Skip to content

Commit fea98a1

Browse files
kuhekuhe
committed
test(credential-provider-node): add credential source assertions
1 parent be37764 commit fea98a1

File tree

3 files changed

+101
-21
lines changed

3 files changed

+101
-21
lines changed

‎packages/core/src/submodules/httpAuthSchemes/aws_sdk/resolveAwsSdkSigV4Config.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import { setCredentialFeature } from "@aws-sdk/core";
1+
import { setCredentialFeature } from "@aws-sdk/core/client";
22
import { AttributedAwsCredentialIdentity } from "@aws-sdk/types";
33
import {
44
doesIdentityRequireRefresh,

‎packages/credential-provider-node/src/credential-provider-node.integ.spec.ts‎

Lines changed: 99 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,9 @@ describe("credential-provider-node integration test", () => {
295295
expect(credentials).toEqual({
296296
accessKeyId: "ENV_ACCESS_KEY",
297297
secretAccessKey: "ENV_SECRET_KEY",
298+
$source: {
299+
CREDENTIALS_ENV_VARS: "g",
300+
},
298301
});
299302
});
300303

@@ -312,6 +315,9 @@ describe("credential-provider-node integration test", () => {
312315
expiration: new Date("2000-01-01T00:00:00.000Z"),
313316
sessionToken: "ENV_SESSION_TOKEN",
314317
credentialScope: "us-env-1",
318+
$source: {
319+
CREDENTIALS_ENV_VARS: "g",
320+
},
315321
});
316322
});
317323

@@ -331,6 +337,9 @@ describe("credential-provider-node integration test", () => {
331337
expect(credentials).toEqual({
332338
accessKeyId: "INI_STATIC_ACCESS_KEY",
333339
secretAccessKey: "INI_STATIC_SECRET_KEY",
340+
$source: {
341+
CREDENTIALS_PROFILE: "n",
342+
},
334343
});
335344
});
336345
});
@@ -356,6 +365,10 @@ describe("credential-provider-node integration test", () => {
356365
sessionToken: "SSO_SESSION_TOKEN",
357366
expiration: new Date("3000-01-01T00:00:00.000Z"),
358367
credentialScope: "us-sso-1-us-sso-region-1",
368+
$source: {
369+
CREDENTIALS_CODE: "e",
370+
CREDENTIALS_SSO_LEGACY: "u",
371+
},
359372
});
360373
});
361374
});
@@ -371,6 +384,9 @@ describe("credential-provider-node integration test", () => {
371384
expect(credentials).toEqual({
372385
accessKeyId: "INI_STATIC_ACCESS_KEY",
373386
secretAccessKey: "INI_STATIC_SECRET_KEY",
387+
$source: {
388+
CREDENTIALS_PROFILE: "n",
389+
},
374390
});
375391
});
376392

@@ -395,6 +411,10 @@ describe("credential-provider-node integration test", () => {
395411
sessionToken: "STS_AR_SESSION_TOKEN",
396412
expiration: new Date("3000-01-01T00:00:00.000Z"),
397413
credentialScope: "us-stsar-1__us-west-2",
414+
$source: {
415+
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
416+
CREDENTIALS_STS_ASSUME_ROLE: "i",
417+
},
398418
});
399419
});
400420

@@ -423,6 +443,10 @@ describe("credential-provider-node integration test", () => {
423443
sessionToken: "STS_AR_SESSION_TOKEN",
424444
expiration: new Date("3000-01-01T00:00:00.000Z"),
425445
credentialScope: "us-stsar-1__eu-west-1",
446+
$source: {
447+
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
448+
CREDENTIALS_STS_ASSUME_ROLE: "i",
449+
},
426450
});
427451
});
428452

@@ -451,6 +475,10 @@ describe("credential-provider-node integration test", () => {
451475
sessionToken: "STS_AR_SESSION_TOKEN",
452476
expiration: new Date("3000-01-01T00:00:00.000Z"),
453477
credentialScope: "us-stsar-1__us-gov-stsar-1",
478+
$source: {
479+
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
480+
CREDENTIALS_STS_ASSUME_ROLE: "i",
481+
},
454482
});
455483
});
456484

@@ -471,29 +499,41 @@ describe("credential-provider-node integration test", () => {
471499
sessionToken: "STS_ARWI_SESSION_TOKEN",
472500
expiration: new Date("3000-01-01T00:00:00.000Z"),
473501
credentialScope: "us-stsarwi-1__us-west-2",
502+
$source: {
503+
CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN: "q",
504+
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID: "k",
505+
},
474506
});
475507
});
476508

477-
it("should resolve credentials from STS assumeRoleWithWebIdentity if the ini profile is configured for web identity and the client region is not the default AWS partition", async () => {
478-
sts = new STS({
479-
region: "us-gov-sts-1",
480-
requestHandler: mockRequestHandler,
481-
});
482-
Object.assign(iniProfileData.default, {
483-
region: "us-gov-sts-1",
484-
web_identity_token_file: "token-filepath",
485-
role_arn: "ROLE_ARN",
486-
});
487-
await sts.getCallerIdentity({});
488-
const credentials = await sts.config.credentials();
489-
expect(credentials).toEqual({
490-
accessKeyId: "STS_ARWI_ACCESS_KEY_ID",
491-
secretAccessKey: "STS_ARWI_SECRET_ACCESS_KEY",
492-
sessionToken: "STS_ARWI_SESSION_TOKEN",
493-
expiration: new Date("3000-01-01T00:00:00.000Z"),
494-
credentialScope: "us-stsarwi-1__us-gov-sts-1",
495-
});
496-
});
509+
it(
510+
"should resolve credentials from STS assumeRoleWithWebIdentity if the ini profile is" +
511+
" configured for web identity and the client region is not the default AWS partition",
512+
async () => {
513+
sts = new STS({
514+
region: "us-gov-sts-1",
515+
requestHandler: mockRequestHandler,
516+
});
517+
Object.assign(iniProfileData.default, {
518+
region: "us-gov-sts-1",
519+
web_identity_token_file: "token-filepath",
520+
role_arn: "ROLE_ARN",
521+
});
522+
await sts.getCallerIdentity({});
523+
const credentials = await sts.config.credentials();
524+
expect(credentials).toEqual({
525+
accessKeyId: "STS_ARWI_ACCESS_KEY_ID",
526+
secretAccessKey: "STS_ARWI_SECRET_ACCESS_KEY",
527+
sessionToken: "STS_ARWI_SESSION_TOKEN",
528+
expiration: new Date("3000-01-01T00:00:00.000Z"),
529+
credentialScope: "us-stsarwi-1__us-gov-sts-1",
530+
$source: {
531+
CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN: "q",
532+
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID: "k",
533+
},
534+
});
535+
}
536+
);
497537

498538
it("should resolve process credentials if the profile is a process profile", async () => {
499539
Object.assign(iniProfileData.default, {
@@ -506,6 +546,10 @@ describe("credential-provider-node integration test", () => {
506546
secretAccessKey: "PROCESS_SECRET_ACCESS_KEY",
507547
sessionToken: "PROCESS_SESSION_TOKEN",
508548
credentialScope: "us-process-1",
549+
$source: {
550+
CREDENTIALS_PROCESS: "w",
551+
CREDENTIALS_PROFILE_PROCESS: "v",
552+
},
509553
});
510554
});
511555

@@ -529,6 +573,10 @@ describe("credential-provider-node integration test", () => {
529573
sessionToken: "SSO_SESSION_TOKEN",
530574
expiration: new Date("3000-01-01T00:00:00.000Z"),
531575
credentialScope: "us-sso-1-us-sso-region-1",
576+
$source: {
577+
CREDENTIALS_PROFILE_SSO: "r",
578+
CREDENTIALS_SSO: "s",
579+
},
532580
});
533581
});
534582

@@ -561,6 +609,11 @@ describe("credential-provider-node integration test", () => {
561609
sessionToken: "STS_AR_SESSION_TOKEN",
562610
expiration: new Date("3000-01-01T00:00:00.000Z"),
563611
credentialScope: "us-stsar-1__us-west-2",
612+
$source: {
613+
CREDENTIALS_CODE: "e",
614+
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
615+
CREDENTIALS_STS_ASSUME_ROLE: "i",
616+
},
564617
});
565618
expect(spy).toHaveBeenCalledWith(
566619
expect.objectContaining({
@@ -601,6 +654,11 @@ describe("credential-provider-node integration test", () => {
601654
sessionToken: "STS_AR_SESSION_TOKEN",
602655
expiration: new Date("3000-01-01T00:00:00.000Z"),
603656
credentialScope: "us-stsar-1__us-west-2",
657+
$source: {
658+
CREDENTIALS_CODE: "e",
659+
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
660+
CREDENTIALS_STS_ASSUME_ROLE: "i",
661+
},
604662
});
605663
expect(assumeRoleArns).toEqual(["ROLE_ARN_1", "ROLE_ARN_2"]);
606664
});
@@ -643,6 +701,11 @@ describe("credential-provider-node integration test", () => {
643701
sessionToken: "STS_AR_SESSION_TOKEN",
644702
expiration: new Date("3000-01-01T00:00:00.000Z"),
645703
credentialScope: "us-stsar-1__us-west-2",
704+
$source: {
705+
CREDENTIALS_CODE: "e",
706+
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
707+
CREDENTIALS_STS_ASSUME_ROLE: "i",
708+
},
646709
});
647710
expect(spy).toHaveBeenCalledWith(
648711
expect.objectContaining({
@@ -692,6 +755,11 @@ describe("credential-provider-node integration test", () => {
692755
sessionToken: "STS_AR_SESSION_TOKEN",
693756
expiration: new Date("3000-01-01T00:00:00.000Z"),
694757
credentialScope: "us-stsar-1__us-west-2",
758+
$source: {
759+
CREDENTIALS_CODE: "e",
760+
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
761+
CREDENTIALS_STS_ASSUME_ROLE: "i",
762+
},
695763
});
696764
expect(spy).toHaveBeenCalledWith(
697765
expect.objectContaining({
@@ -720,6 +788,10 @@ describe("credential-provider-node integration test", () => {
720788
secretAccessKey: "PROCESS_SECRET_ACCESS_KEY",
721789
sessionToken: "PROCESS_SESSION_TOKEN",
722790
credentialScope: "us-process-1",
791+
$source: {
792+
CREDENTIALS_PROCESS: "w",
793+
CREDENTIALS_PROFILE_PROCESS: "v",
794+
},
723795
});
724796
});
725797
});
@@ -736,6 +808,10 @@ describe("credential-provider-node integration test", () => {
736808
sessionToken: "STS_ARWI_SESSION_TOKEN",
737809
expiration: new Date("3000-01-01T00:00:00.000Z"),
738810
credentialScope: "us-stsarwi-1__us-west-2",
811+
$source: {
812+
CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN: "h",
813+
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID: "k",
814+
},
739815
});
740816
});
741817
});
@@ -751,6 +827,9 @@ describe("credential-provider-node integration test", () => {
751827
secretAccessKey: "CONTAINER_SECRET_ACCESS_KEY",
752828
sessionToken: "CONTAINER_TOKEN",
753829
expiration: new Date("3000-01-01T00:00:00.000Z"),
830+
$source: {
831+
CREDENTIALS_HTTP: "z",
832+
},
754833
});
755834
});
756835

‎packages/credential-provider-web-identity/src/fromWebToken.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { setCredentialFeature } from "@aws-sdk/core";
12
import type { CredentialProviderOptions } from "@aws-sdk/types";
23
import type { AwsCredentialIdentity, AwsCredentialIdentityProvider, Pluggable } from "@smithy/types";
34

0 commit comments

Comments
 (0)