") { case "AssumeRole": w.Write([]byte(fmt.Sprintf( assumeRoleRespMsg, time.Now(). Add(15time.Minute). Format(protocol.ISO8601TimeFormat)))) return case "AssumeRoleWithWebIdentity": w.Write([]byte(fmt.Sprintf(assumeRoleWithWebIdentityResponse, time.Now(). Add(15time.Minute). Format(protocol.ISO8601TimeFormat)))) return default: w.WriteHeader(404) return } })) ssoServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Write([]byte(fmt.Sprintf( getRoleCredentialsResponse, time.Now(). Add(15time.Minute). UnixNano()/int64(time.Millisecond)))) })) resolver := endpoints.ResolverFunc( func(service, region string, opts ...func(endpoints.Options)) (endpoints.ResolvedEndpoint, error) { switch service { case "ec2metadata": return endpoints.ResolvedEndpoint{ URL: ec2MetadataServer.URL, }, nil case "sts": return endpoints.ResolvedEndpoint{ URL: stsServer.URL, }, nil case "portal.sso": return endpoints.ResolvedEndpoint{ URL: ssoServer.URL, }, nil default: return endpoints.ResolvedEndpoint{}, fmt.Errorf("unknown service endpoint, %s", service) } }) return resolver, func() { shareddefaults.ECSContainerCredentialsURI = origECSEndpoint ecsMetadataServer.Close() ec2MetadataServer.Close() ssoServer.Close() stsServer.Close() } } func TestSharedConfigCredentialSource(t testing.T) { const configFileForWindows = "testdata/credential_source_config_for_windows" const configFile = "testdata/credential_source_config" cases := []struct { name string profile string sessOptProfile string sessOptEC2IMDSEndpoint string expectedError error expectedAccessKey string expectedSecretKey string expectedSessionToken string expectedChain []string init func() (func(), error) dependentOnOS bool }{ { name: "credential source and source profile", profile: "invalid_source_and_credential_source", expectedError: ErrSharedConfigSourceCollision, init: func() (func(), error) { os.Setenv("AWS_ACCESS_KEY", "access_key") os.Setenv("AWS_SECRET_KEY", "secret_key") return func() {}, nil }, }, { name: "env var credential source", sessOptProfile: "env_var_credential_source", expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", expectedChain: []string{ "assume_role_w_creds_role_arn_env", }, init: func() (func(), error) { os.Setenv("AWS_ACCESS_KEY", "access_key") os.Setenv("AWS_SECRET_KEY", "secret_key") return func() {}, nil }, }, { name: "ec2metadata credential source", profile: "ec2metadata", expectedChain: []string{ "assume_role_w_creds_role_arn_ec2", }, expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", }, { name: "ec2metadata custom EC2 IMDS endpoint, env var", profile: "not-exists-profile", expectedAccessKey: "ec2_custom_key", expectedSecretKey: "ec2_custom_secret", expectedSessionToken: "token", init: func() (func(), error) { altServer := newEc2MetadataServer("ec2_custom_key", "ec2_custom_secret", true) os.Setenv("AWS_EC2_METADATA_SERVICE_ENDPOINT", altServer.URL) return func() {}, nil }, }, { name: "ecs container credential source", profile: "ecscontainer", expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", expectedChain: []string{ "assume_role_w_creds_role_arn_ecs", }, init: func() (func(), error) { os.Setenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "/ECS") return func() {}, nil }, }, { name: "chained assume role with env creds", profile: "chained_assume_role", expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", expectedChain: []string{ "assume_role_w_creds_role_arn_chain", "assume_role_w_creds_role_arn_ec2", }, }, { name: "credential process with no ARN set", profile: "cred_proc_no_arn_set", dependentOnOS: true, expectedAccessKey: "cred_proc_akid", expectedSecretKey: "cred_proc_secret", }, { name: "credential process with ARN set", profile: "cred_proc_arn_set", dependentOnOS: true, expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", expectedChain: []string{ "assume_role_w_creds_proc_role_arn", }, }, { name: "chained assume role with credential process", profile: "chained_cred_proc", dependentOnOS: true, expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", expectedChain: []string{ "assume_role_w_creds_proc_source_prof", }, }, { name: "sso credentials", profile: "sso_creds", expectedAccessKey: "SSO_AKID", expectedSecretKey: "SSO_SECRET_KEY", expectedSessionToken: "SSO_SESSION_TOKEN", init: func() (func(), error) { return ssoTestSetup() }, }, { name: "chained assume role with sso credentials", profile: "source_sso_creds", expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", expectedChain: []string{ "source_sso_creds_arn", }, init: func() (func(), error) { return ssoTestSetup() }, }, { name: "chained assume role with sso and static credentials", profile: "assume_sso_and_static", expectedAccessKey: "AKID", expectedSecretKey: "SECRET", expectedSessionToken: "SESSION_TOKEN", expectedChain: []string{ "assume_sso_and_static_arn", }, }, { name: "invalid sso configuration", profile: "sso_invalid", expectedError: fmt.Errorf("profile \"sso_invalid\" is configured to use SSO but is missing required configuration: sso_region, sso_start_url"), }, { name: "environment credentials with invalid sso", profile: "sso_invalid", expectedAccessKey: "access_key", expectedSecretKey: "secret_key", init: func() (func(), error) { os.Setenv("AWS_ACCESS_KEY", "access_key") os.Setenv("AWS_SECRET_KEY", "secret_key") return func() {}, nil }, }, { name: "sso mixed with credential process provider", profile: "sso_mixed_credproc", expectedAccessKey: "SSO_AKID", expectedSecretKey: "SSO_SECRET_KEY", expectedSessionToken: "SSO_SESSION_TOKEN", init: func() (func(), error) { return ssoTestSetup() }, }, { name: "sso mixed with web identity token provider", profile: "sso_mixed_webident", expectedAccessKey: "WEB_IDENTITY_AKID", expectedSecretKey: "WEB_IDENTITY_SECRET", expectedSessionToken: "WEB_IDENTITY_SESSION_TOKEN", }, } for i, c := range cases { t.Run(strconv.Itoa(i)+"_"+c.name, func(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() if c.dependentOnOS && runtime.GOOS == "windows" { os.Setenv("AWS_CONFIG_FILE", configFileForWindows) } else { os.Setenv("AWS_CONFIG_FILE", configFile) } os.Setenv("AWS_REGION", "us-east-1") os.Setenv("AWS_SDK_LOAD_CONFIG", "1") if len(c.profile) != 0 { os.Setenv("AWS_PROFILE", c.profile) } endpointResolver, cleanupFn := setupCredentialsEndpoints(t) defer cleanupFn() if c.init != nil { cleanup, err := c.init() if err != nil { t.Fatalf("expect no error, got %v", err) } defer cleanup() } var credChain []string handlers := defaults.Handlers() handlers.Sign.PushBack(func(r request.Request) { if r.Config.Credentials == credentials.AnonymousCredentials { return } params := r.Params.(sts.AssumeRoleInput) credChain = append(credChain, params.RoleArn) }) sess, err := NewSessionWithOptions(Options{ Profile: c.sessOptProfile, Config: aws.Config{ Logger: t, EndpointResolver: endpointResolver, }, Handlers: handlers, EC2IMDSEndpoint: c.sessOptEC2IMDSEndpoint, }) if c.expectedError != nil { var errStr string if err != nil { errStr = err.Error() } if e, a := c.expectedError.Error(), errStr; !strings.Contains(a, e) { t.Fatalf("expected %v, but received %v", e, a) } } if c.expectedError != nil { return } creds, err := sess.Config.Credentials.Get() if err != nil { t.Fatalf("expected no error, but received %v", err) } if e, a := c.expectedChain, credChain; !reflect.DeepEqual(e, a) { t.Errorf("expected %v, but received %v", e, a) } if e, a := c.expectedAccessKey, creds.AccessKeyID; e != a { t.Errorf("expected %v, but received %v", e, a) } if e, a := c.expectedSecretKey, creds.SecretAccessKey; e != a { t.Errorf("expected %v, but received %v", e, a) } if e, a := c.expectedSessionToken, creds.SessionToken; e != a { t.Errorf("expected %v, but received %v", e, a) } }) } } const ecsResponse = `{ "Code": "Success", "Type": "AWS-HMAC", "AccessKeyId" : "ecs-access-key", "SecretAccessKey" : "ecs-secret-key", "Token" : "token", "Expiration" : "2100-01-01T00:00:00Z", "LastUpdated" : "2009-11-23T00:00:00Z" }` const ec2MetadataResponse = `{ "Code": "Success", "Type": "AWS-HMAC", "AccessKeyId" : "%s", "SecretAccessKey" : "%s", "Token" : "token", "Expiration" : "2100-01-01T00:00:00Z", "LastUpdated" : "2009-11-23T00:00:00Z" }` const assumeRoleRespMsg = ` <AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/"> <AssumeRoleResult> <AssumedRoleUser> <Arn>arn:aws:sts::account_id:assumed-role/role/session_name</Arn> <AssumedRoleId>AKID:session_name</AssumedRoleId> </AssumedRoleUser> <Credentials> <AccessKeyId>AKID</AccessKeyId> <SecretAccessKey>SECRET</SecretAccessKey> <SessionToken>SESSION_TOKEN</SessionToken> <Expiration>%s</Expiration> </Credentials> </AssumeRoleResult> <ResponseMetadata> <RequestId>request-id</RequestId> </ResponseMetadata> </AssumeRoleResponse> ` var assumeRoleWithWebIdentityResponse = `<AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/"> <AssumeRoleWithWebIdentityResult> <SubjectFromWebIdentityToken>amzn1.account.AF6RHO7KZU5XRVQJGXK6HB56KR2A</SubjectFromWebIdentityToken> <Audience>client.5498841531868486423.1548@apps.example.com</Audience> <AssumedRoleUser> <Arn>arn:aws:sts::123456789012:assumed-role/FederatedWebIdentityRole/app1</Arn> <AssumedRoleId>AROACLKWSDQRAOEXAMPLE:app1</AssumedRoleId> </AssumedRoleUser> <Credentials> <AccessKeyId>WEB_IDENTITY_AKID</AccessKeyId> <SecretAccessKey>WEB_IDENTITY_SECRET</SecretAccessKey> <SessionToken>WEB_IDENTITY_SESSION_TOKEN</SessionToken> <Expiration>%s</Expiration> </Credentials> <Provider>www.amazon.com</Provider> </AssumeRoleWithWebIdentityResult> <ResponseMetadata> <RequestId>request-id</RequestId> </ResponseMetadata> </AssumeRoleWithWebIdentityResponse> ` const getRoleCredentialsResponse = `{ "roleCredentials": { "accessKeyId": "SSO_AKID", "secretAccessKey": "SSO_SECRET_KEY", "sessionToken": "SSO_SESSION_TOKEN", "expiration": %d } }` const ssoTokenCacheFile = `{ "accessToken": "ssoAccessToken", "expiresAt": "%s" }` func TestSessionAssumeRole(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_REGION", "us-east-1") os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_w_creds") server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Write([]byte(fmt.Sprintf( assumeRoleRespMsg, time.Now().Add(15time.Minute).Format("2006-01-02T15:04:05Z")))) })) defer server.Close() s, err := NewSession(&aws.Config{ Endpoint: aws.String(server.URL), DisableSSL: aws.Bool(true), }) if err != nil { t.Fatalf("expect no error, got %v", err) } creds, err := s.Config.Credentials.Get() if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := "AKID", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SECRET", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SESSION_TOKEN", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "AssumeRoleProvider", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestSessionAssumeRole_WithMFA(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_REGION", "us-east-1") os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_w_creds") server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if e, a := r.FormValue("SerialNumber"), "0123456789"; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := r.FormValue("TokenCode"), "tokencode"; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "900", r.FormValue("DurationSeconds"); e != a { t.Errorf("expect %v, got %v", e, a) } w.Write([]byte(fmt.Sprintf( assumeRoleRespMsg, time.Now().Add(15time.Minute).Format("2006-01-02T15:04:05Z")))) })) defer server.Close() customProviderCalled := false sess, err := NewSessionWithOptions(Options{ Profile: "assume_role_w_mfa", Config: aws.Config{ Region: aws.String("us-east-1"), Endpoint: aws.String(server.URL), DisableSSL: aws.Bool(true), }, SharedConfigState: SharedConfigEnable, AssumeRoleTokenProvider: func() (string, error) { customProviderCalled = true return "tokencode", nil }, }) if err != nil { t.Fatalf("expect no error, got %v", err) } creds, err := sess.Config.Credentials.Get() if err != nil { t.Fatalf("expect no error, got %v", err) } if !customProviderCalled { t.Errorf("expect true") } if e, a := "AKID", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SECRET", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SESSION_TOKEN", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "AssumeRoleProvider", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestSessionAssumeRole_WithMFA_NoTokenProvider(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_REGION", "us-east-1") os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_w_creds") _, err := NewSessionWithOptions(Options{ Profile: "assume_role_w_mfa", SharedConfigState: SharedConfigEnable, }) if e, a := (AssumeRoleTokenProviderNotSetError{}), err; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestSessionAssumeRole_DisableSharedConfig(t testing.T) { // Backwards compatibility with Shared config disabled // assume role should not be built into the config. restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_SDK_LOAD_CONFIG", "0") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_w_creds") s, err := NewSession(&aws.Config{ CredentialsChainVerboseErrors: aws.Bool(true), }) if err != nil { t.Fatalf("expect no error, got %v", err) } creds, err := s.Config.Credentials.Get() if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := "assume_role_w_creds_akid", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assume_role_w_creds_secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SharedConfigCredentials", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestSessionAssumeRole_InvalidSourceProfile(t testing.T) { // Backwards compatibility with Shared config disabled // assume role should not be built into the config. restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_invalid_source_profile") s, err := NewSession() if err == nil { t.Fatalf("expect error, got none") } expectMsg := "SharedConfigAssumeRoleError: failed to load assume role" if e, a := expectMsg, err.Error(); !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } if s != nil { t.Errorf("expect nil, %v", err) } } func TestSessionAssumeRole_ExtendedDuration(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() cases := []struct { profile string optionDuration time.Duration expectedDuration string }{ { profile: "assume_role_w_creds", expectedDuration: "900", }, { profile: "assume_role_w_creds", optionDuration: 30 * time.Minute, expectedDuration: "1800", }, { profile: "assume_role_w_creds_w_duration", expectedDuration: "1800", }, { profile: "assume_role_w_creds_w_invalid_duration", expectedDuration: "900", }, } for _, tt := range cases { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if e, a := tt.expectedDuration, r.FormValue("DurationSeconds"); e != a { t.Errorf("expect %v, got %v", e, a) } w.Write([]byte(fmt.Sprintf( assumeRoleRespMsg, time.Now().Add(15time.Minute).Format("2006-01-02T15:04:05Z")))) })) os.Setenv("AWS_REGION", "us-east-1") os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_w_creds") opts := Options{ Profile: tt.profile, Config: aws.Config{ Endpoint: aws.String(server.URL), DisableSSL: aws.Bool(true), }, SharedConfigState: SharedConfigEnable, } if tt.optionDuration != 0 { opts.AssumeRoleDuration = tt.optionDuration } s, err := NewSessionWithOptions(opts) if err != nil { server.Close() t.Fatalf("expect no error, got %v", err) } creds, err := s.Config.Credentials.Get() if err != nil { server.Close() t.Fatalf("expect no error, got %v", err) } if e, a := "AKID", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SECRET", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SESSION_TOKEN", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "AssumeRoleProvider", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } server.Close() } } func TestSessionAssumeRole_WithMFA_ExtendedDuration(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_REGION", "us-east-1") os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_w_creds") server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if e, a := "0123456789", r.FormValue("SerialNumber"); e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "tokencode", r.FormValue("TokenCode"); e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "1800", r.FormValue("DurationSeconds"); e != a { t.Errorf("expect %v, got %v", e, a) } w.Write([]byte(fmt.Sprintf( assumeRoleRespMsg, time.Now().Add(30time.Minute).Format("2006-01-02T15:04:05Z")))) })) defer server.Close() customProviderCalled := false sess, err := NewSessionWithOptions(Options{ Profile: "assume_role_w_mfa", Config: aws.Config{ Region: aws.String("us-east-1"), Endpoint: aws.String(server.URL), DisableSSL: aws.Bool(true), }, SharedConfigState: SharedConfigEnable, AssumeRoleDuration: 30 time.Minute, AssumeRoleTokenProvider: func() (string, error) { customProviderCalled = true return "tokencode", nil }, }) if err != nil { t.Fatalf("expect no error, got %v", err) } creds, err := sess.Config.Credentials.Get() if err != nil { t.Fatalf("expect no error, got %v", err) } if !customProviderCalled { t.Errorf("expect true") } if e, a := "AKID", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SECRET", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "SESSION_TOKEN", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "AssumeRoleProvider", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestSessionAssumeRoleWithWebIdentity_Options(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_REGION", "us-east-1") os.Setenv("AWS_ROLE_ARN", "web_identity_role_arn") os.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", "./testdata/wit.txt") endpointResolver, teardown := setupCredentialsEndpoints(t) defer teardown() optionsCalled := false sess, err := NewSessionWithOptions(Options{ Config: aws.Config{ EndpointResolver: endpointResolver, }, CredentialsProviderOptions: &CredentialsProviderOptions{ WebIdentityRoleProviderOptions: func(stscreds.WebIdentityRoleProvider) { optionsCalled = true }, }, }) if err != nil { t.Fatalf("expect no error, got %v", err) } if !optionsCalled { t.Errorf("expect options func to be called") } creds, err := sess.Config.Credentials.Get() if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := "WEB_IDENTITY_AKID", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "WEB_IDENTITY_SECRET", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "WEB_IDENTITY_SESSION_TOKEN", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := stscreds.WebIdentityProviderName, creds.ProviderName; e != a { t.Errorf("expect %v,got %v", e, a) } } func ssoTestSetup() (func(), error) { dir, err := ioutil.TempDir("", "sso-test") if err != nil { return nil, err } cacheDir := filepath.Join(dir, ".aws", "sso", "cache") err = os.MkdirAll(cacheDir, 0750) if err != nil { os.RemoveAll(dir) return nil, err } tokenFile, err := os.Create(filepath.Join(cacheDir, "eb5e43e71ce87dd92ec58903d76debd8ee42aefd.json")) if err != nil { os.RemoveAll(dir) return nil, err } defer tokenFile.Close() _, err = tokenFile.WriteString(fmt.Sprintf(ssoTokenCacheFile, time.Now(). Add(15*time.Minute). Format(time.RFC3339))) if err != nil { os.RemoveAll(dir) return nil, err } if runtime.GOOS == "windows" { os.Setenv("USERPROFILE", dir) } else { os.Setenv("HOME", dir) } return func() { os.RemoveAll(dir) }, nil }	25.01 KB	2025-05-25 12:27
📄 csm_test.go //go:build go1.7 // +build go1.7 package session import ( "os" "path/filepath" "strings" "testing" "github.com/aws/aws-sdk-go/internal/sdktesting" ) func TestSession_loadCSMConfig(t testing.T) { defConfigFiles := []string{ filepath.Join("testdata", "csm_shared_config"), } cases := map[string]struct { Envs map[string]string ConfigFiles []string CSMProfile string Expect csmConfig Err string }{ "no config": { Envs: map[string]string{}, Expect: csmConfig{}, ConfigFiles: defConfigFiles, CSMProfile: "aws_csm_empty", }, "env enabled": { Envs: map[string]string{ "AWS_CSM_ENABLED": "true", "AWS_CSM_PORT": "4321", "AWS_CSM_HOST": "ahost", "AWS_CSM_CLIENT_ID": "client id", }, Expect: csmConfig{ Enabled: true, Port: "4321", Host: "ahost", ClientID: "client id", }, }, "shared cfg enabled": { ConfigFiles: defConfigFiles, Expect: csmConfig{ Enabled: true, Port: "1234", Host: "bar", ClientID: "foo", }, }, "mixed cfg, use env": { Envs: map[string]string{ "AWS_CSM_ENABLED": "true", }, ConfigFiles: defConfigFiles, Expect: csmConfig{ Enabled: true, }, }, "mixed cfg, use env disabled": { Envs: map[string]string{ "AWS_CSM_ENABLED": "false", }, ConfigFiles: defConfigFiles, Expect: csmConfig{ Enabled: false, }, }, "mixed cfg, use shared config": { Envs: map[string]string{ "AWS_CSM_PORT": "4321", }, ConfigFiles: defConfigFiles, Expect: csmConfig{ Enabled: true, Port: "1234", Host: "bar", ClientID: "foo", }, }, } for name, c := range cases { t.Run(name, func(t testing.T) { restoreFn := sdktesting.StashEnv() defer restoreFn() if len(c.CSMProfile) != 0 { csmProfile := csmProfileName defer func() { csmProfileName = csmProfile }() csmProfileName = c.CSMProfile } for name, v := range c.Envs { os.Setenv(name, v) } envCfg, err := loadEnvConfig() if err != nil { t.Fatalf("failed to load the envcfg, %v", err) } csmCfg, err := loadCSMConfig(envCfg, c.ConfigFiles) if len(c.Err) != 0 { if err == nil { t.Fatalf("expect error, got none") } if e, a := c.Err, err.Error(); !strings.Contains(a, e) { t.Errorf("expect %v in error %v", e, a) } return } if e, a := c.Expect, csmCfg; e != a { t.Errorf("expect %v CSM config got %v", e, a) } }) } }	2.47 KB	2025-05-25 12:27
📄 custom_ca_bundle_test.go package session import ( "bytes" "fmt" "net" "net/http" "os" "strings" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/awstesting" ) var TLSBundleCertFile string var TLSBundleKeyFile string var TLSBundleCAFile string func TestMain(m testing.M) { var err error TLSBundleCertFile, TLSBundleKeyFile, TLSBundleCAFile, err = awstesting.CreateTLSBundleFiles() if err != nil { panic(err) } fmt.Println("TestMain", TLSBundleCertFile, TLSBundleKeyFile) code := m.Run() err = awstesting.CleanupTLSBundleFiles(TLSBundleCertFile, TLSBundleKeyFile, TLSBundleCAFile) if err != nil { panic(err) } os.Exit(code) } func TestNewSession_WithCustomCABundle_Env(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() endpoint, err := awstesting.CreateTLSServer(TLSBundleCertFile, TLSBundleKeyFile, nil) if err != nil { t.Fatalf("expect no error, got %v", err) } os.Setenv("AWS_CA_BUNDLE", TLSBundleCAFile) s, err := NewSession(&aws.Config{ HTTPClient: &http.Client{}, Endpoint: aws.String(endpoint), Region: aws.String("mock-region"), Credentials: credentials.AnonymousCredentials, }) if err != nil { t.Fatalf("expect no error, got %v", err) } if s == nil { t.Fatalf("expect session to be created, got none") } req, _ := http.NewRequest("GET", s.Config.Endpoint, nil) resp, err := s.Config.HTTPClient.Do(req) if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := http.StatusOK, resp.StatusCode; e != a { t.Errorf("expect %d status code, got %d", e, a) } } func TestNewSession_WithCustomCABundle_EnvNotExists(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_CA_BUNDLE", "file-not-exists") s, err := NewSession() if err == nil { t.Fatalf("expect error, got none") } if e, a := "LoadCustomCABundleError", err.(awserr.Error).Code(); e != a { t.Errorf("expect %s error code, got %s", e, a) } if s != nil { t.Errorf("expect nil session, got %v", s) } } func TestNewSession_WithCustomCABundle_Option(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() endpoint, err := awstesting.CreateTLSServer(TLSBundleCertFile, TLSBundleKeyFile, nil) if err != nil { t.Fatalf("expect no error, got %v", err) } s, err := NewSessionWithOptions(Options{ Config: aws.Config{ HTTPClient: &http.Client{}, Endpoint: aws.String(endpoint), Region: aws.String("mock-region"), Credentials: credentials.AnonymousCredentials, }, CustomCABundle: bytes.NewReader(awstesting.TLSBundleCA), }) if err != nil { t.Fatalf("expect no error, got %v", err) } if s == nil { t.Fatalf("expect session to be created, got none") } req, _ := http.NewRequest("GET", s.Config.Endpoint, nil) resp, err := s.Config.HTTPClient.Do(req) if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := http.StatusOK, resp.StatusCode; e != a { t.Errorf("expect %d status code, got %d", e, a) } } func TestNewSession_WithCustomCABundle_HTTPProxyAvailable(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() s, err := NewSessionWithOptions(Options{ Config: aws.Config{ HTTPClient: &http.Client{}, Region: aws.String("mock-region"), Credentials: credentials.AnonymousCredentials, }, CustomCABundle: bytes.NewReader(awstesting.TLSBundleCA), }) if err != nil { t.Fatalf("expect no error, got %v", err) } if s == nil { t.Fatalf("expect session to be created, got none") } tr := s.Config.HTTPClient.Transport.(http.Transport) if tr.Proxy == nil { t.Fatalf("expect transport proxy, was nil") } if tr.TLSClientConfig.RootCAs == nil { t.Fatalf("expect TLS config to have root CAs") } } func TestNewSession_WithCustomCABundle_OptionPriority(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() endpoint, err := awstesting.CreateTLSServer(TLSBundleCertFile, TLSBundleKeyFile, nil) if err != nil { t.Fatalf("expect no error, got %v", err) } os.Setenv("AWS_CA_BUNDLE", "file-not-exists") s, err := NewSessionWithOptions(Options{ Config: aws.Config{ HTTPClient: &http.Client{}, Endpoint: aws.String(endpoint), Region: aws.String("mock-region"), Credentials: credentials.AnonymousCredentials, }, CustomCABundle: bytes.NewReader(awstesting.TLSBundleCA), }) if err != nil { t.Fatalf("expect no error, got %v", err) } if s == nil { t.Fatalf("expect session to be created, got none") } req, _ := http.NewRequest("GET", s.Config.Endpoint, nil) resp, err := s.Config.HTTPClient.Do(req) if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := http.StatusOK, resp.StatusCode; e != a { t.Errorf("expect %d status code, got %d", e, a) } } type mockRoundTripper struct{} func (m mockRoundTripper) RoundTrip(r http.Request) (http.Response, error) { return nil, nil } func TestNewSession_WithCustomCABundle_UnsupportedTransport(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() s, err := NewSessionWithOptions(Options{ Config: aws.Config{ HTTPClient: &http.Client{ Transport: &mockRoundTripper{}, }, }, CustomCABundle: bytes.NewReader(awstesting.TLSBundleCA), }) if err == nil { t.Fatalf("expect error, got none") } if e, a := "LoadCustomCABundleError", err.(awserr.Error).Code(); e != a { t.Errorf("expect %s error code, got %s", e, a) } if s != nil { t.Errorf("expect nil session, got %v", s) } aerrMsg := err.(awserr.Error).Message() if e, a := "transport unsupported type", aerrMsg; !strings.Contains(a, e) { t.Errorf("expect %s to be in %s", e, a) } } func TestNewSession_WithCustomCABundle_TransportSet(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() endpoint, err := awstesting.CreateTLSServer(TLSBundleCertFile, TLSBundleKeyFile, nil) if err != nil { t.Fatalf("expect no error, got %v", err) } s, err := NewSessionWithOptions(Options{ Config: aws.Config{ Endpoint: aws.String(endpoint), Region: aws.String("mock-region"), Credentials: credentials.AnonymousCredentials, HTTPClient: &http.Client{ Transport: &http.Transport{ Proxy: http.ProxyFromEnvironment, Dial: (&net.Dialer{ Timeout: 30 time.Second, KeepAlive: 30 * time.Second, DualStack: true, }).Dial, TLSHandshakeTimeout: 2 * time.Second, }, }, }, CustomCABundle: bytes.NewReader(awstesting.TLSBundleCA), }) if err != nil { t.Fatalf("expect no error, got %v", err) } if s == nil { t.Fatalf("expect session to be created, got none") } req, _ := http.NewRequest("GET", *s.Config.Endpoint, nil) resp, err := s.Config.HTTPClient.Do(req) if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := http.StatusOK, resp.StatusCode; e != a { t.Errorf("expect %d status code, got %d", e, a) } }	6.83 KB	2025-05-25 12:27
📄 custom_transport.go //go:build go1.13 // +build go1.13 package session import ( "net" "net/http" "time" ) // Transport that should be used when a custom CA bundle is specified with the // SDK. func getCustomTransport() http.Transport { return &http.Transport{ Proxy: http.ProxyFromEnvironment, DialContext: (&net.Dialer{ Timeout: 30 time.Second, KeepAlive: 30 * time.Second, DualStack: true, }).DialContext, ForceAttemptHTTP2: true, MaxIdleConns: 100, IdleConnTimeout: 90 * time.Second, TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, } }	609 B	2025-05-25 12:27
📄 custom_transport_go1.12.go //go:build !go1.13 && go1.7 // +build !go1.13,go1.7 package session import ( "net" "net/http" "time" ) // Transport that should be used when a custom CA bundle is specified with the // SDK. func getCustomTransport() http.Transport { return &http.Transport{ Proxy: http.ProxyFromEnvironment, DialContext: (&net.Dialer{ Timeout: 30 time.Second, KeepAlive: 30 * time.Second, DualStack: true, }).DialContext, MaxIdleConns: 100, IdleConnTimeout: 90 * time.Second, TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, } }	595 B	2025-05-25 12:27
📄 custom_transport_go1.5.go //go:build !go1.6 && go1.5 // +build !go1.6,go1.5 package session import ( "net" "net/http" "time" ) // Transport that should be used when a custom CA bundle is specified with the // SDK. func getCustomTransport() http.Transport { return &http.Transport{ Proxy: http.ProxyFromEnvironment, Dial: (&net.Dialer{ Timeout: 30 time.Second, KeepAlive: 30 * time.Second, }).Dial, TLSHandshakeTimeout: 10 * time.Second, } }	442 B	2025-05-25 12:27
📄 custom_transport_go1.6.go //go:build !go1.7 && go1.6 // +build !go1.7,go1.6 package session import ( "net" "net/http" "time" ) // Transport that should be used when a custom CA bundle is specified with the // SDK. func getCustomTransport() http.Transport { return &http.Transport{ Proxy: http.ProxyFromEnvironment, Dial: (&net.Dialer{ Timeout: 30 time.Second, KeepAlive: 30 * time.Second, }).Dial, TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, } }	486 B	2025-05-25 12:27
📄 doc.go /* Package session provides configuration for the SDK's service clients. Sessions can be shared across service clients that share the same base configuration. Sessions are safe to use concurrently as long as the Session is not being modified. Sessions should be cached when possible, because creating a new Session will load all configuration values from the environment, and config files each time the Session is created. Sharing the Session value across all of your service clients will ensure the configuration is loaded the fewest number of times possible. Sessions options from Shared Config By default NewSession will only load credentials from the shared credentials file (~/.aws/credentials). If the AWS_SDK_LOAD_CONFIG environment variable is set to a truthy value the Session will be created from the configuration values from the shared config (~/.aws/config) and shared credentials (~/.aws/credentials) files. Using the NewSessionWithOptions with SharedConfigState set to SharedConfigEnable will create the session as if the AWS_SDK_LOAD_CONFIG environment variable was set. Credential and config loading order The Session will attempt to load configuration and credentials from the environment, configuration files, and other credential sources. The order configuration is loaded in is: * Environment Variables * Shared Credentials file * Shared Configuration file (if SharedConfig is enabled) * EC2 Instance Metadata (credentials only) The Environment variables for credentials will have precedence over shared config even if SharedConfig is enabled. To override this behavior, and use shared config credentials instead specify the session.Options.Profile, (e.g. when using credential_source=Environment to assume a role). sess, err := session.NewSessionWithOptions(session.Options{ Profile: "myProfile", }) Creating Sessions Creating a Session without additional options will load credentials region, and profile loaded from the environment and shared config automatically. See, "Environment Variables" section for information on environment variables used by Session. // Create Session sess, err := session.NewSession() When creating Sessions optional aws.Config values can be passed in that will override the default, or loaded, config values the Session is being created with. This allows you to provide additional, or case based, configuration as needed. // Create a Session with a custom region sess, err := session.NewSession(&aws.Config{ Region: aws.String("us-west-2"), }) Use NewSessionWithOptions to provide additional configuration driving how the Session's configuration will be loaded. Such as, specifying shared config profile, or override the shared config state, (AWS_SDK_LOAD_CONFIG). // Equivalent to session.NewSession() sess, err := session.NewSessionWithOptions(session.Options{ // Options }) sess, err := session.NewSessionWithOptions(session.Options{ // Specify profile to load for the session's config Profile: "profile_name", // Provide SDK Config options, such as Region. Config: aws.Config{ Region: aws.String("us-west-2"), }, // Force enable Shared Config support SharedConfigState: session.SharedConfigEnable, }) Adding Handlers You can add handlers to a session to decorate API operation, (e.g. adding HTTP headers). All clients that use the Session receive a copy of the Session's handlers. For example, the following request handler added to the Session logs every requests made. // Create a session, and add additional handlers for all service // clients created with the Session to inherit. Adds logging handler. sess := session.Must(session.NewSession()) sess.Handlers.Send.PushFront(func(r request.Request) { // Log every request made and its payload logger.Printf("Request: %s/%s, Params: %s", r.ClientInfo.ServiceName, r.Operation, r.Params) }) Shared Config Fields By default the SDK will only load the shared credentials file's (~/.aws/credentials) credentials values, and all other config is provided by the environment variables, SDK defaults, and user provided aws.Config values. If the AWS_SDK_LOAD_CONFIG environment variable is set, or SharedConfigEnable option is used to create the Session the full shared config values will be loaded. This includes credentials, region, and support for assume role. In addition the Session will load its configuration from both the shared config file (~/.aws/config) and shared credentials file (~/.aws/credentials). Both files have the same format. If both config files are present the configuration from both files will be read. The Session will be created from configuration values from the shared credentials file (~/.aws/credentials) over those in the shared config file (~/.aws/config). Credentials are the values the SDK uses to authenticating requests with AWS Services. When specified in a file, both aws_access_key_id and aws_secret_access_key must be provided together in the same file to be considered valid. They will be ignored if both are not present. aws_session_token is an optional field that can be provided in addition to the other two fields. aws_access_key_id = AKID aws_secret_access_key = SECRET aws_session_token = TOKEN ; region only supported if SharedConfigEnabled. region = us-east-1 Assume Role configuration The role_arn field allows you to configure the SDK to assume an IAM role using a set of credentials from another source. Such as when paired with static credentials, "profile_source", "credential_process", or "credential_source" fields. If "role_arn" is provided, a source of credentials must also be specified, such as "source_profile", "credential_source", or "credential_process". role_arn = arn:aws:iam::<account_number>:role/<role_name> source_profile = profile_with_creds external_id = 1234 mfa_serial = <serial or mfa arn> role_session_name = session_name The SDK supports assuming a role with MFA token. If "mfa_serial" is set, you must also set the Session Option.AssumeRoleTokenProvider. The Session will fail to load if the AssumeRoleTokenProvider is not specified. sess := session.Must(session.NewSessionWithOptions(session.Options{ AssumeRoleTokenProvider: stscreds.StdinTokenProvider, })) To setup Assume Role outside of a session see the stscreds.AssumeRoleProvider documentation. Environment Variables When a Session is created several environment variables can be set to adjust how the SDK functions, and what configuration data it loads when creating Sessions. All environment values are optional, but some values like credentials require multiple of the values to set or the partial values will be ignored. All environment variable values are strings unless otherwise noted. Environment configuration values. If set both Access Key ID and Secret Access Key must be provided. Session Token and optionally also be provided, but is not required. # Access Key ID AWS_ACCESS_KEY_ID=AKID AWS_ACCESS_KEY=AKID # only read if AWS_ACCESS_KEY_ID is not set. # Secret Access Key AWS_SECRET_ACCESS_KEY=SECRET AWS_SECRET_KEY=SECRET=SECRET # only read if AWS_SECRET_ACCESS_KEY is not set. # Session Token AWS_SESSION_TOKEN=TOKEN Region value will instruct the SDK where to make service API requests to. If is not provided in the environment the region must be provided before a service client request is made. AWS_REGION=us-east-1 # AWS_DEFAULT_REGION is only read if AWS_SDK_LOAD_CONFIG is also set, # and AWS_REGION is not also set. AWS_DEFAULT_REGION=us-east-1 Profile name the SDK should load use when loading shared config from the configuration files. If not provided "default" will be used as the profile name. AWS_PROFILE=my_profile # AWS_DEFAULT_PROFILE is only read if AWS_SDK_LOAD_CONFIG is also set, # and AWS_PROFILE is not also set. AWS_DEFAULT_PROFILE=my_profile SDK load config instructs the SDK to load the shared config in addition to shared credentials. This also expands the configuration loaded so the shared credentials will have parity with the shared config file. This also enables Region and Profile support for the AWS_DEFAULT_REGION and AWS_DEFAULT_PROFILE env values as well. AWS_SDK_LOAD_CONFIG=1 Custom Shared Config and Credential Files Shared credentials file path can be set to instruct the SDK to use an alternative file for the shared credentials. If not set the file will be loaded from $HOME/.aws/credentials on Linux/Unix based systems, and %USERPROFILE%\.aws\credentials on Windows. AWS_SHARED_CREDENTIALS_FILE=$HOME/my_shared_credentials Shared config file path can be set to instruct the SDK to use an alternative file for the shared config. If not set the file will be loaded from $HOME/.aws/config on Linux/Unix based systems, and %USERPROFILE%\.aws\config on Windows. AWS_CONFIG_FILE=$HOME/my_shared_config Custom CA Bundle Path to a custom Credentials Authority (CA) bundle PEM file that the SDK will use instead of the default system's root CA bundle. Use this only if you want to replace the CA bundle the SDK uses for TLS requests. AWS_CA_BUNDLE=$HOME/my_custom_ca_bundle Enabling this option will attempt to merge the Transport into the SDK's HTTP client. If the client's Transport is not a http.Transport an error will be returned. If the Transport's TLS config is set this option will cause the SDK to overwrite the Transport's TLS config's RootCAs value. If the CA bundle file contains multiple certificates all of them will be loaded. The Session option CustomCABundle is also available when creating sessions to also enable this feature. CustomCABundle session option field has priority over the AWS_CA_BUNDLE environment variable, and will be used if both are set. Setting a custom HTTPClient in the aws.Config options will override this setting. To use this option and custom HTTP client, the HTTP client needs to be provided when creating the session. Not the service client. Custom Client TLS Certificate The SDK supports the environment and session option being configured with Client TLS certificates that are sent as a part of the client's TLS handshake for client authentication. If used, both Cert and Key values are required. If one is missing, or either fail to load the contents of the file an error will be returned. HTTP Client's Transport concrete implementation must be a http.Transport or creating the session will fail. AWS_SDK_GO_CLIENT_TLS_KEY=$HOME/my_client_key AWS_SDK_GO_CLIENT_TLS_CERT=$HOME/my_client_cert This can also be configured via the session.Options ClientTLSCert and ClientTLSKey. sess, err := session.NewSessionWithOptions(session.Options{ ClientTLSCert: myCertFile, ClientTLSKey: myKeyFile, }) Custom EC2 IMDS Endpoint The endpoint of the EC2 IMDS client can be configured via the environment variable, AWS_EC2_METADATA_SERVICE_ENDPOINT when creating the client with a Session. See Options.EC2IMDSEndpoint for more details. AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254 If using an URL with an IPv6 address literal, the IPv6 address component must be enclosed in square brackets. AWS_EC2_METADATA_SERVICE_ENDPOINT=http://[::1] The custom EC2 IMDS endpoint can also be specified via the Session options. sess, err := session.NewSessionWithOptions(session.Options{ EC2MetadataEndpoint: "http://[::1]", }) FIPS and DualStack Endpoints The SDK can be configured to resolve an endpoint with certain capabilities such as FIPS and DualStack. You can configure a FIPS endpoint using an environment variable, shared config ($HOME/.aws/config), or programmatically. To configure a FIPS endpoint set the environment variable set the AWS_USE_FIPS_ENDPOINT to true or false to enable or disable FIPS endpoint resolution. AWS_USE_FIPS_ENDPOINT=true To configure a FIPS endpoint using shared config, set use_fips_endpoint to true or false to enable or disable FIPS endpoint resolution. [profile myprofile] region=us-west-2 use_fips_endpoint=true To configure a FIPS endpoint programmatically // Option 1: Configure it on a session for all clients sess, err := session.NewSessionWithOptions(session.Options{ UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }) if err != nil { // handle error } client := s3.New(sess) // Option 2: Configure it per client sess, err := session.NewSession() if err != nil { // handle error } client := s3.New(sess, &aws.Config{ UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }) You can configure a DualStack endpoint using an environment variable, shared config ($HOME/.aws/config), or programmatically. To configure a DualStack endpoint set the environment variable set the AWS_USE_DUALSTACK_ENDPOINT to true or false to enable or disable DualStack endpoint resolution. AWS_USE_DUALSTACK_ENDPOINT=true To configure a DualStack endpoint using shared config, set use_dualstack_endpoint to true or false to enable or disable DualStack endpoint resolution. [profile myprofile] region=us-west-2 use_dualstack_endpoint=true To configure a DualStack endpoint programmatically // Option 1: Configure it on a session for all clients sess, err := session.NewSessionWithOptions(session.Options{ UseDualStackEndpoint: endpoints.DualStackEndpointStateEnabled, }) if err != nil { // handle error } client := s3.New(sess) // Option 2: Configure it per client sess, err := session.NewSession() if err != nil { // handle error } client := s3.New(sess, &aws.Config{ UseDualStackEndpoint: endpoints.DualStackEndpointStateEnabled, }) / package session	13.32 KB	2025-05-25 12:27
📄 env_config.go package session import ( "fmt" "os" "strconv" "strings" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/defaults" "github.com/aws/aws-sdk-go/aws/endpoints" ) // EnvProviderName provides a name of the provider when config is loaded from environment. const EnvProviderName = "EnvConfigCredentials" // envConfig is a collection of environment values the SDK will read // setup config from. All environment values are optional. But some values // such as credentials require multiple values to be complete or the values // will be ignored. type envConfig struct { // Environment configuration values. If set both Access Key ID and Secret Access // Key must be provided. Session Token and optionally also be provided, but is // not required. // // # Access Key ID // AWS_ACCESS_KEY_ID=AKID // AWS_ACCESS_KEY=AKID # only read if AWS_ACCESS_KEY_ID is not set. // // # Secret Access Key // AWS_SECRET_ACCESS_KEY=SECRET // AWS_SECRET_KEY=SECRET=SECRET # only read if AWS_SECRET_ACCESS_KEY is not set. // // # Session Token // AWS_SESSION_TOKEN=TOKEN Creds credentials.Value // Region value will instruct the SDK where to make service API requests to. If is // not provided in the environment the region must be provided before a service // client request is made. // // AWS_REGION=us-east-1 // // # AWS_DEFAULT_REGION is only read if AWS_SDK_LOAD_CONFIG is also set, // # and AWS_REGION is not also set. // AWS_DEFAULT_REGION=us-east-1 Region string // Profile name the SDK should load use when loading shared configuration from the // shared configuration files. If not provided "default" will be used as the // profile name. // // AWS_PROFILE=my_profile // // # AWS_DEFAULT_PROFILE is only read if AWS_SDK_LOAD_CONFIG is also set, // # and AWS_PROFILE is not also set. // AWS_DEFAULT_PROFILE=my_profile Profile string // SDK load config instructs the SDK to load the shared config in addition to // shared credentials. This also expands the configuration loaded from the shared // credentials to have parity with the shared config file. This also enables // Region and Profile support for the AWS_DEFAULT_REGION and AWS_DEFAULT_PROFILE // env values as well. // // AWS_SDK_LOAD_CONFIG=1 EnableSharedConfig bool // Shared credentials file path can be set to instruct the SDK to use an alternate // file for the shared credentials. If not set the file will be loaded from // $HOME/.aws/credentials on Linux/Unix based systems, and // %USERPROFILE%\.aws\credentials on Windows. // // AWS_SHARED_CREDENTIALS_FILE=$HOME/my_shared_credentials SharedCredentialsFile string // Shared config file path can be set to instruct the SDK to use an alternate // file for the shared config. If not set the file will be loaded from // $HOME/.aws/config on Linux/Unix based systems, and // %USERPROFILE%\.aws\config on Windows. // // AWS_CONFIG_FILE=$HOME/my_shared_config SharedConfigFile string // Sets the path to a custom Credentials Authority (CA) Bundle PEM file // that the SDK will use instead of the system's root CA bundle. // Only use this if you want to configure the SDK to use a custom set // of CAs. // // Enabling this option will attempt to merge the Transport // into the SDK's HTTP client. If the client's Transport is // not a http.Transport an error will be returned. If the // Transport's TLS config is set this option will cause the // SDK to overwrite the Transport's TLS config's RootCAs value. // // Setting a custom HTTPClient in the aws.Config options will override this setting. // To use this option and custom HTTP client, the HTTP client needs to be provided // when creating the session. Not the service client. // // AWS_CA_BUNDLE=$HOME/my_custom_ca_bundle CustomCABundle string // Sets the TLC client certificate that should be used by the SDK's HTTP transport // when making requests. The certificate must be paired with a TLS client key file. // // AWS_SDK_GO_CLIENT_TLS_CERT=$HOME/my_client_cert ClientTLSCert string // Sets the TLC client key that should be used by the SDK's HTTP transport // when making requests. The key must be paired with a TLS client certificate file. // // AWS_SDK_GO_CLIENT_TLS_KEY=$HOME/my_client_key ClientTLSKey string csmEnabled string CSMEnabled bool CSMPort string CSMHost string CSMClientID string // Enables endpoint discovery via environment variables. // // AWS_ENABLE_ENDPOINT_DISCOVERY=true EnableEndpointDiscovery bool enableEndpointDiscovery string // Specifies the WebIdentity token the SDK should use to assume a role // with. // // AWS_WEB_IDENTITY_TOKEN_FILE=file_path WebIdentityTokenFilePath string // Specifies the IAM role arn to use when assuming an role. // // AWS_ROLE_ARN=role_arn RoleARN string // Specifies the IAM role session name to use when assuming a role. // // AWS_ROLE_SESSION_NAME=session_name RoleSessionName string // Specifies the STS Regional Endpoint flag for the SDK to resolve the endpoint // for a service. // // AWS_STS_REGIONAL_ENDPOINTS=regional // This can take value as `regional` or `legacy` STSRegionalEndpoint endpoints.STSRegionalEndpoint // Specifies the S3 Regional Endpoint flag for the SDK to resolve the // endpoint for a service. // // AWS_S3_US_EAST_1_REGIONAL_ENDPOINT=regional // This can take value as `regional` or `legacy` S3UsEast1RegionalEndpoint endpoints.S3UsEast1RegionalEndpoint // Specifies if the S3 service should allow ARNs to direct the region // the client's requests are sent to. // // AWS_S3_USE_ARN_REGION=true S3UseARNRegion bool // Specifies the EC2 Instance Metadata Service endpoint to use. If specified it overrides EC2IMDSEndpointMode. // // AWS_EC2_METADATA_SERVICE_ENDPOINT=http://[::1] EC2IMDSEndpoint string // Specifies the EC2 Instance Metadata Service default endpoint selection mode (IPv4 or IPv6) // // AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE=IPv6 EC2IMDSEndpointMode endpoints.EC2IMDSEndpointModeState // Specifies that IMDS clients should not fallback to IMDSv1 if token // requests fail. // // AWS_EC2_METADATA_V1_DISABLED=true EC2IMDSv1Disabled bool // Specifies that SDK clients must resolve a dual-stack endpoint for // services. // // AWS_USE_DUALSTACK_ENDPOINT=true UseDualStackEndpoint endpoints.DualStackEndpointState // Specifies that SDK clients must resolve a FIPS endpoint for // services. // // AWS_USE_FIPS_ENDPOINT=true UseFIPSEndpoint endpoints.FIPSEndpointState } var ( csmEnabledEnvKey = []string{ "AWS_CSM_ENABLED", } csmHostEnvKey = []string{ "AWS_CSM_HOST", } csmPortEnvKey = []string{ "AWS_CSM_PORT", } csmClientIDEnvKey = []string{ "AWS_CSM_CLIENT_ID", } credAccessEnvKey = []string{ "AWS_ACCESS_KEY_ID", "AWS_ACCESS_KEY", } credSecretEnvKey = []string{ "AWS_SECRET_ACCESS_KEY", "AWS_SECRET_KEY", } credSessionEnvKey = []string{ "AWS_SESSION_TOKEN", } enableEndpointDiscoveryEnvKey = []string{ "AWS_ENABLE_ENDPOINT_DISCOVERY", } regionEnvKeys = []string{ "AWS_REGION", "AWS_DEFAULT_REGION", // Only read if AWS_SDK_LOAD_CONFIG is also set } profileEnvKeys = []string{ "AWS_PROFILE", "AWS_DEFAULT_PROFILE", // Only read if AWS_SDK_LOAD_CONFIG is also set } sharedCredsFileEnvKey = []string{ "AWS_SHARED_CREDENTIALS_FILE", } sharedConfigFileEnvKey = []string{ "AWS_CONFIG_FILE", } webIdentityTokenFilePathEnvKey = []string{ "AWS_WEB_IDENTITY_TOKEN_FILE", } roleARNEnvKey = []string{ "AWS_ROLE_ARN", } roleSessionNameEnvKey = []string{ "AWS_ROLE_SESSION_NAME", } stsRegionalEndpointKey = []string{ "AWS_STS_REGIONAL_ENDPOINTS", } s3UsEast1RegionalEndpoint = []string{ "AWS_S3_US_EAST_1_REGIONAL_ENDPOINT", } s3UseARNRegionEnvKey = []string{ "AWS_S3_USE_ARN_REGION", } ec2IMDSEndpointEnvKey = []string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT", } ec2IMDSEndpointModeEnvKey = []string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE", } ec2MetadataV1DisabledEnvKey = []string{ "AWS_EC2_METADATA_V1_DISABLED", } useCABundleKey = []string{ "AWS_CA_BUNDLE", } useClientTLSCert = []string{ "AWS_SDK_GO_CLIENT_TLS_CERT", } useClientTLSKey = []string{ "AWS_SDK_GO_CLIENT_TLS_KEY", } awsUseDualStackEndpoint = []string{ "AWS_USE_DUALSTACK_ENDPOINT", } awsUseFIPSEndpoint = []string{ "AWS_USE_FIPS_ENDPOINT", } ) // loadEnvConfig retrieves the SDK's environment configuration. // See `envConfig` for the values that will be retrieved. // // If the environment variable `AWS_SDK_LOAD_CONFIG` is set to a truthy value // the shared SDK config will be loaded in addition to the SDK's specific // configuration values. func loadEnvConfig() (envConfig, error) { enableSharedConfig, _ := strconv.ParseBool(os.Getenv("AWS_SDK_LOAD_CONFIG")) return envConfigLoad(enableSharedConfig) } // loadEnvSharedConfig retrieves the SDK's environment configuration, and the // SDK shared config. See `envConfig` for the values that will be retrieved. // // Loads the shared configuration in addition to the SDK's specific configuration. // This will load the same values as `loadEnvConfig` if the `AWS_SDK_LOAD_CONFIG` // environment variable is set. func loadSharedEnvConfig() (envConfig, error) { return envConfigLoad(true) } func envConfigLoad(enableSharedConfig bool) (envConfig, error) { cfg := envConfig{} cfg.EnableSharedConfig = enableSharedConfig // Static environment credentials var creds credentials.Value setFromEnvVal(&creds.AccessKeyID, credAccessEnvKey) setFromEnvVal(&creds.SecretAccessKey, credSecretEnvKey) setFromEnvVal(&creds.SessionToken, credSessionEnvKey) if creds.HasKeys() { // Require logical grouping of credentials creds.ProviderName = EnvProviderName cfg.Creds = creds } // Role Metadata setFromEnvVal(&cfg.RoleARN, roleARNEnvKey) setFromEnvVal(&cfg.RoleSessionName, roleSessionNameEnvKey) // Web identity environment variables setFromEnvVal(&cfg.WebIdentityTokenFilePath, webIdentityTokenFilePathEnvKey) // CSM environment variables setFromEnvVal(&cfg.csmEnabled, csmEnabledEnvKey) setFromEnvVal(&cfg.CSMHost, csmHostEnvKey) setFromEnvVal(&cfg.CSMPort, csmPortEnvKey) setFromEnvVal(&cfg.CSMClientID, csmClientIDEnvKey) if len(cfg.csmEnabled) != 0 { v, _ := strconv.ParseBool(cfg.csmEnabled) cfg.CSMEnabled = &v } regionKeys := regionEnvKeys profileKeys := profileEnvKeys if !cfg.EnableSharedConfig { regionKeys = regionKeys[:1] profileKeys = profileKeys[:1] } setFromEnvVal(&cfg.Region, regionKeys) setFromEnvVal(&cfg.Profile, profileKeys) // endpoint discovery is in reference to it being enabled. setFromEnvVal(&cfg.enableEndpointDiscovery, enableEndpointDiscoveryEnvKey) if len(cfg.enableEndpointDiscovery) > 0 { cfg.EnableEndpointDiscovery = aws.Bool(cfg.enableEndpointDiscovery != "false") } setFromEnvVal(&cfg.SharedCredentialsFile, sharedCredsFileEnvKey) setFromEnvVal(&cfg.SharedConfigFile, sharedConfigFileEnvKey) if len(cfg.SharedCredentialsFile) == 0 { cfg.SharedCredentialsFile = defaults.SharedCredentialsFilename() } if len(cfg.SharedConfigFile) == 0 { cfg.SharedConfigFile = defaults.SharedConfigFilename() } setFromEnvVal(&cfg.CustomCABundle, useCABundleKey) setFromEnvVal(&cfg.ClientTLSCert, useClientTLSCert) setFromEnvVal(&cfg.ClientTLSKey, useClientTLSKey) var err error // STS Regional Endpoint variable for _, k := range stsRegionalEndpointKey { if v := os.Getenv(k); len(v) != 0 { cfg.STSRegionalEndpoint, err = endpoints.GetSTSRegionalEndpoint(v) if err != nil { return cfg, fmt.Errorf("failed to load, %v from env config, %v", k, err) } } } // S3 Regional Endpoint variable for _, k := range s3UsEast1RegionalEndpoint { if v := os.Getenv(k); len(v) != 0 { cfg.S3UsEast1RegionalEndpoint, err = endpoints.GetS3UsEast1RegionalEndpoint(v) if err != nil { return cfg, fmt.Errorf("failed to load, %v from env config, %v", k, err) } } } var s3UseARNRegion string setFromEnvVal(&s3UseARNRegion, s3UseARNRegionEnvKey) if len(s3UseARNRegion) != 0 { switch { case strings.EqualFold(s3UseARNRegion, "false"): cfg.S3UseARNRegion = false case strings.EqualFold(s3UseARNRegion, "true"): cfg.S3UseARNRegion = true default: return envConfig{}, fmt.Errorf( "invalid value for environment variable, %s=%s, need true or false", s3UseARNRegionEnvKey[0], s3UseARNRegion) } } setFromEnvVal(&cfg.EC2IMDSEndpoint, ec2IMDSEndpointEnvKey) if err := setEC2IMDSEndpointMode(&cfg.EC2IMDSEndpointMode, ec2IMDSEndpointModeEnvKey); err != nil { return envConfig{}, err } setBoolPtrFromEnvVal(&cfg.EC2IMDSv1Disabled, ec2MetadataV1DisabledEnvKey) if err := setUseDualStackEndpointFromEnvVal(&cfg.UseDualStackEndpoint, awsUseDualStackEndpoint); err != nil { return cfg, err } if err := setUseFIPSEndpointFromEnvVal(&cfg.UseFIPSEndpoint, awsUseFIPSEndpoint); err != nil { return cfg, err } return cfg, nil } func setFromEnvVal(dst string, keys []string) { for _, k := range keys { if v := os.Getenv(k); len(v) != 0 { dst = v break } } } func setBoolPtrFromEnvVal(dst bool, keys []string) { for _, k := range keys { value := os.Getenv(k) if len(value) == 0 { continue } switch { case strings.EqualFold(value, "false"): dst = new(bool) *dst = false case strings.EqualFold(value, "true"): dst = new(bool) *dst = true } } } func setEC2IMDSEndpointMode(mode endpoints.EC2IMDSEndpointModeState, keys []string) error { for _, k := range keys { value := os.Getenv(k) if len(value) == 0 { continue } if err := mode.SetFromString(value); err != nil { return fmt.Errorf("invalid value for environment variable, %s=%s, %v", k, value, err) } return nil } return nil } func setUseDualStackEndpointFromEnvVal(dst endpoints.DualStackEndpointState, keys []string) error { for _, k := range keys { value := os.Getenv(k) if len(value) == 0 { continue // skip if empty } switch { case strings.EqualFold(value, "true"): dst = endpoints.DualStackEndpointStateEnabled case strings.EqualFold(value, "false"): dst = endpoints.DualStackEndpointStateDisabled default: return fmt.Errorf( "invalid value for environment variable, %s=%s, need true, false", k, value) } } return nil } func setUseFIPSEndpointFromEnvVal(dst endpoints.FIPSEndpointState, keys []string) error { for _, k := range keys { value := os.Getenv(k) if len(value) == 0 { continue // skip if empty } switch { case strings.EqualFold(value, "true"): dst = endpoints.FIPSEndpointStateEnabled case strings.EqualFold(value, "false"): dst = endpoints.FIPSEndpointStateDisabled default: return fmt.Errorf( "invalid value for environment variable, %s=%s, need true, false", k, value) } } return nil }	14.53 KB	2025-05-25 12:27
📄 env_config_test.go //go:build go1.7 // +build go1.7 package session import ( "os" "reflect" "strconv" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/endpoints" "github.com/aws/aws-sdk-go/awstesting" "github.com/aws/aws-sdk-go/internal/sdktesting" "github.com/aws/aws-sdk-go/internal/shareddefaults" ) func TestLoadEnvConfig_Creds(t testing.T) { cases := []struct { Env map[string]string Val credentials.Value }{ { Env: map[string]string{ "AWS_ACCESS_KEY": "AKID", }, Val: credentials.Value{}, }, { Env: map[string]string{ "AWS_ACCESS_KEY_ID": "AKID", }, Val: credentials.Value{}, }, { Env: map[string]string{ "AWS_SECRET_KEY": "SECRET", }, Val: credentials.Value{}, }, { Env: map[string]string{ "AWS_SECRET_ACCESS_KEY": "SECRET", }, Val: credentials.Value{}, }, { Env: map[string]string{ "AWS_ACCESS_KEY_ID": "AKID", "AWS_SECRET_ACCESS_KEY": "SECRET", }, Val: credentials.Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", ProviderName: "EnvConfigCredentials", }, }, { Env: map[string]string{ "AWS_ACCESS_KEY": "AKID", "AWS_SECRET_KEY": "SECRET", }, Val: credentials.Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", ProviderName: "EnvConfigCredentials", }, }, { Env: map[string]string{ "AWS_ACCESS_KEY": "AKID", "AWS_SECRET_KEY": "SECRET", "AWS_SESSION_TOKEN": "TOKEN", }, Val: credentials.Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", SessionToken: "TOKEN", ProviderName: "EnvConfigCredentials", }, }, } for i, c := range cases { t.Run(strconv.Itoa(i), func(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() for k, v := range c.Env { os.Setenv(k, v) } cfg, err := loadEnvConfig() if err != nil { t.Fatalf("failed to load env config, %v", err) } if !reflect.DeepEqual(c.Val, cfg.Creds) { t.Errorf("expect credentials to match.\n%s", awstesting.SprintExpectActual(c.Val, cfg.Creds)) } }) } } func TestLoadEnvConfig(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() cases := []struct { Env map[string]string UseSharedConfigCall bool Config envConfig WantErr bool }{ 0: { Env: map[string]string{ "AWS_REGION": "region", "AWS_PROFILE": "profile", }, Config: envConfig{ Region: "region", Profile: "profile", SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 1: { Env: map[string]string{ "AWS_REGION": "region", "AWS_DEFAULT_REGION": "default_region", "AWS_PROFILE": "profile", "AWS_DEFAULT_PROFILE": "default_profile", }, Config: envConfig{ Region: "region", Profile: "profile", SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 2: { Env: map[string]string{ "AWS_REGION": "region", "AWS_DEFAULT_REGION": "default_region", "AWS_PROFILE": "profile", "AWS_DEFAULT_PROFILE": "default_profile", "AWS_SDK_LOAD_CONFIG": "1", }, Config: envConfig{ Region: "region", Profile: "profile", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 3: { Env: map[string]string{ "AWS_DEFAULT_REGION": "default_region", "AWS_DEFAULT_PROFILE": "default_profile", }, Config: envConfig{ SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 4: { Env: map[string]string{ "AWS_DEFAULT_REGION": "default_region", "AWS_DEFAULT_PROFILE": "default_profile", "AWS_SDK_LOAD_CONFIG": "1", }, Config: envConfig{ Region: "default_region", Profile: "default_profile", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 5: { Env: map[string]string{ "AWS_REGION": "region", "AWS_PROFILE": "profile", }, Config: envConfig{ Region: "region", Profile: "profile", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 6: { Env: map[string]string{ "AWS_REGION": "region", "AWS_DEFAULT_REGION": "default_region", "AWS_PROFILE": "profile", "AWS_DEFAULT_PROFILE": "default_profile", }, Config: envConfig{ Region: "region", Profile: "profile", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 7: { Env: map[string]string{ "AWS_REGION": "region", "AWS_DEFAULT_REGION": "default_region", "AWS_PROFILE": "profile", "AWS_DEFAULT_PROFILE": "default_profile", "AWS_SDK_LOAD_CONFIG": "1", }, Config: envConfig{ Region: "region", Profile: "profile", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 8: { Env: map[string]string{ "AWS_DEFAULT_REGION": "default_region", "AWS_DEFAULT_PROFILE": "default_profile", }, Config: envConfig{ Region: "default_region", Profile: "default_profile", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 9: { Env: map[string]string{ "AWS_DEFAULT_REGION": "default_region", "AWS_DEFAULT_PROFILE": "default_profile", "AWS_SDK_LOAD_CONFIG": "1", }, Config: envConfig{ Region: "default_region", Profile: "default_profile", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 10: { Env: map[string]string{ "AWS_CA_BUNDLE": "custom_ca_bundle", }, Config: envConfig{ CustomCABundle: "custom_ca_bundle", SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 11: { Env: map[string]string{ "AWS_CA_BUNDLE": "custom_ca_bundle", }, Config: envConfig{ CustomCABundle: "custom_ca_bundle", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 12: { Env: map[string]string{ "AWS_SDK_GO_CLIENT_TLS_CERT": "client_tls_cert", }, Config: envConfig{ ClientTLSCert: "client_tls_cert", SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 13: { Env: map[string]string{ "AWS_SDK_GO_CLIENT_TLS_CERT": "client_tls_cert", }, Config: envConfig{ ClientTLSCert: "client_tls_cert", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 14: { Env: map[string]string{ "AWS_SDK_GO_CLIENT_TLS_KEY": "client_tls_key", }, Config: envConfig{ ClientTLSKey: "client_tls_key", SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 15: { Env: map[string]string{ "AWS_SDK_GO_CLIENT_TLS_KEY": "client_tls_key", }, Config: envConfig{ ClientTLSKey: "client_tls_key", EnableSharedConfig: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, UseSharedConfigCall: true, }, 16: { Env: map[string]string{ "AWS_SHARED_CREDENTIALS_FILE": "/path/to/credentials/file", "AWS_CONFIG_FILE": "/path/to/config/file", }, Config: envConfig{ SharedCredentialsFile: "/path/to/credentials/file", SharedConfigFile: "/path/to/config/file", }, }, 17: { Env: map[string]string{ "AWS_STS_REGIONAL_ENDPOINTS": "regional", }, Config: envConfig{ STSRegionalEndpoint: endpoints.RegionalSTSEndpoint, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 18: { Env: map[string]string{ "AWS_S3_US_EAST_1_REGIONAL_ENDPOINT": "regional", }, Config: envConfig{ S3UsEast1RegionalEndpoint: endpoints.RegionalS3UsEast1Endpoint, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 19: { Env: map[string]string{ "AWS_S3_USE_ARN_REGION": "true", }, Config: envConfig{ S3UseARNRegion: true, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 20: { Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT": "http://example.aws", }, Config: envConfig{ EC2IMDSEndpoint: "http://example.aws", SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 21: { Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "IPv6", }, Config: envConfig{ EC2IMDSEndpointMode: endpoints.EC2IMDSEndpointModeStateIPv6, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 22: { Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "IPv4", }, Config: envConfig{ EC2IMDSEndpointMode: endpoints.EC2IMDSEndpointModeStateIPv4, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 23: { Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "foobar", }, WantErr: true, }, 24: { Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT": "http://endpoint.localhost", }, Config: envConfig{ EC2IMDSEndpoint: "http://endpoint.localhost", SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 25: { Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "IPv6", "AWS_EC2_METADATA_SERVICE_ENDPOINT": "http://endpoint.localhost", }, Config: envConfig{ EC2IMDSEndpoint: "http://endpoint.localhost", EC2IMDSEndpointMode: endpoints.EC2IMDSEndpointModeStateIPv6, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 26: { Env: map[string]string{ "AWS_EC2_METADATA_DISABLED": "false", }, Config: envConfig{ SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 27: { Env: map[string]string{ "AWS_USE_DUALSTACK_ENDPOINT": "true", }, Config: envConfig{ UseDualStackEndpoint: endpoints.DualStackEndpointStateEnabled, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 28: { Env: map[string]string{ "AWS_USE_DUALSTACK_ENDPOINT": "false", }, Config: envConfig{ UseDualStackEndpoint: endpoints.DualStackEndpointStateDisabled, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 29: { Env: map[string]string{ "AWS_USE_DUALSTACK_ENDPOINT": "invalid", }, WantErr: true, }, 30: { Env: map[string]string{ "AWS_USE_FIPS_ENDPOINT": "true", }, Config: envConfig{ UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 31: { Env: map[string]string{ "AWS_USE_FIPS_ENDPOINT": "false", }, Config: envConfig{ UseFIPSEndpoint: endpoints.FIPSEndpointStateDisabled, SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, 32: { Env: map[string]string{ "AWS_USE_FIPS_ENDPOINT": "invalid", }, WantErr: true, }, 33: { Env: map[string]string{ "AWS_EC2_METADATA_V1_DISABLED": "fAlSe", }, Config: envConfig{ SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), EC2IMDSv1Disabled: aws.Bool(false), }, }, 34: { Env: map[string]string{ "AWS_EC2_METADATA_V1_DISABLED": "tRuE", }, Config: envConfig{ SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), EC2IMDSv1Disabled: aws.Bool(true), }, }, 35: { Env: map[string]string{ "AWS_EC2_METADATA_V1_DISABLED": "invalid", }, Config: envConfig{ SharedCredentialsFile: shareddefaults.SharedCredentialsFilename(), SharedConfigFile: shareddefaults.SharedConfigFilename(), }, }, } for i, c := range cases { t.Run(strconv.Itoa(i), func(t testing.T) { restoreEnvFn = sdktesting.StashEnv() defer restoreEnvFn() for k, v := range c.Env { os.Setenv(k, v) } var cfg envConfig var err error if c.UseSharedConfigCall { cfg, err = loadSharedEnvConfig() if (err != nil) != c.WantErr { t.Errorf("WantErr=%v, got err=%v", c.WantErr, err) return } else if c.WantErr { return } } else { cfg, err = loadEnvConfig() if (err != nil) != c.WantErr { t.Errorf("WantErr=%v, got err=%v", c.WantErr, err) return } else if c.WantErr { return } } if !reflect.DeepEqual(c.Config, cfg) { t.Errorf("expect config to match.\n%s", awstesting.SprintExpectActual(c.Config, cfg)) } }) } } func TestSetEnvValue(t *testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("empty_key", "") os.Setenv("second_key", "2") os.Setenv("third_key", "3") var dst string setFromEnvVal(&dst, []string{ "empty_key", "first_key", "second_key", "third_key", }) if e, a := "2", dst; e != a { t.Errorf("expect %s value from environment, got %s", e, a) } }	15.16 KB	2025-05-25 12:27
📄 session.go package session import ( "crypto/tls" "crypto/x509" "fmt" "io" "io/ioutil" "net/http" "os" "strings" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/corehandlers" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/csm" "github.com/aws/aws-sdk-go/aws/defaults" "github.com/aws/aws-sdk-go/aws/endpoints" "github.com/aws/aws-sdk-go/aws/request" ) const ( // ErrCodeSharedConfig represents an error that occurs in the shared // configuration logic ErrCodeSharedConfig = "SharedConfigErr" // ErrCodeLoadCustomCABundle error code for unable to load custom CA bundle. ErrCodeLoadCustomCABundle = "LoadCustomCABundleError" // ErrCodeLoadClientTLSCert error code for unable to load client TLS // certificate or key ErrCodeLoadClientTLSCert = "LoadClientTLSCertError" ) // ErrSharedConfigSourceCollision will be returned if a section contains both // source_profile and credential_source var ErrSharedConfigSourceCollision = awserr.New(ErrCodeSharedConfig, "only one credential type may be specified per profile: source profile, credential source, credential process, web identity token", nil) // ErrSharedConfigECSContainerEnvVarEmpty will be returned if the environment // variables are empty and Environment was set as the credential source var ErrSharedConfigECSContainerEnvVarEmpty = awserr.New(ErrCodeSharedConfig, "EcsContainer was specified as the credential_source, but 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' was not set", nil) // ErrSharedConfigInvalidCredSource will be returned if an invalid credential source was provided var ErrSharedConfigInvalidCredSource = awserr.New(ErrCodeSharedConfig, "credential source values must be EcsContainer, Ec2InstanceMetadata, or Environment", nil) // A Session provides a central location to create service clients from and // store configurations and request handlers for those services. // // Sessions are safe to create service clients concurrently, but it is not safe // to mutate the Session concurrently. // // The Session satisfies the service client's client.ConfigProvider. type Session struct { Config aws.Config Handlers request.Handlers options Options } // New creates a new instance of the handlers merging in the provided configs // on top of the SDK's default configurations. Once the Session is created it // can be mutated to modify the Config or Handlers. The Session is safe to be // read concurrently, but it should not be written to concurrently. // // If the AWS_SDK_LOAD_CONFIG environment is set to a truthy value, the New // method could now encounter an error when loading the configuration. When // The environment variable is set, and an error occurs, New will return a // session that will fail all requests reporting the error that occurred while // loading the session. Use NewSession to get the error when creating the // session. // // If the AWS_SDK_LOAD_CONFIG environment variable is set to a truthy value // the shared config file (~/.aws/config) will also be loaded, in addition to // the shared credentials file (~/.aws/credentials). Values set in both the // shared config, and shared credentials will be taken from the shared // credentials file. // // Deprecated: Use NewSession functions to create sessions instead. NewSession // has the same functionality as New except an error can be returned when the // func is called instead of waiting to receive an error until a request is made. func New(cfgs ...aws.Config) Session { // load initial config from environment envCfg, envErr := loadEnvConfig() if envCfg.EnableSharedConfig { var cfg aws.Config cfg.MergeIn(cfgs...) s, err := NewSessionWithOptions(Options{ Config: cfg, SharedConfigState: SharedConfigEnable, }) if err != nil { // Old session.New expected all errors to be discovered when // a request is made, and would report the errors then. This // needs to be replicated if an error occurs while creating // the session. msg := "failed to create session with AWS_SDK_LOAD_CONFIG enabled. " + "Use session.NewSession to handle errors occurring during session creation." // Session creation failed, need to report the error and prevent // any requests from succeeding. s = &Session{Config: defaults.Config()} s.logDeprecatedNewSessionError(msg, err, cfgs) } return s } s := deprecatedNewSession(envCfg, cfgs...) if envErr != nil { msg := "failed to load env config" s.logDeprecatedNewSessionError(msg, envErr, cfgs) } if csmCfg, err := loadCSMConfig(envCfg, []string{}); err != nil { if l := s.Config.Logger; l != nil { l.Log(fmt.Sprintf("ERROR: failed to load CSM configuration, %v", err)) } } else if csmCfg.Enabled { err := enableCSM(&s.Handlers, csmCfg, s.Config.Logger) if err != nil { msg := "failed to enable CSM" s.logDeprecatedNewSessionError(msg, err, cfgs) } } return s } // NewSession returns a new Session created from SDK defaults, config files, // environment, and user provided config files. Once the Session is created // it can be mutated to modify the Config or Handlers. The Session is safe to // be read concurrently, but it should not be written to concurrently. // // If the AWS_SDK_LOAD_CONFIG environment variable is set to a truthy value // the shared config file (~/.aws/config) will also be loaded in addition to // the shared credentials file (~/.aws/credentials). Values set in both the // shared config, and shared credentials will be taken from the shared // credentials file. Enabling the Shared Config will also allow the Session // to be built with retrieving credentials with AssumeRole set in the config. // // See the NewSessionWithOptions func for information on how to override or // control through code how the Session will be created, such as specifying the // config profile, and controlling if shared config is enabled or not. func NewSession(cfgs ...aws.Config) (Session, error) { opts := Options{} opts.Config.MergeIn(cfgs...) return NewSessionWithOptions(opts) } // SharedConfigState provides the ability to optionally override the state // of the session's creation based on the shared config being enabled or // disabled. type SharedConfigState int const ( // SharedConfigStateFromEnv does not override any state of the // AWS_SDK_LOAD_CONFIG env var. It is the default value of the // SharedConfigState type. SharedConfigStateFromEnv SharedConfigState = iota // SharedConfigDisable overrides the AWS_SDK_LOAD_CONFIG env var value // and disables the shared config functionality. SharedConfigDisable // SharedConfigEnable overrides the AWS_SDK_LOAD_CONFIG env var value // and enables the shared config functionality. SharedConfigEnable ) // Options provides the means to control how a Session is created and what // configuration values will be loaded. type Options struct { // Provides config values for the SDK to use when creating service clients // and making API requests to services. Any value set in with this field // will override the associated value provided by the SDK defaults, // environment or config files where relevant. // // If not set, configuration values from from SDK defaults, environment, // config will be used. Config aws.Config // Overrides the config profile the Session should be created from. If not // set the value of the environment variable will be loaded (AWS_PROFILE, // or AWS_DEFAULT_PROFILE if the Shared Config is enabled). // // If not set and environment variables are not set the "default" // (DefaultSharedConfigProfile) will be used as the profile to load the // session config from. Profile string // Instructs how the Session will be created based on the AWS_SDK_LOAD_CONFIG // environment variable. By default a Session will be created using the // value provided by the AWS_SDK_LOAD_CONFIG environment variable. // // Setting this value to SharedConfigEnable or SharedConfigDisable // will allow you to override the AWS_SDK_LOAD_CONFIG environment variable // and enable or disable the shared config functionality. SharedConfigState SharedConfigState // Ordered list of files the session will load configuration from. // It will override environment variable AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE. SharedConfigFiles []string // When the SDK's shared config is configured to assume a role with MFA // this option is required in order to provide the mechanism that will // retrieve the MFA token. There is no default value for this field. If // it is not set an error will be returned when creating the session. // // This token provider will be called when ever the assumed role's // credentials need to be refreshed. Within the context of service clients // all sharing the same session the SDK will ensure calls to the token // provider are atomic. When sharing a token provider across multiple // sessions additional synchronization logic is needed to ensure the // token providers do not introduce race conditions. It is recommend to // share the session where possible. // // stscreds.StdinTokenProvider is a basic implementation that will prompt // from stdin for the MFA token code. // // This field is only used if the shared configuration is enabled, and // the config enables assume role with MFA via the mfa_serial field. AssumeRoleTokenProvider func() (string, error) // When the SDK's shared config is configured to assume a role this option // may be provided to set the expiry duration of the STS credentials. // Defaults to 15 minutes if not set as documented in the // stscreds.AssumeRoleProvider. AssumeRoleDuration time.Duration // Reader for a custom Credentials Authority (CA) bundle in PEM format that // the SDK will use instead of the default system's root CA bundle. Use this // only if you want to replace the CA bundle the SDK uses for TLS requests. // // HTTP Client's Transport concrete implementation must be a http.Transport // or creating the session will fail. // // If the Transport's TLS config is set this option will cause the SDK // to overwrite the Transport's TLS config's RootCAs value. If the CA // bundle reader contains multiple certificates all of them will be loaded. // // Can also be specified via the environment variable: // // AWS_CA_BUNDLE=$HOME/ca_bundle // // Can also be specified via the shared config field: // // ca_bundle = $HOME/ca_bundle CustomCABundle io.Reader // Reader for the TLC client certificate that should be used by the SDK's // HTTP transport when making requests. The certificate must be paired with // a TLS client key file. Will be ignored if both are not provided. // // HTTP Client's Transport concrete implementation must be a http.Transport // or creating the session will fail. // // Can also be specified via the environment variable: // // AWS_SDK_GO_CLIENT_TLS_CERT=$HOME/my_client_cert ClientTLSCert io.Reader // Reader for the TLC client key that should be used by the SDK's HTTP // transport when making requests. The key must be paired with a TLS client // certificate file. Will be ignored if both are not provided. // // HTTP Client's Transport concrete implementation must be a http.Transport // or creating the session will fail. // // Can also be specified via the environment variable: // // AWS_SDK_GO_CLIENT_TLS_KEY=$HOME/my_client_key ClientTLSKey io.Reader // The handlers that the session and all API clients will be created with. // This must be a complete set of handlers. Use the defaults.Handlers() // function to initialize this value before changing the handlers to be // used by the SDK. Handlers request.Handlers // Allows specifying a custom endpoint to be used by the EC2 IMDS client // when making requests to the EC2 IMDS API. The endpoint value should // include the URI scheme. If the scheme is not present it will be defaulted to http. // // If unset, will the EC2 IMDS client will use its default endpoint. // // Can also be specified via the environment variable, // AWS_EC2_METADATA_SERVICE_ENDPOINT. // // AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254 // // If using an URL with an IPv6 address literal, the IPv6 address // component must be enclosed in square brackets. // // AWS_EC2_METADATA_SERVICE_ENDPOINT=http://[::1] EC2IMDSEndpoint string // Specifies the EC2 Instance Metadata Service default endpoint selection mode (IPv4 or IPv6) // // AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE=IPv6 EC2IMDSEndpointMode endpoints.EC2IMDSEndpointModeState // Specifies options for creating credential providers. // These are only used if the aws.Config does not already // include credentials. CredentialsProviderOptions CredentialsProviderOptions } // NewSessionWithOptions returns a new Session created from SDK defaults, config files, // environment, and user provided config files. This func uses the Options // values to configure how the Session is created. // // If the AWS_SDK_LOAD_CONFIG environment variable is set to a truthy value // the shared config file (~/.aws/config) will also be loaded in addition to // the shared credentials file (~/.aws/credentials). Values set in both the // shared config, and shared credentials will be taken from the shared // credentials file. Enabling the Shared Config will also allow the Session // to be built with retrieving credentials with AssumeRole set in the config. // // // Equivalent to session.New // sess := session.Must(session.NewSessionWithOptions(session.Options{})) // // // Specify profile to load for the session's config // sess := session.Must(session.NewSessionWithOptions(session.Options{ // Profile: "profile_name", // })) // // // Specify profile for config and region for requests // sess := session.Must(session.NewSessionWithOptions(session.Options{ // Config: aws.Config{Region: aws.String("us-east-1")}, // Profile: "profile_name", // })) // // // Force enable Shared Config support // sess := session.Must(session.NewSessionWithOptions(session.Options{ // SharedConfigState: session.SharedConfigEnable, // })) func NewSessionWithOptions(opts Options) (Session, error) { var envCfg envConfig var err error if opts.SharedConfigState == SharedConfigEnable { envCfg, err = loadSharedEnvConfig() if err != nil { return nil, fmt.Errorf("failed to load shared config, %v", err) } } else { envCfg, err = loadEnvConfig() if err != nil { return nil, fmt.Errorf("failed to load environment config, %v", err) } } if len(opts.Profile) != 0 { envCfg.Profile = opts.Profile } switch opts.SharedConfigState { case SharedConfigDisable: envCfg.EnableSharedConfig = false case SharedConfigEnable: envCfg.EnableSharedConfig = true } return newSession(opts, envCfg, &opts.Config) } // Must is a helper function to ensure the Session is valid and there was no // error when calling a NewSession function. // // This helper is intended to be used in variable initialization to load the // Session and configuration at startup. Such as: // // var sess = session.Must(session.NewSession()) func Must(sess Session, err error) Session { if err != nil { panic(err) } return sess } // Wraps the endpoint resolver with a resolver that will return a custom // endpoint for EC2 IMDS. func wrapEC2IMDSEndpoint(resolver endpoints.Resolver, endpoint string, mode endpoints.EC2IMDSEndpointModeState) endpoints.Resolver { return endpoints.ResolverFunc( func(service, region string, opts ...func(endpoints.Options)) ( endpoints.ResolvedEndpoint, error, ) { if service == ec2MetadataServiceID && len(endpoint) > 0 { return endpoints.ResolvedEndpoint{ URL: endpoint, SigningName: ec2MetadataServiceID, SigningRegion: region, }, nil } else if service == ec2MetadataServiceID { opts = append(opts, func(o endpoints.Options) { o.EC2MetadataEndpointMode = mode }) } return resolver.EndpointFor(service, region, opts...) }) } func deprecatedNewSession(envCfg envConfig, cfgs ...aws.Config) Session { cfg := defaults.Config() handlers := defaults.Handlers() // Apply the passed in configs so the configuration can be applied to the // default credential chain cfg.MergeIn(cfgs...) if cfg.EndpointResolver == nil { // An endpoint resolver is required for a session to be able to provide // endpoints for service client configurations. cfg.EndpointResolver = endpoints.DefaultResolver() } if !(len(envCfg.EC2IMDSEndpoint) == 0 && envCfg.EC2IMDSEndpointMode == endpoints.EC2IMDSEndpointModeStateUnset) { cfg.EndpointResolver = wrapEC2IMDSEndpoint(cfg.EndpointResolver, envCfg.EC2IMDSEndpoint, envCfg.EC2IMDSEndpointMode) } cfg.Credentials = defaults.CredChain(cfg, handlers) // Reapply any passed in configs to override credentials if set cfg.MergeIn(cfgs...) s := &Session{ Config: cfg, Handlers: handlers, options: Options{ EC2IMDSEndpoint: envCfg.EC2IMDSEndpoint, }, } initHandlers(s) return s } func enableCSM(handlers request.Handlers, cfg csmConfig, logger aws.Logger) error { if logger != nil { logger.Log("Enabling CSM") } r, err := csm.Start(cfg.ClientID, csm.AddressWithDefaults(cfg.Host, cfg.Port)) if err != nil { return err } r.InjectHandlers(handlers) return nil } func newSession(opts Options, envCfg envConfig, cfgs ...aws.Config) (Session, error) { cfg := defaults.Config() handlers := opts.Handlers if handlers.IsEmpty() { handlers = defaults.Handlers() } // Get a merged version of the user provided config to determine if // credentials were. userCfg := &aws.Config{} userCfg.MergeIn(cfgs...) cfg.MergeIn(userCfg) // Ordered config files will be loaded in with later files overwriting // previous config file values. var cfgFiles []string if opts.SharedConfigFiles != nil { cfgFiles = opts.SharedConfigFiles } else { cfgFiles = []string{envCfg.SharedConfigFile, envCfg.SharedCredentialsFile} if !envCfg.EnableSharedConfig { // The shared config file (~/.aws/config) is only loaded if instructed // to load via the envConfig.EnableSharedConfig (AWS_SDK_LOAD_CONFIG). cfgFiles = cfgFiles[1:] } } // Load additional config from file(s) sharedCfg, err := loadSharedConfig(envCfg.Profile, cfgFiles, envCfg.EnableSharedConfig) if err != nil { if len(envCfg.Profile) == 0 && !envCfg.EnableSharedConfig && (envCfg.Creds.HasKeys() \|\| userCfg.Credentials != nil) { // Special case where the user has not explicitly specified an AWS_PROFILE, // or session.Options.profile, shared config is not enabled, and the // environment has credentials, allow the shared config file to fail to // load since the user has already provided credentials, and nothing else // is required to be read file. Github(aws/aws-sdk-go#2455) } else if _, ok := err.(SharedConfigProfileNotExistsError); !ok { return nil, err } } if err := mergeConfigSrcs(cfg, userCfg, envCfg, sharedCfg, handlers, opts); err != nil { return nil, err } if err := setTLSOptions(&opts, cfg, envCfg, sharedCfg); err != nil { return nil, err } s := &Session{ Config: cfg, Handlers: handlers, options: opts, } initHandlers(s) if csmCfg, err := loadCSMConfig(envCfg, cfgFiles); err != nil { if l := s.Config.Logger; l != nil { l.Log(fmt.Sprintf("ERROR: failed to load CSM configuration, %v", err)) } } else if csmCfg.Enabled { err = enableCSM(&s.Handlers, csmCfg, s.Config.Logger) if err != nil { return nil, err } } return s, nil } type csmConfig struct { Enabled bool Host string Port string ClientID string } var csmProfileName = "aws_csm" func loadCSMConfig(envCfg envConfig, cfgFiles []string) (csmConfig, error) { if envCfg.CSMEnabled != nil { if envCfg.CSMEnabled { return csmConfig{ Enabled: true, ClientID: envCfg.CSMClientID, Host: envCfg.CSMHost, Port: envCfg.CSMPort, }, nil } return csmConfig{}, nil } sharedCfg, err := loadSharedConfig(csmProfileName, cfgFiles, false) if err != nil { if _, ok := err.(SharedConfigProfileNotExistsError); !ok { return csmConfig{}, err } } if sharedCfg.CSMEnabled != nil && sharedCfg.CSMEnabled == true { return csmConfig{ Enabled: true, ClientID: sharedCfg.CSMClientID, Host: sharedCfg.CSMHost, Port: sharedCfg.CSMPort, }, nil } return csmConfig{}, nil } func setTLSOptions(opts Options, cfg aws.Config, envCfg envConfig, sharedCfg sharedConfig) error { // CA Bundle can be specified in both environment variable shared config file. var caBundleFilename = envCfg.CustomCABundle if len(caBundleFilename) == 0 { caBundleFilename = sharedCfg.CustomCABundle } // Only use environment value if session option is not provided. customTLSOptions := map[string]struct { filename string field io.Reader errCode string }{ "custom CA bundle PEM": {filename: caBundleFilename, field: &opts.CustomCABundle, errCode: ErrCodeLoadCustomCABundle}, "custom client TLS cert": {filename: envCfg.ClientTLSCert, field: &opts.ClientTLSCert, errCode: ErrCodeLoadClientTLSCert}, "custom client TLS key": {filename: envCfg.ClientTLSKey, field: &opts.ClientTLSKey, errCode: ErrCodeLoadClientTLSCert}, } for name, v := range customTLSOptions { if len(v.filename) != 0 && v.field == nil { f, err := os.Open(v.filename) if err != nil { return awserr.New(v.errCode, fmt.Sprintf("failed to open %s file", name), err) } defer f.Close() v.field = f } } // Setup HTTP client with custom cert bundle if enabled if opts.CustomCABundle != nil { if err := loadCustomCABundle(cfg.HTTPClient, opts.CustomCABundle); err != nil { return err } } // Setup HTTP client TLS certificate and key for client TLS authentication. if opts.ClientTLSCert != nil && opts.ClientTLSKey != nil { if err := loadClientTLSCert(cfg.HTTPClient, opts.ClientTLSCert, opts.ClientTLSKey); err != nil { return err } } else if opts.ClientTLSCert == nil && opts.ClientTLSKey == nil { // Do nothing if neither values are available. } else { return awserr.New(ErrCodeLoadClientTLSCert, fmt.Sprintf("client TLS cert(%t) and key(%t) must both be provided", opts.ClientTLSCert != nil, opts.ClientTLSKey != nil), nil) } return nil } func getHTTPTransport(client http.Client) (http.Transport, error) { var t http.Transport switch v := client.Transport.(type) { case http.Transport: t = v default: if client.Transport != nil { return nil, fmt.Errorf("unsupported transport, %T", client.Transport) } } if t == nil { // Nil transport implies `http.DefaultTransport` should be used. Since // the SDK cannot modify, nor copy the `DefaultTransport` specifying // the values the next closest behavior. t = getCustomTransport() } return t, nil } func loadCustomCABundle(client http.Client, bundle io.Reader) error { t, err := getHTTPTransport(client) if err != nil { return awserr.New(ErrCodeLoadCustomCABundle, "unable to load custom CA bundle, HTTPClient's transport unsupported type", err) } p, err := loadCertPool(bundle) if err != nil { return err } if t.TLSClientConfig == nil { t.TLSClientConfig = &tls.Config{} } t.TLSClientConfig.RootCAs = p client.Transport = t return nil } func loadCertPool(r io.Reader) (x509.CertPool, error) { b, err := ioutil.ReadAll(r) if err != nil { return nil, awserr.New(ErrCodeLoadCustomCABundle, "failed to read custom CA bundle PEM file", err) } p := x509.NewCertPool() if !p.AppendCertsFromPEM(b) { return nil, awserr.New(ErrCodeLoadCustomCABundle, "failed to load custom CA bundle PEM file", err) } return p, nil } func loadClientTLSCert(client http.Client, certFile, keyFile io.Reader) error { t, err := getHTTPTransport(client) if err != nil { return awserr.New(ErrCodeLoadClientTLSCert, "unable to get usable HTTP transport from client", err) } cert, err := ioutil.ReadAll(certFile) if err != nil { return awserr.New(ErrCodeLoadClientTLSCert, "unable to get read client TLS cert file", err) } key, err := ioutil.ReadAll(keyFile) if err != nil { return awserr.New(ErrCodeLoadClientTLSCert, "unable to get read client TLS key file", err) } clientCert, err := tls.X509KeyPair(cert, key) if err != nil { return awserr.New(ErrCodeLoadClientTLSCert, "unable to load x509 key pair from client cert", err) } tlsCfg := t.TLSClientConfig if tlsCfg == nil { tlsCfg = &tls.Config{} } tlsCfg.Certificates = append(tlsCfg.Certificates, clientCert) t.TLSClientConfig = tlsCfg client.Transport = t return nil } func mergeConfigSrcs(cfg, userCfg aws.Config, envCfg envConfig, sharedCfg sharedConfig, handlers request.Handlers, sessOpts Options, ) error { // Region if not already set by user if len(aws.StringValue(cfg.Region)) == 0 { if len(envCfg.Region) > 0 { cfg.WithRegion(envCfg.Region) } else if envCfg.EnableSharedConfig && len(sharedCfg.Region) > 0 { cfg.WithRegion(sharedCfg.Region) } } if cfg.EnableEndpointDiscovery == nil { if envCfg.EnableEndpointDiscovery != nil { cfg.WithEndpointDiscovery(envCfg.EnableEndpointDiscovery) } else if envCfg.EnableSharedConfig && sharedCfg.EnableEndpointDiscovery != nil { cfg.WithEndpointDiscovery(sharedCfg.EnableEndpointDiscovery) } } // Regional Endpoint flag for STS endpoint resolving mergeSTSRegionalEndpointConfig(cfg, []endpoints.STSRegionalEndpoint{ userCfg.STSRegionalEndpoint, envCfg.STSRegionalEndpoint, sharedCfg.STSRegionalEndpoint, endpoints.LegacySTSEndpoint, }) // Regional Endpoint flag for S3 endpoint resolving mergeS3UsEast1RegionalEndpointConfig(cfg, []endpoints.S3UsEast1RegionalEndpoint{ userCfg.S3UsEast1RegionalEndpoint, envCfg.S3UsEast1RegionalEndpoint, sharedCfg.S3UsEast1RegionalEndpoint, endpoints.LegacyS3UsEast1Endpoint, }) var ec2IMDSEndpoint string for _, v := range []string{ sessOpts.EC2IMDSEndpoint, envCfg.EC2IMDSEndpoint, sharedCfg.EC2IMDSEndpoint, } { if len(v) != 0 { ec2IMDSEndpoint = v break } } var endpointMode endpoints.EC2IMDSEndpointModeState for _, v := range []endpoints.EC2IMDSEndpointModeState{ sessOpts.EC2IMDSEndpointMode, envCfg.EC2IMDSEndpointMode, sharedCfg.EC2IMDSEndpointMode, } { if v != endpoints.EC2IMDSEndpointModeStateUnset { endpointMode = v break } } if len(ec2IMDSEndpoint) != 0 \|\| endpointMode != endpoints.EC2IMDSEndpointModeStateUnset { cfg.EndpointResolver = wrapEC2IMDSEndpoint(cfg.EndpointResolver, ec2IMDSEndpoint, endpointMode) } cfg.EC2MetadataEnableFallback = userCfg.EC2MetadataEnableFallback if cfg.EC2MetadataEnableFallback == nil && envCfg.EC2IMDSv1Disabled != nil { cfg.EC2MetadataEnableFallback = aws.Bool(!envCfg.EC2IMDSv1Disabled) } if cfg.EC2MetadataEnableFallback == nil && sharedCfg.EC2IMDSv1Disabled != nil { cfg.EC2MetadataEnableFallback = aws.Bool(!sharedCfg.EC2IMDSv1Disabled) } cfg.S3UseARNRegion = userCfg.S3UseARNRegion if cfg.S3UseARNRegion == nil { cfg.S3UseARNRegion = &envCfg.S3UseARNRegion } if cfg.S3UseARNRegion == nil { cfg.S3UseARNRegion = &sharedCfg.S3UseARNRegion } for _, v := range []endpoints.DualStackEndpointState{userCfg.UseDualStackEndpoint, envCfg.UseDualStackEndpoint, sharedCfg.UseDualStackEndpoint} { if v != endpoints.DualStackEndpointStateUnset { cfg.UseDualStackEndpoint = v break } } for _, v := range []endpoints.FIPSEndpointState{userCfg.UseFIPSEndpoint, envCfg.UseFIPSEndpoint, sharedCfg.UseFIPSEndpoint} { if v != endpoints.FIPSEndpointStateUnset { cfg.UseFIPSEndpoint = v break } } // Configure credentials if not already set by the user when creating the Session. // Credentials are resolved last such that all _resolved_ config values are propagated to credential providers. // ticket: P83606045 if cfg.Credentials == credentials.AnonymousCredentials && userCfg.Credentials == nil { creds, err := resolveCredentials(cfg, envCfg, sharedCfg, handlers, sessOpts) if err != nil { return err } cfg.Credentials = creds } return nil } func mergeSTSRegionalEndpointConfig(cfg aws.Config, values []endpoints.STSRegionalEndpoint) { for _, v := range values { if v != endpoints.UnsetSTSEndpoint { cfg.STSRegionalEndpoint = v break } } } func mergeS3UsEast1RegionalEndpointConfig(cfg aws.Config, values []endpoints.S3UsEast1RegionalEndpoint) { for _, v := range values { if v != endpoints.UnsetS3UsEast1Endpoint { cfg.S3UsEast1RegionalEndpoint = v break } } } func initHandlers(s Session) { // Add the Validate parameter handler if it is not disabled. s.Handlers.Validate.Remove(corehandlers.ValidateParametersHandler) if !aws.BoolValue(s.Config.DisableParamValidation) { s.Handlers.Validate.PushBackNamed(corehandlers.ValidateParametersHandler) } } // Copy creates and returns a copy of the current Session, copying the config // and handlers. If any additional configs are provided they will be merged // on top of the Session's copied config. // // // Create a copy of the current Session, configured for the us-west-2 region. // sess.Copy(&aws.Config{Region: aws.String("us-west-2")}) func (s Session) Copy(cfgs ...aws.Config) Session { newSession := &Session{ Config: s.Config.Copy(cfgs...), Handlers: s.Handlers.Copy(), options: s.options, } initHandlers(newSession) return newSession } // ClientConfig satisfies the client.ConfigProvider interface and is used to // configure the service client instances. Passing the Session to the service // client's constructor (New) will use this method to configure the client. func (s Session) ClientConfig(service string, cfgs ...aws.Config) client.Config { s = s.Copy(cfgs...) resolvedRegion := normalizeRegion(s.Config) region := aws.StringValue(s.Config.Region) resolved, err := s.resolveEndpoint(service, region, resolvedRegion, s.Config) if err != nil { s.Handlers.Validate.PushBack(func(r request.Request) { if len(r.ClientInfo.Endpoint) != 0 { // Error occurred while resolving endpoint, but the request // being invoked has had an endpoint specified after the client // was created. return } r.Error = err }) } return client.Config{ Config: s.Config, Handlers: s.Handlers, PartitionID: resolved.PartitionID, Endpoint: resolved.URL, SigningRegion: resolved.SigningRegion, SigningNameDerived: resolved.SigningNameDerived, SigningName: resolved.SigningName, ResolvedRegion: resolvedRegion, } } const ec2MetadataServiceID = "ec2metadata" func (s Session) resolveEndpoint(service, region, resolvedRegion string, cfg aws.Config) (endpoints.ResolvedEndpoint, error) { if ep := aws.StringValue(cfg.Endpoint); len(ep) != 0 { return endpoints.ResolvedEndpoint{ URL: endpoints.AddScheme(ep, aws.BoolValue(cfg.DisableSSL)), SigningRegion: region, }, nil } resolved, err := cfg.EndpointResolver.EndpointFor(service, region, func(opt endpoints.Options) { opt.DisableSSL = aws.BoolValue(cfg.DisableSSL) opt.UseDualStack = aws.BoolValue(cfg.UseDualStack) opt.UseDualStackEndpoint = cfg.UseDualStackEndpoint opt.UseFIPSEndpoint = cfg.UseFIPSEndpoint // Support for STSRegionalEndpoint where the STSRegionalEndpoint is // provided in envConfig or sharedConfig with envConfig getting // precedence. opt.STSRegionalEndpoint = cfg.STSRegionalEndpoint // Support for S3UsEast1RegionalEndpoint where the S3UsEast1RegionalEndpoint is // provided in envConfig or sharedConfig with envConfig getting // precedence. opt.S3UsEast1RegionalEndpoint = cfg.S3UsEast1RegionalEndpoint // Support the condition where the service is modeled but its // endpoint metadata is not available. opt.ResolveUnknownService = true opt.ResolvedRegion = resolvedRegion opt.Logger = cfg.Logger opt.LogDeprecated = cfg.LogLevel.Matches(aws.LogDebugWithDeprecated) }, ) if err != nil { return endpoints.ResolvedEndpoint{}, err } return resolved, nil } // ClientConfigNoResolveEndpoint is the same as ClientConfig with the exception // that the EndpointResolver will not be used to resolve the endpoint. The only // endpoint set must come from the aws.Config.Endpoint field. func (s Session) ClientConfigNoResolveEndpoint(cfgs ...aws.Config) client.Config { s = s.Copy(cfgs...) resolvedRegion := normalizeRegion(s.Config) var resolved endpoints.ResolvedEndpoint if ep := aws.StringValue(s.Config.Endpoint); len(ep) > 0 { resolved.URL = endpoints.AddScheme(ep, aws.BoolValue(s.Config.DisableSSL)) resolved.SigningRegion = aws.StringValue(s.Config.Region) } return client.Config{ Config: s.Config, Handlers: s.Handlers, Endpoint: resolved.URL, SigningRegion: resolved.SigningRegion, SigningNameDerived: resolved.SigningNameDerived, SigningName: resolved.SigningName, ResolvedRegion: resolvedRegion, } } // logDeprecatedNewSessionError function enables error handling for session func (s Session) logDeprecatedNewSessionError(msg string, err error, cfgs []aws.Config) { // Session creation failed, need to report the error and prevent // any requests from succeeding. s.Config.MergeIn(cfgs...) s.Config.Logger.Log("ERROR:", msg, "Error:", err) s.Handlers.Validate.PushBack(func(r request.Request) { r.Error = err }) } // normalizeRegion resolves / normalizes the configured region (converts pseudo fips regions), and modifies the provided // config to have the equivalent options for resolution and returns the resolved region name. func normalizeRegion(cfg *aws.Config) (resolved string) { const fipsInfix = "-fips-" const fipsPrefix = "-fips" const fipsSuffix = "fips-" region := aws.StringValue(cfg.Region) if strings.Contains(region, fipsInfix) \|\| strings.Contains(region, fipsPrefix) \|\| strings.Contains(region, fipsSuffix) { resolved = strings.Replace(strings.Replace(strings.Replace( region, fipsInfix, "-", -1), fipsPrefix, "", -1), fipsSuffix, "", -1) cfg.UseFIPSEndpoint = endpoints.FIPSEndpointStateEnabled } return resolved }	33.48 KB	2025-05-25 12:27
📄 session_test.go //go:build go1.7 // +build go1.7 package session import ( "bytes" "fmt" "net/http" "os" "path/filepath" "reflect" "strconv" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/defaults" "github.com/aws/aws-sdk-go/aws/endpoints" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/s3" ) func TestNewDefaultSession(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() s := New(&aws.Config{Region: aws.String("region")}) if e, a := "region", s.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := http.DefaultClient, s.Config.HTTPClient; e != a { t.Errorf("expect %v, got %v", e, a) } if s.Config.Logger == nil { t.Errorf("expect not nil") } if e, a := aws.LogOff, s.Config.LogLevel; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestNew_WithCustomCreds(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() customCreds := credentials.NewStaticCredentials("AKID", "SECRET", "TOKEN") s := New(&aws.Config{Credentials: customCreds}) if e, a := customCreds, s.Config.Credentials; e != a { t.Errorf("expect %v, got %v", e, a) } } type mockLogger struct { bytes.Buffer } func (w mockLogger) Log(args ...interface{}) { fmt.Fprintln(w, args...) } func TestNew_WithSessionLoadError(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_CONFIG_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "assume_role_invalid_source_profile") logger := bytes.Buffer{} s := New(&aws.Config{ Region: aws.String("us-west-2"), Logger: &mockLogger{&logger}, }) if s == nil { t.Errorf("expect not nil") } svc := s3.New(s) _, err := svc.ListBuckets(&s3.ListBucketsInput{}) if err == nil { t.Errorf("expect not nil") } if e, a := "ERROR: failed to create session with AWS_SDK_LOAD_CONFIG enabled", logger.String(); !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } expectErr := SharedConfigAssumeRoleError{ RoleARN: "assume_role_invalid_source_profile_role_arn", SourceProfile: "profile_not_exists", } if e, a := expectErr.Error(), err.Error(); !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestSessionCopy(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_REGION", "orig_region") s := Session{ Config: defaults.Config(), Handlers: defaults.Handlers(), } newSess := s.Copy(&aws.Config{Region: aws.String("new_region")}) if e, a := "orig_region", s.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "new_region", newSess.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestSessionClientConfig(t testing.T) { s, err := NewSession(&aws.Config{ Credentials: credentials.AnonymousCredentials, Region: aws.String("orig_region"), EndpointResolver: endpoints.ResolverFunc( func(service, region string, opts ...func(endpoints.Options)) (endpoints.ResolvedEndpoint, error) { if e, a := "mock-service", service; e != a { t.Errorf("expect %q service, got %q", e, a) } if e, a := "other-region", region; e != a { t.Errorf("expect %q region, got %q", e, a) } return endpoints.ResolvedEndpoint{ URL: "https://" + service + "." + region + ".amazonaws.com", SigningRegion: region, }, nil }, ), }) if err != nil { t.Errorf("expect nil, %v", err) } cfg := s.ClientConfig("mock-service", &aws.Config{Region: aws.String("other-region")}) if e, a := "https://mock-service.other-region.amazonaws.com", cfg.Endpoint; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "other-region", cfg.SigningRegion; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "other-region", cfg.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestNewSession_ResolveEndpointError(t testing.T) { logger := mockLogger{Buffer: bytes.NewBuffer(nil)} sess, err := NewSession(defaults.Config(), &aws.Config{ Region: aws.String(""), Logger: logger, EndpointResolver: endpoints.ResolverFunc( func(service, region string, opts ...func(endpoints.Options)) (endpoints.ResolvedEndpoint, error) { return endpoints.ResolvedEndpoint{}, fmt.Errorf("mock error") }, ), }) if err != nil { t.Fatalf("expect no error got %v", err) } cfg := sess.ClientConfig("mock service") var r request.Request cfg.Handlers.Validate.Run(&r) if r.Error == nil { t.Fatalf("expect validation error, got none") } if e, a := aws.ErrMissingRegion.Error(), r.Error.Error(); !strings.Contains(a, e) { t.Errorf("expect %v validation error, got %v", e, a) } if v := logger.Buffer.String(); len(v) != 0 { t.Errorf("expect nothing logged, got %s", v) } } func TestNewSession_NoCredentials(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() s, err := NewSession() if err != nil { t.Errorf("expect nil, %v", err) } if s.Config.Credentials == nil { t.Errorf("expect not nil") } if e, a := credentials.AnonymousCredentials, s.Config.Credentials; e == a { t.Errorf("expect different credentials, %v", e) } } func TestNewSessionWithOptions_OverrideProfile(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "other_profile") s, err := NewSessionWithOptions(Options{ Profile: "full_profile", }) if err != nil { t.Errorf("expect nil, %v", err) } if e, a := "full_profile_region", s.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } creds, err := s.Config.Credentials.Get() if err != nil { t.Errorf("expect nil, %v", err) } if e, a := "full_profile_akid", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "full_profile_secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if e, a := "SharedConfigCredentials", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestNewSessionWithOptions_OverrideSharedConfigEnable(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_SDK_LOAD_CONFIG", "0") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "full_profile") s, err := NewSessionWithOptions(Options{ SharedConfigState: SharedConfigEnable, }) if err != nil { t.Errorf("expect nil, %v", err) } if e, a := "full_profile_region", s.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } creds, err := s.Config.Credentials.Get() if err != nil { t.Errorf("expect nil, %v", err) } if e, a := "full_profile_akid", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "full_profile_secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if e, a := "SharedConfigCredentials", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestNewSessionWithOptions_OverrideSharedConfigDisable(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "full_profile") s, err := NewSessionWithOptions(Options{ SharedConfigState: SharedConfigDisable, }) if err != nil { t.Errorf("expect nil, %v", err) } if v := s.Config.Region; len(v) != 0 { t.Errorf("expect empty, got %v", v) } creds, err := s.Config.Credentials.Get() if err != nil { t.Errorf("expect nil, %v", err) } if e, a := "full_profile_akid", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "full_profile_secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if e, a := "SharedConfigCredentials", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestNewSessionWithOptions_OverrideSharedConfigFiles(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() os.Setenv("AWS_SDK_LOAD_CONFIG", "1") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", testConfigFilename) os.Setenv("AWS_PROFILE", "config_file_load_order") s, err := NewSessionWithOptions(Options{ SharedConfigFiles: []string{testConfigOtherFilename}, }) if err != nil { t.Errorf("expect nil, %v", err) } if e, a := "shared_config_other_region", s.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } creds, err := s.Config.Credentials.Get() if err != nil { t.Errorf("expect nil, %v", err) } if e, a := "shared_config_other_akid", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "shared_config_other_secret", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if e, a := "SharedConfigCredentials", creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } } func TestNewSessionWithOptions_Overrides(t testing.T) { cases := map[string]struct { InEnvs map[string]string InProfile string OutRegion string OutCreds credentials.Value }{ "env profile with opt profile": { InEnvs: map[string]string{ "AWS_SDK_LOAD_CONFIG": "0", "AWS_SHARED_CREDENTIALS_FILE": testConfigFilename, "AWS_PROFILE": "other_profile", }, InProfile: "full_profile", OutRegion: "full_profile_region", OutCreds: credentials.Value{ AccessKeyID: "full_profile_akid", SecretAccessKey: "full_profile_secret", ProviderName: "SharedConfigCredentials", }, }, "env creds with env profile": { InEnvs: map[string]string{ "AWS_SDK_LOAD_CONFIG": "0", "AWS_SHARED_CREDENTIALS_FILE": testConfigFilename, "AWS_REGION": "env_region", "AWS_ACCESS_KEY": "env_akid", "AWS_SECRET_ACCESS_KEY": "env_secret", "AWS_PROFILE": "other_profile", }, OutRegion: "env_region", OutCreds: credentials.Value{ AccessKeyID: "env_akid", SecretAccessKey: "env_secret", ProviderName: "EnvConfigCredentials", }, }, "env creds with opt profile": { InEnvs: map[string]string{ "AWS_SDK_LOAD_CONFIG": "0", "AWS_SHARED_CREDENTIALS_FILE": testConfigFilename, "AWS_REGION": "env_region", "AWS_ACCESS_KEY": "env_akid", "AWS_SECRET_ACCESS_KEY": "env_secret", "AWS_PROFILE": "other_profile", }, InProfile: "full_profile", OutRegion: "env_region", OutCreds: credentials.Value{ AccessKeyID: "full_profile_akid", SecretAccessKey: "full_profile_secret", ProviderName: "SharedConfigCredentials", }, }, "cfg and cred file with opt profile": { InEnvs: map[string]string{ "AWS_SDK_LOAD_CONFIG": "0", "AWS_SHARED_CREDENTIALS_FILE": testConfigFilename, "AWS_CONFIG_FILE": testConfigOtherFilename, "AWS_PROFILE": "other_profile", }, InProfile: "config_file_load_order", OutRegion: "shared_config_region", OutCreds: credentials.Value{ AccessKeyID: "shared_config_akid", SecretAccessKey: "shared_config_secret", ProviderName: "SharedConfigCredentials", }, }, } for name, c := range cases { t.Run(name, func(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() for k, v := range c.InEnvs { os.Setenv(k, v) } s, err := NewSessionWithOptions(Options{ Profile: c.InProfile, SharedConfigState: SharedConfigEnable, }) if err != nil { t.Fatalf("expect no error, got %v", err) } creds, err := s.Config.Credentials.Get() if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := c.OutRegion, s.Config.Region; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := c.OutCreds.AccessKeyID, creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := c.OutCreds.SecretAccessKey, creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := c.OutCreds.SessionToken, creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := c.OutCreds.ProviderName, creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } }) } } func TestNewSession_EnvCredsWithInvalidConfigFile(t testing.T) { cases := map[string]struct { AccessKey, SecretKey string Profile string Options Options ExpectCreds credentials.Value Err string }{ "no options": { Err: "SharedConfigLoadError", }, "env only": { AccessKey: "env_akid", SecretKey: "env_secret", ExpectCreds: credentials.Value{ AccessKeyID: "env_akid", SecretAccessKey: "env_secret", ProviderName: "EnvConfigCredentials", }, }, "static credentials only": { Options: Options{ Config: aws.Config{ Credentials: credentials.NewStaticCredentials( "AKID", "SECRET", ""), }, }, ExpectCreds: credentials.Value{ AccessKeyID: "AKID", SecretAccessKey: "SECRET", ProviderName: "StaticProvider", }, }, "env profile and env": { AccessKey: "env_akid", SecretKey: "env_secret", Profile: "env_profile", Err: "SharedConfigLoadError", }, "opt profile and env": { AccessKey: "env_akid", SecretKey: "env_secret", Options: Options{ Profile: "someProfile", }, Err: "SharedConfigLoadError", }, "cfg enabled": { AccessKey: "env_akid", SecretKey: "env_secret", Options: Options{ SharedConfigState: SharedConfigEnable, }, Err: "SharedConfigLoadError", }, } var cfgFile = filepath.Join("testdata", "shared_config_invalid_ini") for name, c := range cases { t.Run(name, func(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() if v := c.AccessKey; len(v) != 0 { os.Setenv("AWS_ACCESS_KEY", v) } if v := c.SecretKey; len(v) != 0 { os.Setenv("AWS_SECRET_ACCESS_KEY", v) } if v := c.Profile; len(v) != 0 { os.Setenv("AWS_PROFILE", v) } opts := c.Options opts.SharedConfigFiles = []string{cfgFile} s, err := NewSessionWithOptions(opts) if len(c.Err) != 0 { if err == nil { t.Fatalf("expect session error, got none") } if e, a := c.Err, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect session error to contain %q, got %v", e, a) } return } if err != nil { t.Fatalf("expect no error, got %v", err) } creds, err := s.Config.Credentials.Get() if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := c.ExpectCreds.AccessKeyID, creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := c.ExpectCreds.SecretAccessKey, creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := c.ExpectCreds.ProviderName, creds.ProviderName; !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } }) } } func TestSession_RegionalEndpoints(t testing.T) { cases := map[string]struct { Env map[string]string Config aws.Config ExpectErr string ExpectSTS endpoints.STSRegionalEndpoint ExpectS3UsEast1 endpoints.S3UsEast1RegionalEndpoint }{ "default": { ExpectSTS: endpoints.LegacySTSEndpoint, ExpectS3UsEast1: endpoints.LegacyS3UsEast1Endpoint, }, "enable regional": { Config: aws.Config{ STSRegionalEndpoint: endpoints.RegionalSTSEndpoint, S3UsEast1RegionalEndpoint: endpoints.RegionalS3UsEast1Endpoint, }, ExpectSTS: endpoints.RegionalSTSEndpoint, ExpectS3UsEast1: endpoints.RegionalS3UsEast1Endpoint, }, "sts env enable": { Env: map[string]string{ "AWS_STS_REGIONAL_ENDPOINTS": "regional", }, ExpectSTS: endpoints.RegionalSTSEndpoint, ExpectS3UsEast1: endpoints.LegacyS3UsEast1Endpoint, }, "sts us-east-1 env merge enable": { Env: map[string]string{ "AWS_STS_REGIONAL_ENDPOINTS": "legacy", }, Config: aws.Config{ STSRegionalEndpoint: endpoints.RegionalSTSEndpoint, }, ExpectSTS: endpoints.RegionalSTSEndpoint, ExpectS3UsEast1: endpoints.LegacyS3UsEast1Endpoint, }, "s3 us-east-1 env enable": { Env: map[string]string{ "AWS_S3_US_EAST_1_REGIONAL_ENDPOINT": "regional", }, ExpectSTS: endpoints.LegacySTSEndpoint, ExpectS3UsEast1: endpoints.RegionalS3UsEast1Endpoint, }, "s3 us-east-1 env merge enable": { Env: map[string]string{ "AWS_S3_US_EAST_1_REGIONAL_ENDPOINT": "legacy", }, Config: aws.Config{ S3UsEast1RegionalEndpoint: endpoints.RegionalS3UsEast1Endpoint, }, ExpectSTS: endpoints.LegacySTSEndpoint, ExpectS3UsEast1: endpoints.RegionalS3UsEast1Endpoint, }, } for name, c := range cases { t.Run(name, func(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() for k, v := range c.Env { os.Setenv(k, v) } s, err := NewSession(&c.Config) if len(c.ExpectErr) != 0 { if err == nil { t.Fatalf("expect session error, got none") } if e, a := c.ExpectErr, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect session error to contain %q, got %v", e, a) } return } if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := c.ExpectSTS, s.Config.STSRegionalEndpoint; e != a { t.Errorf("expect %v STSRegionalEndpoint, got %v", e, a) } if e, a := c.ExpectS3UsEast1, s.Config.S3UsEast1RegionalEndpoint; e != a { t.Errorf("expect %v S3UsEast1RegionalEndpoint, got %v", e, a) } // Asserts }) } } func TestSession_ClientConfig_ResolveEndpoint(t testing.T) { cases := map[string]struct { Service string Region string Env map[string]string Options Options ExpectEndpoint string }{ "IMDS custom endpoint from env": { Service: ec2MetadataServiceID, Region: "ignored", Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT": "http://example.aws", }, ExpectEndpoint: "http://example.aws", }, "IMDS custom endpoint from aws.Config": { Service: ec2MetadataServiceID, Region: "ignored", Options: Options{ EC2IMDSEndpoint: "http://example.aws", }, ExpectEndpoint: "http://example.aws", }, "IMDS custom endpoint from aws.Config and env": { Service: ec2MetadataServiceID, Region: "ignored", Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT": "http://wrong.example.aws", }, Options: Options{ EC2IMDSEndpoint: "http://correct.example.aws", }, ExpectEndpoint: "http://correct.example.aws", }, "IMDS custom endpoint from profile": { Service: ec2MetadataServiceID, Options: Options{ SharedConfigState: SharedConfigEnable, SharedConfigFiles: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpoint", }, Region: "ignored", ExpectEndpoint: "http://endpoint.localhost", }, "IMDS custom endpoint from profile and env": { Service: ec2MetadataServiceID, Options: Options{ SharedConfigFiles: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpoint", }, Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT": "http://endpoint-env.localhost", }, Region: "ignored", ExpectEndpoint: "http://endpoint-env.localhost", }, "IMDS IPv6 mode from profile": { Service: ec2MetadataServiceID, Options: Options{ SharedConfigState: SharedConfigEnable, SharedConfigFiles: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointModeIPv6", }, Region: "ignored", ExpectEndpoint: "http://[fd00:ec2::254]/latest", }, "IMDS IPv4 mode from profile": { Service: ec2MetadataServiceID, Options: Options{ SharedConfigFiles: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointModeIPv4", }, Region: "ignored", ExpectEndpoint: "http://169.254.169.254/latest", }, "IMDS IPv6 mode in env": { Service: ec2MetadataServiceID, Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "IPv6", }, Region: "ignored", ExpectEndpoint: "http://[fd00:ec2::254]/latest", }, "IMDS IPv4 mode in env": { Service: ec2MetadataServiceID, Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "IPv4", }, Region: "ignored", ExpectEndpoint: "http://169.254.169.254/latest", }, "IMDS mode in env and profile": { Service: ec2MetadataServiceID, Options: Options{ SharedConfigFiles: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointModeIPv4", }, Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "IPv6", }, Region: "ignored", ExpectEndpoint: "http://[fd00:ec2::254]/latest", }, "IMDS mode and endpoint profile": { Service: ec2MetadataServiceID, Options: Options{ SharedConfigState: SharedConfigEnable, SharedConfigFiles: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointAndModeMixed", }, Region: "ignored", ExpectEndpoint: "http://endpoint.localhost", }, "IMDS mode session option and env": { Service: ec2MetadataServiceID, Options: Options{ EC2IMDSEndpointMode: endpoints.EC2IMDSEndpointModeStateIPv6, }, Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE": "IPv4", }, Region: "ignored", ExpectEndpoint: "http://[fd00:ec2::254]/latest", }, "IMDS endpoint session option and env": { Service: ec2MetadataServiceID, Options: Options{ EC2IMDSEndpoint: "http://endpoint.localhost", }, Env: map[string]string{ "AWS_EC2_METADATA_SERVICE_ENDPOINT": "http://endpoint-env.localhost", }, Region: "ignored", ExpectEndpoint: "http://endpoint.localhost", }, } for name, c := range cases { t.Run(name, func(t testing.T) { restoreEnvFn := initSessionTestEnv() defer restoreEnvFn() for k, v := range c.Env { os.Setenv(k, v) } s, err := NewSessionWithOptions(c.Options) if err != nil { t.Fatalf("expect no error, got %v", err) } clientCfg := s.ClientConfig(c.Service, &aws.Config{ Region: aws.String(c.Region), }) if e, a := c.ExpectEndpoint, clientCfg.Endpoint; e != a { t.Errorf("expect %v, got %v", e, a) } }) } } func TestNormalizeRegion(t testing.T) { cases := []struct { Config aws.Config ExpectedConfig aws.Config ExpectedResolvedRegion string }{ { Config: aws.Config{ Region: aws.String("us-west-2"), }, ExpectedConfig: aws.Config{ Region: aws.String("us-west-2"), }, ExpectedResolvedRegion: "", }, { Config: aws.Config{ Region: aws.String("us-west-2"), UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }, ExpectedConfig: aws.Config{ Region: aws.String("us-west-2"), UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }, ExpectedResolvedRegion: "", }, { Config: aws.Config{ Region: aws.String("fips-us-west-2"), UseFIPSEndpoint: endpoints.FIPSEndpointStateDisabled, }, ExpectedConfig: aws.Config{ Region: aws.String("fips-us-west-2"), UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }, ExpectedResolvedRegion: "us-west-2", }, { Config: aws.Config{ Region: aws.String("fips-us-west-2"), }, ExpectedConfig: aws.Config{ Region: aws.String("fips-us-west-2"), UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }, ExpectedResolvedRegion: "us-west-2", }, { Config: aws.Config{ Region: aws.String("us-west-2-fips"), }, ExpectedConfig: aws.Config{ Region: aws.String("us-west-2-fips"), UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }, ExpectedResolvedRegion: "us-west-2", }, { Config: aws.Config{ Region: aws.String("us-west-2-fips-thing"), }, ExpectedConfig: aws.Config{ Region: aws.String("us-west-2-fips-thing"), UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }, ExpectedResolvedRegion: "us-west-2-thing", }, } for i, tt := range cases { t.Run(strconv.Itoa(i), func(t testing.T) { resolved := normalizeRegion(&tt.Config) if !reflect.DeepEqual(tt.ExpectedConfig, tt.Config) { t.Errorf("expect %v, got %v", tt.ExpectedConfig, tt.Config) } if e, a := tt.ExpectedResolvedRegion, resolved; e != a { t.Errorf("expect %v, got %v", e, a) } }) } }	24.68 KB	2025-05-25 12:27
📄 shared_config.go package session import ( "fmt" "strings" "time" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/endpoints" "github.com/aws/aws-sdk-go/internal/ini" ) const ( // Static Credentials group accessKeyIDKey = `aws_access_key_id` // group required secretAccessKey = `aws_secret_access_key` // group required sessionTokenKey = `aws_session_token` // optional // Assume Role Credentials group roleArnKey = `role_arn` // group required sourceProfileKey = `source_profile` // group required (or credential_source) credentialSourceKey = `credential_source` // group required (or source_profile) externalIDKey = `external_id` // optional mfaSerialKey = `mfa_serial` // optional roleSessionNameKey = `role_session_name` // optional roleDurationSecondsKey = "duration_seconds" // optional // Prefix to be used for SSO sections. These are supposed to only exist in // the shared config file, not the credentials file. ssoSectionPrefix = `sso-session ` // AWS Single Sign-On (AWS SSO) group ssoSessionNameKey = "sso_session" // AWS Single Sign-On (AWS SSO) group ssoAccountIDKey = "sso_account_id" ssoRegionKey = "sso_region" ssoRoleNameKey = "sso_role_name" ssoStartURL = "sso_start_url" // CSM options csmEnabledKey = `csm_enabled` csmHostKey = `csm_host` csmPortKey = `csm_port` csmClientIDKey = `csm_client_id` // Additional Config fields regionKey = `region` // custom CA Bundle filename customCABundleKey = `ca_bundle` // endpoint discovery group enableEndpointDiscoveryKey = `endpoint_discovery_enabled` // optional // External Credential Process credentialProcessKey = `credential_process` // optional // Web Identity Token File webIdentityTokenFileKey = `web_identity_token_file` // optional // Additional config fields for regional or legacy endpoints stsRegionalEndpointSharedKey = `sts_regional_endpoints` // Additional config fields for regional or legacy endpoints s3UsEast1RegionalSharedKey = `s3_us_east_1_regional_endpoint` // DefaultSharedConfigProfile is the default profile to be used when // loading configuration from the config files if another profile name // is not provided. DefaultSharedConfigProfile = `default` // S3 ARN Region Usage s3UseARNRegionKey = "s3_use_arn_region" // EC2 IMDS Endpoint Mode ec2MetadataServiceEndpointModeKey = "ec2_metadata_service_endpoint_mode" // EC2 IMDS Endpoint ec2MetadataServiceEndpointKey = "ec2_metadata_service_endpoint" // ECS IMDSv1 disable fallback ec2MetadataV1DisabledKey = "ec2_metadata_v1_disabled" // Use DualStack Endpoint Resolution useDualStackEndpoint = "use_dualstack_endpoint" // Use FIPS Endpoint Resolution useFIPSEndpointKey = "use_fips_endpoint" ) // sharedConfig represents the configuration fields of the SDK config files. type sharedConfig struct { Profile string // Credentials values from the config file. Both aws_access_key_id and // aws_secret_access_key must be provided together in the same file to be // considered valid. The values will be ignored if not a complete group. // aws_session_token is an optional field that can be provided if both of // the other two fields are also provided. // // aws_access_key_id // aws_secret_access_key // aws_session_token Creds credentials.Value CredentialSource string CredentialProcess string WebIdentityTokenFile string // SSO session options SSOSessionName string SSOSession ssoSession SSOAccountID string SSORegion string SSORoleName string SSOStartURL string RoleARN string RoleSessionName string ExternalID string MFASerial string AssumeRoleDuration time.Duration SourceProfileName string SourceProfile sharedConfig // Region is the region the SDK should use for looking up AWS service // endpoints and signing requests. // // region Region string // CustomCABundle is the file path to a PEM file the SDK will read and // use to configure the HTTP transport with additional CA certs that are // not present in the platforms default CA store. // // This value will be ignored if the file does not exist. // // ca_bundle CustomCABundle string // EnableEndpointDiscovery can be enabled in the shared config by setting // endpoint_discovery_enabled to true // // endpoint_discovery_enabled = true EnableEndpointDiscovery bool // CSM Options CSMEnabled bool CSMHost string CSMPort string CSMClientID string // Specifies the Regional Endpoint flag for the SDK to resolve the endpoint for a service // // sts_regional_endpoints = regional // This can take value as `LegacySTSEndpoint` or `RegionalSTSEndpoint` STSRegionalEndpoint endpoints.STSRegionalEndpoint // Specifies the Regional Endpoint flag for the SDK to resolve the endpoint for a service // // s3_us_east_1_regional_endpoint = regional // This can take value as `LegacyS3UsEast1Endpoint` or `RegionalS3UsEast1Endpoint` S3UsEast1RegionalEndpoint endpoints.S3UsEast1RegionalEndpoint // Specifies if the S3 service should allow ARNs to direct the region // the client's requests are sent to. // // s3_use_arn_region=true S3UseARNRegion bool // Specifies the EC2 Instance Metadata Service default endpoint selection mode (IPv4 or IPv6) // // ec2_metadata_service_endpoint_mode=IPv6 EC2IMDSEndpointMode endpoints.EC2IMDSEndpointModeState // Specifies the EC2 Instance Metadata Service endpoint to use. If specified it overrides EC2IMDSEndpointMode. // // ec2_metadata_service_endpoint=http://fd00:ec2::254 EC2IMDSEndpoint string // Specifies that IMDS clients should not fallback to IMDSv1 if token // requests fail. // // ec2_metadata_v1_disabled=true EC2IMDSv1Disabled bool // Specifies that SDK clients must resolve a dual-stack endpoint for // services. // // use_dualstack_endpoint=true UseDualStackEndpoint endpoints.DualStackEndpointState // Specifies that SDK clients must resolve a FIPS endpoint for // services. // // use_fips_endpoint=true UseFIPSEndpoint endpoints.FIPSEndpointState } type sharedConfigFile struct { Filename string IniData ini.Sections } // SSOSession provides the shared configuration parameters of the sso-session // section. type ssoSession struct { Name string SSORegion string SSOStartURL string } func (s ssoSession) setFromIniSection(section ini.Section) { updateString(&s.Name, section, ssoSessionNameKey) updateString(&s.SSORegion, section, ssoRegionKey) updateString(&s.SSOStartURL, section, ssoStartURL) } // loadSharedConfig retrieves the configuration from the list of files using // the profile provided. The order the files are listed will determine // precedence. Values in subsequent files will overwrite values defined in // earlier files. // // For example, given two files A and B. Both define credentials. If the order // of the files are A then B, B's credential values will be used instead of // A's. // // See sharedConfig.setFromFile for information how the config files // will be loaded. func loadSharedConfig(profile string, filenames []string, exOpts bool) (sharedConfig, error) { if len(profile) == 0 { profile = DefaultSharedConfigProfile } files, err := loadSharedConfigIniFiles(filenames) if err != nil { return sharedConfig{}, err } cfg := sharedConfig{} profiles := map[string]struct{}{} if err = cfg.setFromIniFiles(profiles, profile, files, exOpts); err != nil { return sharedConfig{}, err } return cfg, nil } func loadSharedConfigIniFiles(filenames []string) ([]sharedConfigFile, error) { files := make([]sharedConfigFile, 0, len(filenames)) for _, filename := range filenames { sections, err := ini.OpenFile(filename) if aerr, ok := err.(awserr.Error); ok && aerr.Code() == ini.ErrCodeUnableToReadFile { // Skip files which can't be opened and read for whatever reason continue } else if err != nil { return nil, SharedConfigLoadError{Filename: filename, Err: err} } files = append(files, sharedConfigFile{ Filename: filename, IniData: sections, }) } return files, nil } func (cfg sharedConfig) setFromIniFiles(profiles map[string]struct{}, profile string, files []sharedConfigFile, exOpts bool) error { cfg.Profile = profile // Trim files from the list that don't exist. var skippedFiles int var profileNotFoundErr error for _, f := range files { if err := cfg.setFromIniFile(profile, f, exOpts); err != nil { if _, ok := err.(SharedConfigProfileNotExistsError); ok { // Ignore profiles not defined in individual files. profileNotFoundErr = err skippedFiles++ continue } return err } } if skippedFiles == len(files) { // If all files were skipped because the profile is not found, return // the original profile not found error. return profileNotFoundErr } if _, ok := profiles[profile]; ok { // if this is the second instance of the profile the Assume Role // options must be cleared because they are only valid for the // first reference of a profile. The self linked instance of the // profile only have credential provider options. cfg.clearAssumeRoleOptions() } else { // First time a profile has been seen. Assert if the credential type // requires a role ARN, the ARN is also set if err := cfg.validateCredentialsConfig(profile); err != nil { return err } } profiles[profile] = struct{}{} if err := cfg.validateCredentialType(); err != nil { return err } // Link source profiles for assume roles if len(cfg.SourceProfileName) != 0 { // Linked profile via source_profile ignore credential provider // options, the source profile must provide the credentials. cfg.clearCredentialOptions() srcCfg := &sharedConfig{} err := srcCfg.setFromIniFiles(profiles, cfg.SourceProfileName, files, exOpts) if err != nil { // SourceProfile that doesn't exist is an error in configuration. if _, ok := err.(SharedConfigProfileNotExistsError); ok { err = SharedConfigAssumeRoleError{ RoleARN: cfg.RoleARN, SourceProfile: cfg.SourceProfileName, } } return err } if !srcCfg.hasCredentials() { return SharedConfigAssumeRoleError{ RoleARN: cfg.RoleARN, SourceProfile: cfg.SourceProfileName, } } cfg.SourceProfile = srcCfg } // If the profile contains an SSO session parameter, the session MUST exist // as a section in the config file. Load the SSO session using the name // provided. If the session section is not found or incomplete an error // will be returned. if cfg.hasSSOTokenProviderConfiguration() { skippedFiles = 0 for _, f := range files { section, ok := f.IniData.GetSection(fmt.Sprintf(ssoSectionPrefix + strings.TrimSpace(cfg.SSOSessionName))) if ok { var ssoSession ssoSession ssoSession.setFromIniSection(section) ssoSession.Name = cfg.SSOSessionName cfg.SSOSession = &ssoSession break } skippedFiles++ } if skippedFiles == len(files) { // If all files were skipped because the sso session section is not found, return // the sso section not found error. return fmt.Errorf("failed to find SSO session section, %v", cfg.SSOSessionName) } } return nil } // setFromFile loads the configuration from the file using the profile // provided. A sharedConfig pointer type value is used so that multiple config // file loadings can be chained. // // Only loads complete logically grouped values, and will not set fields in cfg // for incomplete grouped values in the config. Such as credentials. For // example if a config file only includes aws_access_key_id but no // aws_secret_access_key the aws_access_key_id will be ignored. func (cfg sharedConfig) setFromIniFile(profile string, file sharedConfigFile, exOpts bool) error { section, ok := file.IniData.GetSection(profile) if !ok { // Fallback to to alternate profile name: profile <name> section, ok = file.IniData.GetSection(fmt.Sprintf("profile %s", profile)) if !ok { return SharedConfigProfileNotExistsError{Profile: profile, Err: nil} } } if exOpts { // Assume Role Parameters updateString(&cfg.RoleARN, section, roleArnKey) updateString(&cfg.ExternalID, section, externalIDKey) updateString(&cfg.MFASerial, section, mfaSerialKey) updateString(&cfg.RoleSessionName, section, roleSessionNameKey) updateString(&cfg.SourceProfileName, section, sourceProfileKey) updateString(&cfg.CredentialSource, section, credentialSourceKey) updateString(&cfg.Region, section, regionKey) updateString(&cfg.CustomCABundle, section, customCABundleKey) // we're retaining a behavioral quirk with this field that existed before // the removal of literal parsing for (aws-sdk-go-v2/#2276): // - if the key is missing, the config field will not be set // - if the key is set to a non-numeric, the config field will be set to 0 if section.Has(roleDurationSecondsKey) { var d time.Duration if v, ok := section.Int(roleDurationSecondsKey); ok { d = time.Duration(v) time.Second } cfg.AssumeRoleDuration = &d } if v := section.String(stsRegionalEndpointSharedKey); len(v) != 0 { sre, err := endpoints.GetSTSRegionalEndpoint(v) if err != nil { return fmt.Errorf("failed to load %s from shared config, %s, %v", stsRegionalEndpointSharedKey, file.Filename, err) } cfg.STSRegionalEndpoint = sre } if v := section.String(s3UsEast1RegionalSharedKey); len(v) != 0 { sre, err := endpoints.GetS3UsEast1RegionalEndpoint(v) if err != nil { return fmt.Errorf("failed to load %s from shared config, %s, %v", s3UsEast1RegionalSharedKey, file.Filename, err) } cfg.S3UsEast1RegionalEndpoint = sre } // AWS Single Sign-On (AWS SSO) // SSO session options updateString(&cfg.SSOSessionName, section, ssoSessionNameKey) // AWS Single Sign-On (AWS SSO) updateString(&cfg.SSOAccountID, section, ssoAccountIDKey) updateString(&cfg.SSORegion, section, ssoRegionKey) updateString(&cfg.SSORoleName, section, ssoRoleNameKey) updateString(&cfg.SSOStartURL, section, ssoStartURL) if err := updateEC2MetadataServiceEndpointMode(&cfg.EC2IMDSEndpointMode, section, ec2MetadataServiceEndpointModeKey); err != nil { return fmt.Errorf("failed to load %s from shared config, %s, %v", ec2MetadataServiceEndpointModeKey, file.Filename, err) } updateString(&cfg.EC2IMDSEndpoint, section, ec2MetadataServiceEndpointKey) updateBoolPtr(&cfg.EC2IMDSv1Disabled, section, ec2MetadataV1DisabledKey) updateUseDualStackEndpoint(&cfg.UseDualStackEndpoint, section, useDualStackEndpoint) updateUseFIPSEndpoint(&cfg.UseFIPSEndpoint, section, useFIPSEndpointKey) } updateString(&cfg.CredentialProcess, section, credentialProcessKey) updateString(&cfg.WebIdentityTokenFile, section, webIdentityTokenFileKey) // Shared Credentials creds := credentials.Value{ AccessKeyID: section.String(accessKeyIDKey), SecretAccessKey: section.String(secretAccessKey), SessionToken: section.String(sessionTokenKey), ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", file.Filename), } if creds.HasKeys() { cfg.Creds = creds } // Endpoint discovery updateBoolPtr(&cfg.EnableEndpointDiscovery, section, enableEndpointDiscoveryKey) // CSM options updateBoolPtr(&cfg.CSMEnabled, section, csmEnabledKey) updateString(&cfg.CSMHost, section, csmHostKey) updateString(&cfg.CSMPort, section, csmPortKey) updateString(&cfg.CSMClientID, section, csmClientIDKey) updateBool(&cfg.S3UseARNRegion, section, s3UseARNRegionKey) return nil } func updateEC2MetadataServiceEndpointMode(endpointMode endpoints.EC2IMDSEndpointModeState, section ini.Section, key string) error { if !section.Has(key) { return nil } value := section.String(key) return endpointMode.SetFromString(value) } func (cfg sharedConfig) validateCredentialsConfig(profile string) error { if err := cfg.validateCredentialsRequireARN(profile); err != nil { return err } return nil } func (cfg sharedConfig) validateCredentialsRequireARN(profile string) error { var credSource string switch { case len(cfg.SourceProfileName) != 0: credSource = sourceProfileKey case len(cfg.CredentialSource) != 0: credSource = credentialSourceKey case len(cfg.WebIdentityTokenFile) != 0: credSource = webIdentityTokenFileKey } if len(credSource) != 0 && len(cfg.RoleARN) == 0 { return CredentialRequiresARNError{ Type: credSource, Profile: profile, } } return nil } func (cfg sharedConfig) validateCredentialType() error { // Only one or no credential type can be defined. if !oneOrNone( len(cfg.SourceProfileName) != 0, len(cfg.CredentialSource) != 0, len(cfg.CredentialProcess) != 0, len(cfg.WebIdentityTokenFile) != 0, ) { return ErrSharedConfigSourceCollision } return nil } func (cfg sharedConfig) validateSSOConfiguration() error { if cfg.hasSSOTokenProviderConfiguration() { err := cfg.validateSSOTokenProviderConfiguration() if err != nil { return err } return nil } if cfg.hasLegacySSOConfiguration() { err := cfg.validateLegacySSOConfiguration() if err != nil { return err } } return nil } func (cfg sharedConfig) hasCredentials() bool { switch { case len(cfg.SourceProfileName) != 0: case len(cfg.CredentialSource) != 0: case len(cfg.CredentialProcess) != 0: case len(cfg.WebIdentityTokenFile) != 0: case cfg.hasSSOConfiguration(): case cfg.Creds.HasKeys(): default: return false } return true } func (cfg sharedConfig) clearCredentialOptions() { cfg.CredentialSource = "" cfg.CredentialProcess = "" cfg.WebIdentityTokenFile = "" cfg.Creds = credentials.Value{} cfg.SSOAccountID = "" cfg.SSORegion = "" cfg.SSORoleName = "" cfg.SSOStartURL = "" } func (cfg sharedConfig) clearAssumeRoleOptions() { cfg.RoleARN = "" cfg.ExternalID = "" cfg.MFASerial = "" cfg.RoleSessionName = "" cfg.SourceProfileName = "" } func (cfg sharedConfig) hasSSOConfiguration() bool { return cfg.hasSSOTokenProviderConfiguration() \|\| cfg.hasLegacySSOConfiguration() } func (c sharedConfig) hasSSOTokenProviderConfiguration() bool { return len(c.SSOSessionName) > 0 } func (c sharedConfig) hasLegacySSOConfiguration() bool { return len(c.SSORegion) > 0 \|\| len(c.SSOAccountID) > 0 \|\| len(c.SSOStartURL) > 0 \|\| len(c.SSORoleName) > 0 } func (c sharedConfig) validateSSOTokenProviderConfiguration() error { var missing []string if len(c.SSOSessionName) == 0 { missing = append(missing, ssoSessionNameKey) } if c.SSOSession == nil { missing = append(missing, ssoSectionPrefix) } else { if len(c.SSOSession.SSORegion) == 0 { missing = append(missing, ssoRegionKey) } if len(c.SSOSession.SSOStartURL) == 0 { missing = append(missing, ssoStartURL) } } if len(missing) > 0 { return fmt.Errorf("profile %q is configured to use SSO but is missing required configuration: %s", c.Profile, strings.Join(missing, ", ")) } if len(c.SSORegion) > 0 && c.SSORegion != c.SSOSession.SSORegion { return fmt.Errorf("%s in profile %q must match %s in %s", ssoRegionKey, c.Profile, ssoRegionKey, ssoSectionPrefix) } if len(c.SSOStartURL) > 0 && c.SSOStartURL != c.SSOSession.SSOStartURL { return fmt.Errorf("%s in profile %q must match %s in %s", ssoStartURL, c.Profile, ssoStartURL, ssoSectionPrefix) } return nil } func (c sharedConfig) validateLegacySSOConfiguration() error { var missing []string if len(c.SSORegion) == 0 { missing = append(missing, ssoRegionKey) } if len(c.SSOStartURL) == 0 { missing = append(missing, ssoStartURL) } if len(c.SSOAccountID) == 0 { missing = append(missing, ssoAccountIDKey) } if len(c.SSORoleName) == 0 { missing = append(missing, ssoRoleNameKey) } if len(missing) > 0 { return fmt.Errorf("profile %q is configured to use SSO but is missing required configuration: %s", c.Profile, strings.Join(missing, ", ")) } return nil } func oneOrNone(bs ...bool) bool { var count int for _, b := range bs { if b { count++ if count > 1 { return false } } } return true } // updateString will only update the dst with the value in the section key, key // is present in the section. func updateString(dst string, section ini.Section, key string) { if !section.Has(key) { return } dst = section.String(key) } // updateBool will only update the dst with the value in the section key, key // is present in the section. func updateBool(dst bool, section ini.Section, key string) { if !section.Has(key) { return } // retains pre-(aws-sdk-go-v2#2276) behavior where non-bool value would resolve to false v, _ := section.Bool(key) dst = v } // updateBoolPtr will only update the dst with the value in the section key, // key is present in the section. func updateBoolPtr(dst bool, section ini.Section, key string) { if !section.Has(key) { return } // retains pre-(aws-sdk-go-v2#2276) behavior where non-bool value would resolve to false v, _ := section.Bool(key) dst = new(bool) *dst = v } // SharedConfigLoadError is an error for the shared config file failed to load. type SharedConfigLoadError struct { Filename string Err error } // Code is the short id of the error. func (e SharedConfigLoadError) Code() string { return "SharedConfigLoadError" } // Message is the description of the error func (e SharedConfigLoadError) Message() string { return fmt.Sprintf("failed to load config file, %s", e.Filename) } // OrigErr is the underlying error that caused the failure. func (e SharedConfigLoadError) OrigErr() error { return e.Err } // Error satisfies the error interface. func (e SharedConfigLoadError) Error() string { return awserr.SprintError(e.Code(), e.Message(), "", e.Err) } // SharedConfigProfileNotExistsError is an error for the shared config when // the profile was not find in the config file. type SharedConfigProfileNotExistsError struct { Profile string Err error } // Code is the short id of the error. func (e SharedConfigProfileNotExistsError) Code() string { return "SharedConfigProfileNotExistsError" } // Message is the description of the error func (e SharedConfigProfileNotExistsError) Message() string { return fmt.Sprintf("failed to get profile, %s", e.Profile) } // OrigErr is the underlying error that caused the failure. func (e SharedConfigProfileNotExistsError) OrigErr() error { return e.Err } // Error satisfies the error interface. func (e SharedConfigProfileNotExistsError) Error() string { return awserr.SprintError(e.Code(), e.Message(), "", e.Err) } // SharedConfigAssumeRoleError is an error for the shared config when the // profile contains assume role information, but that information is invalid // or not complete. type SharedConfigAssumeRoleError struct { RoleARN string SourceProfile string } // Code is the short id of the error. func (e SharedConfigAssumeRoleError) Code() string { return "SharedConfigAssumeRoleError" } // Message is the description of the error func (e SharedConfigAssumeRoleError) Message() string { return fmt.Sprintf( "failed to load assume role for %s, source profile %s has no shared credentials", e.RoleARN, e.SourceProfile, ) } // OrigErr is the underlying error that caused the failure. func (e SharedConfigAssumeRoleError) OrigErr() error { return nil } // Error satisfies the error interface. func (e SharedConfigAssumeRoleError) Error() string { return awserr.SprintError(e.Code(), e.Message(), "", nil) } // CredentialRequiresARNError provides the error for shared config credentials // that are incorrectly configured in the shared config or credentials file. type CredentialRequiresARNError struct { // type of credentials that were configured. Type string // Profile name the credentials were in. Profile string } // Code is the short id of the error. func (e CredentialRequiresARNError) Code() string { return "CredentialRequiresARNError" } // Message is the description of the error func (e CredentialRequiresARNError) Message() string { return fmt.Sprintf( "credential type %s requires role_arn, profile %s", e.Type, e.Profile, ) } // OrigErr is the underlying error that caused the failure. func (e CredentialRequiresARNError) OrigErr() error { return nil } // Error satisfies the error interface. func (e CredentialRequiresARNError) Error() string { return awserr.SprintError(e.Code(), e.Message(), "", nil) } // updateEndpointDiscoveryType will only update the dst with the value in the section, if // a valid key and corresponding EndpointDiscoveryType is found. func updateUseDualStackEndpoint(dst endpoints.DualStackEndpointState, section ini.Section, key string) { if !section.Has(key) { return } // retains pre-(aws-sdk-go-v2/#2276) behavior where non-bool value would resolve to false if v, _ := section.Bool(key); v { dst = endpoints.DualStackEndpointStateEnabled } else { dst = endpoints.DualStackEndpointStateDisabled } return } // updateEndpointDiscoveryType will only update the dst with the value in the section, if // a valid key and corresponding EndpointDiscoveryType is found. func updateUseFIPSEndpoint(dst endpoints.FIPSEndpointState, section ini.Section, key string) { if !section.Has(key) { return } // retains pre-(aws-sdk-go-v2/#2276) behavior where non-bool value would resolve to false if v, _ := section.Bool(key); v { dst = endpoints.FIPSEndpointStateEnabled } else { *dst = endpoints.FIPSEndpointStateDisabled } return }	24.96 KB	2025-05-25 12:27
📄 shared_config_test.go //go:build go1.7 // +build go1.7 package session import ( "fmt" "path/filepath" "reflect" "strconv" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/endpoints" "github.com/aws/aws-sdk-go/internal/ini" ) var ( testConfigFilename = filepath.Join("testdata", "shared_config") testConfigOtherFilename = filepath.Join("testdata", "shared_config_other") ) func TestLoadSharedConfig(t testing.T) { cases := []struct { Filenames []string Profile string Expected sharedConfig Err error }{ { Filenames: []string{"file_not_exists"}, Profile: "default", Expected: sharedConfig{ Profile: "default", }, }, { Filenames: []string{testConfigFilename}, Expected: sharedConfig{ Profile: "default", Region: "default_region", }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "config_file_load_order", Expected: sharedConfig{ Profile: "config_file_load_order", Region: "shared_config_region", Creds: credentials.Value{ AccessKeyID: "shared_config_akid", SecretAccessKey: "shared_config_secret", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, }, }, { Filenames: []string{testConfigFilename, testConfigOtherFilename}, Profile: "config_file_load_order", Expected: sharedConfig{ Profile: "config_file_load_order", Region: "shared_config_other_region", Creds: credentials.Value{ AccessKeyID: "shared_config_other_akid", SecretAccessKey: "shared_config_other_secret", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigOtherFilename), }, }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "assume_role", Expected: sharedConfig{ Profile: "assume_role", RoleARN: "assume_role_role_arn", SourceProfileName: "complete_creds", SourceProfile: &sharedConfig{ Profile: "complete_creds", Creds: credentials.Value{ AccessKeyID: "complete_creds_akid", SecretAccessKey: "complete_creds_secret", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, }, }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "assume_role_invalid_source_profile", Expected: sharedConfig{ Profile: "assume_role_invalid_source_profile", RoleARN: "assume_role_invalid_source_profile_role_arn", SourceProfileName: "profile_not_exists", }, Err: SharedConfigAssumeRoleError{ RoleARN: "assume_role_invalid_source_profile_role_arn", SourceProfile: "profile_not_exists", }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "assume_role_w_creds", Expected: sharedConfig{ Profile: "assume_role_w_creds", RoleARN: "assume_role_w_creds_role_arn", ExternalID: "1234", RoleSessionName: "assume_role_w_creds_session_name", SourceProfileName: "assume_role_w_creds", SourceProfile: &sharedConfig{ Profile: "assume_role_w_creds", Creds: credentials.Value{ AccessKeyID: "assume_role_w_creds_akid", SecretAccessKey: "assume_role_w_creds_secret", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, }, }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "assume_role_wo_creds", Expected: sharedConfig{ Profile: "assume_role_wo_creds", RoleARN: "assume_role_wo_creds_role_arn", SourceProfileName: "assume_role_wo_creds", }, Err: SharedConfigAssumeRoleError{ RoleARN: "assume_role_wo_creds_role_arn", SourceProfile: "assume_role_wo_creds", }, }, { Filenames: []string{filepath.Join("testdata", "shared_config_invalid_ini")}, Profile: "profile_name", Err: SharedConfigLoadError{Filename: filepath.Join("testdata", "shared_config_invalid_ini")}, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "assume_role_with_credential_source", Expected: sharedConfig{ Profile: "assume_role_with_credential_source", RoleARN: "assume_role_with_credential_source_role_arn", CredentialSource: credSourceEc2Metadata, }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "multiple_assume_role", Expected: sharedConfig{ Profile: "multiple_assume_role", RoleARN: "multiple_assume_role_role_arn", SourceProfileName: "assume_role", SourceProfile: &sharedConfig{ Profile: "assume_role", RoleARN: "assume_role_role_arn", SourceProfileName: "complete_creds", SourceProfile: &sharedConfig{ Profile: "complete_creds", Creds: credentials.Value{ AccessKeyID: "complete_creds_akid", SecretAccessKey: "complete_creds_secret", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, }, }, }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "multiple_assume_role_with_credential_source", Expected: sharedConfig{ Profile: "multiple_assume_role_with_credential_source", RoleARN: "multiple_assume_role_with_credential_source_role_arn", SourceProfileName: "assume_role_with_credential_source", SourceProfile: &sharedConfig{ Profile: "assume_role_with_credential_source", RoleARN: "assume_role_with_credential_source_role_arn", CredentialSource: credSourceEc2Metadata, }, }, }, { Filenames: []string{testConfigOtherFilename, testConfigFilename}, Profile: "multiple_assume_role_with_credential_source2", Expected: sharedConfig{ Profile: "multiple_assume_role_with_credential_source2", RoleARN: "multiple_assume_role_with_credential_source2_role_arn", SourceProfileName: "multiple_assume_role_with_credential_source", SourceProfile: &sharedConfig{ Profile: "multiple_assume_role_with_credential_source", RoleARN: "multiple_assume_role_with_credential_source_role_arn", SourceProfileName: "assume_role_with_credential_source", SourceProfile: &sharedConfig{ Profile: "assume_role_with_credential_source", RoleARN: "assume_role_with_credential_source_role_arn", CredentialSource: credSourceEc2Metadata, }, }, }, }, { Filenames: []string{testConfigFilename}, Profile: "with_sts_regional", Expected: sharedConfig{ Profile: "with_sts_regional", STSRegionalEndpoint: endpoints.RegionalSTSEndpoint, }, }, { Filenames: []string{testConfigFilename}, Profile: "with_s3_us_east_1_regional", Expected: sharedConfig{ Profile: "with_s3_us_east_1_regional", S3UsEast1RegionalEndpoint: endpoints.RegionalS3UsEast1Endpoint, }, }, { Filenames: []string{testConfigFilename}, Profile: "sso_creds", Expected: sharedConfig{ Profile: "sso_creds", SSOAccountID: "012345678901", SSORegion: "us-west-2", SSORoleName: "TestRole", SSOStartURL: "https://127.0.0.1/start", }, }, { Filenames: []string{testConfigFilename}, Profile: "source_sso_creds", Expected: sharedConfig{ Profile: "source_sso_creds", RoleARN: "source_sso_creds_arn", SourceProfileName: "sso_creds", SourceProfile: &sharedConfig{ Profile: "sso_creds", SSOAccountID: "012345678901", SSORegion: "us-west-2", SSORoleName: "TestRole", SSOStartURL: "https://127.0.0.1/start", }, }, }, { Filenames: []string{testConfigFilename}, Profile: "sso_and_static", Expected: sharedConfig{ Profile: "sso_and_static", Creds: credentials.Value{ AccessKeyID: "sso_and_static_akid", SecretAccessKey: "sso_and_static_secret", SessionToken: "sso_and_static_token", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, SSOAccountID: "012345678901", SSORegion: "us-west-2", SSORoleName: "TestRole", SSOStartURL: "https://THIS_SHOULD_NOT_BE_IN_TESTDATA_CACHE/start", }, }, { Filenames: []string{testConfigFilename}, Profile: "source_sso_and_assume", Expected: sharedConfig{ Profile: "source_sso_and_assume", RoleARN: "source_sso_and_assume_arn", SourceProfileName: "sso_and_assume", SourceProfile: &sharedConfig{ Profile: "sso_and_assume", RoleARN: "sso_with_assume_role_arn", SourceProfileName: "multiple_assume_role_with_credential_source", SourceProfile: &sharedConfig{ Profile: "multiple_assume_role_with_credential_source", RoleARN: "multiple_assume_role_with_credential_source_role_arn", SourceProfileName: "assume_role_with_credential_source", SourceProfile: &sharedConfig{ Profile: "assume_role_with_credential_source", RoleARN: "assume_role_with_credential_source_role_arn", CredentialSource: credSourceEc2Metadata, }, }, }, }, }, { Filenames: []string{testConfigFilename}, Profile: "sso_mixed_credproc", Expected: sharedConfig{ Profile: "sso_mixed_credproc", SSOAccountID: "012345678901", SSORegion: "us-west-2", SSORoleName: "TestRole", SSOStartURL: "https://127.0.0.1/start", CredentialProcess: "/path/to/process", }, }, { Filenames: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpoint", Expected: sharedConfig{ Profile: "EC2MetadataServiceEndpoint", EC2IMDSEndpoint: "http://endpoint.localhost", }, }, { Filenames: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointModeIPv6", Expected: sharedConfig{ Profile: "EC2MetadataServiceEndpointModeIPv6", EC2IMDSEndpointMode: endpoints.EC2IMDSEndpointModeStateIPv6, }, }, { Filenames: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointModeIPv4", Expected: sharedConfig{ Profile: "EC2MetadataServiceEndpointModeIPv4", EC2IMDSEndpointMode: endpoints.EC2IMDSEndpointModeStateIPv4, }, }, { Filenames: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointModeUnknown", Expected: sharedConfig{ Profile: "EC2MetadataServiceEndpointModeUnknown", }, Err: fmt.Errorf("failed to load ec2_metadata_service_endpoint_mode from shared config"), }, { Filenames: []string{testConfigFilename}, Profile: "EC2MetadataServiceEndpointAndModeMixed", Expected: sharedConfig{ Profile: "EC2MetadataServiceEndpointAndModeMixed", EC2IMDSEndpoint: "http://endpoint.localhost", EC2IMDSEndpointMode: endpoints.EC2IMDSEndpointModeStateIPv6, }, }, { Filenames: []string{testConfigFilename}, Profile: "UseDualStackEndpointEnabled", Expected: sharedConfig{ Profile: "UseDualStackEndpointEnabled", Region: "us-west-2", UseDualStackEndpoint: endpoints.DualStackEndpointStateEnabled, }, }, { Filenames: []string{testConfigFilename}, Profile: "UseDualStackEndpointDisabled", Expected: sharedConfig{ Profile: "UseDualStackEndpointDisabled", Region: "us-west-2", UseDualStackEndpoint: endpoints.DualStackEndpointStateDisabled, }, }, { Filenames: []string{testConfigFilename}, Profile: "UseDualStackEndpointInvalid", Expected: sharedConfig{ Profile: "UseDualStackEndpointInvalid", Region: "us-west-2", UseDualStackEndpoint: endpoints.DualStackEndpointStateDisabled, }, }, { Filenames: []string{testConfigFilename}, Profile: "UseFIPSEndpointEnabled", Expected: sharedConfig{ Profile: "UseFIPSEndpointEnabled", Region: "us-west-2", UseFIPSEndpoint: endpoints.FIPSEndpointStateEnabled, }, }, { Filenames: []string{testConfigFilename}, Profile: "UseFIPSEndpointDisabled", Expected: sharedConfig{ Profile: "UseFIPSEndpointDisabled", Region: "us-west-2", UseFIPSEndpoint: endpoints.FIPSEndpointStateDisabled, }, }, { Filenames: []string{testConfigFilename}, Profile: "UseFIPSEndpointInvalid", Expected: sharedConfig{ Profile: "UseFIPSEndpointInvalid", Region: "us-west-2", UseFIPSEndpoint: endpoints.FIPSEndpointStateDisabled, }, }, { Filenames: []string{testConfigFilename}, Profile: "sso-session-success", Expected: sharedConfig{ Profile: "sso-session-success", Region: "us-east-1", SSOAccountID: "123456789012", SSORoleName: "testRole", SSOSessionName: "sso-session-success-dev", SSOSession: &ssoSession{ Name: "sso-session-success-dev", SSORegion: "us-east-1", SSOStartURL: "https://d-123456789a.awsapps.com/start", }, }, }, { Filenames: []string{testConfigFilename}, Profile: "sso-session-not-exist", Err: fmt.Errorf("failed to find SSO session section, sso-session-lost"), }, { Filenames: []string{testConfigFilename}, Profile: "ec2-metadata-v1-disabled-false", Expected: sharedConfig{ Profile: "ec2-metadata-v1-disabled-false", EC2IMDSv1Disabled: aws.Bool(false), }, }, { Filenames: []string{testConfigFilename}, Profile: "ec2-metadata-v1-disabled-true", Expected: sharedConfig{ Profile: "ec2-metadata-v1-disabled-true", EC2IMDSv1Disabled: aws.Bool(true), }, }, { Filenames: []string{testConfigFilename}, Profile: "ec2-metadata-v1-disabled-invalid", Expected: sharedConfig{ Profile: "ec2-metadata-v1-disabled-invalid", EC2IMDSv1Disabled: aws.Bool(false), }, }, } for i, c := range cases { t.Run(strconv.Itoa(i)+"_"+c.Profile, func(t testing.T) { cfg, err := loadSharedConfig(c.Profile, c.Filenames, true) if c.Err != nil { if err == nil { t.Fatalf("expect error, got none") } if e, a := c.Err.Error(), err.Error(); !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } return } if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := c.Expected, cfg; !reflect.DeepEqual(e, a) { t.Errorf("expect %v, got %v", e, a) } }) } } func TestLoadSharedConfigFromFile(t testing.T) { filename := testConfigFilename f, err := ini.OpenFile(filename) if err != nil { t.Fatalf("failed to load test config file, %s, %v", filename, err) } iniFile := sharedConfigFile{IniData: f, Filename: filename} cases := []struct { Profile string Expected sharedConfig Err error }{ { Profile: "default", Expected: sharedConfig{Region: "default_region"}, }, { Profile: "alt_profile_name", Expected: sharedConfig{Region: "alt_profile_name_region"}, }, { Profile: "short_profile_name_first", Expected: sharedConfig{Region: "short_profile_name_first_short"}, }, { Profile: "partial_creds", Expected: sharedConfig{}, }, { Profile: "complete_creds", Expected: sharedConfig{ Creds: credentials.Value{ AccessKeyID: "complete_creds_akid", SecretAccessKey: "complete_creds_secret", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, }, }, { Profile: "complete_creds_with_token", Expected: sharedConfig{ Creds: credentials.Value{ AccessKeyID: "complete_creds_with_token_akid", SecretAccessKey: "complete_creds_with_token_secret", SessionToken: "complete_creds_with_token_token", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, }, }, { Profile: "full_profile", Expected: sharedConfig{ Creds: credentials.Value{ AccessKeyID: "full_profile_akid", SecretAccessKey: "full_profile_secret", ProviderName: fmt.Sprintf("SharedConfigCredentials: %s", testConfigFilename), }, Region: "full_profile_region", }, }, { Profile: "partial_assume_role", Expected: sharedConfig{ RoleARN: "partial_assume_role_role_arn", }, }, { Profile: "assume_role", Expected: sharedConfig{ RoleARN: "assume_role_role_arn", SourceProfileName: "complete_creds", }, }, { Profile: "assume_role_w_mfa", Expected: sharedConfig{ RoleARN: "assume_role_role_arn", SourceProfileName: "complete_creds", MFASerial: "0123456789", }, }, { Profile: "does_not_exists", Err: SharedConfigProfileNotExistsError{Profile: "does_not_exists"}, }, { Profile: "valid_arn_region", Expected: sharedConfig{ S3UseARNRegion: true, }, }, { Profile: "sso-session-success", Expected: sharedConfig{ Region: "us-east-1", SSOAccountID: "123456789012", SSORoleName: "testRole", SSOSessionName: "sso-session-success-dev", }, }, } for i, c := range cases { t.Run(strconv.Itoa(i)+"_"+c.Profile, func(t testing.T) { cfg := sharedConfig{} err := cfg.setFromIniFile(c.Profile, iniFile, true) if c.Err != nil { if err == nil { t.Fatalf("expect error, got none") } if e, a := c.Err.Error(), err.Error(); !strings.Contains(a, e) { t.Errorf("expect %v, to be in %v", e, a) } return } if err != nil { t.Errorf("expect no error, got %v", err) } if e, a := c.Expected, cfg; !reflect.DeepEqual(e, a) { t.Errorf("expect %v, got %v", e, a) } }) } } func TestLoadSharedConfigIniFiles(t testing.T) { cases := []struct { Filenames []string Expected []sharedConfigFile }{ { Filenames: []string{"not_exists", testConfigFilename}, Expected: []sharedConfigFile{ {Filename: testConfigFilename}, }, }, { Filenames: []string{testConfigFilename, testConfigOtherFilename}, Expected: []sharedConfigFile{ {Filename: testConfigFilename}, {Filename: testConfigOtherFilename}, }, }, } for i, c := range cases { t.Run(strconv.Itoa(i), func(t testing.T) { files, err := loadSharedConfigIniFiles(c.Filenames) if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := len(c.Expected), len(files); e != a { t.Errorf("expect %v, got %v", e, a) } for i, expectedFile := range c.Expected { if e, a := expectedFile.Filename, files[i].Filename; e != a { t.Errorf("expect %v, got %v", e, a) } } }) } }	18.55 KB	2025-05-25 12:27
📄 shared_test.go package session import ( "os" "github.com/aws/aws-sdk-go/internal/sdktesting" ) func initSessionTestEnv() (oldEnv func()) { oldEnv = sdktesting.StashEnv() os.Setenv("AWS_CONFIG_FILE", "file_not_exists") os.Setenv("AWS_SHARED_CREDENTIALS_FILE", "file_not_exists") return oldEnv }	289 B	2025-05-25 12:27
📁 testdata	-	2025-05-25 12:27

Terminal