fix(cli): short-lived credentials are not refreshed #32354
Conversation
The CLI immediately invokes credential *providers* to produce *credentials*, and passes the credentials around instead of the providers. This means that if short-lived credentials expire (like session credentials from roles), there is no way to refresh them. CLI calls will start to fail if that happens. To fix this, instead of resolving providers to credentials, pass providers around instead. Implications for auth plugins ------------- This widens the plugin protocol: the new plugin protocol *forced* a translation to V3 credentials, and had no way to return V3 providers. While it is now possible to return V3 Credential Providers from the plugin protocol, plugin writers cannot easily take advantage of that protocol because there have been ~8 CLI releases that only support V3 credentials and will fail at runtime of V3 providers are returned. To support this, pass a new options argument into `getProvider()`: this will indicate whether V3 Providers are supported or not. Plugins can return a provider if the CLI indicates that it supports V3 providers, and avoid doing that if the CLI indicates it won't. That way, plugins can be rewritten to take advantage of returning V3 providers without crashing on CLI versions `2.167.0..(this releases)`. This also affects #32111 in which the plugin contract is being moved.
github-actions
bot
added
bug
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
aws-cdk-automation
added
the
pr/needs-cli-test-run
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
| */ | ||
| getProvider(accountId: string, mode: Mode): Promise<AwsCredentialIdentity>; | ||
| readonly supportsV3Providers?: boolean; |
There was a problem hiding this comment.
Instead of passing a flag, which puts an additional cognitive burden on the plugin writer, we could create an adapter that implements the AwsCredentialIdentityProvider interface and wraps a plugin credential source:
// Not sure whether identityProperties is even necessary for our use case, but still...
const pluginWrapper = (identityProperties?: Record<string, any>) => {
return transformTheResulAsNeeded(
await source.getProvider(awsAccountId, mode, identityProperties));
};
return {
credentials: pluginWrapper,
pluginName: source.name,
};
rix0rrr
added
pr-linter/exempt-test
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
rix0rrr
requested a deployment
to
test-pipeline
GitHub Actions
Waiting
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #32354 +/- ##
==========================================
+ Coverage 78.50% 78.67% +0.17%
==========================================
Files 106 107 +1
Lines 7201 7237 +36
Branches 1321 1329 +8
==========================================
+ Hits 5653 5694 +41
+ Misses 1361 1357 -4
+ Partials 187 186 -1
Flags with carried forward coverage won't be shown. Click here to find out more.
|
|
➡️ PR build request submitted to A maintainer must now check the pipeline and add the |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
rix0rrr
added
the
pr-linter/cli-integ-tested
aws-cdk-automation
dismissed
their stale review
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
aws-cdk-automation
added
pr/needs-maintainer-review
| * in caches which will return the cached value until it expires. | ||
| */ | ||
| export function makeCachingProvider(provider: AwsCredentialIdentityProvider): AwsCredentialIdentityProvider { | ||
| return memoize( |
There was a problem hiding this comment.
Usage
You probably shouldn't, at least directly.
A rebel, lol.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
aws-cdk-automation
removed
the
pr/needs-maintainer-review
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. |
The CLI immediately invokes credential providers to produce credentials, and passes the credentials around instead of the providers. This means that if short-lived credentials expire (like session credentials from roles), there is no way to refresh them.
CLI calls will start to fail if that happens.
To fix this, instead of resolving providers to credentials, pass providers around instead.
Implications for auth plugins
This widens the plugin protocol: the new plugin protocol forced a translation to V3 credentials, and had no way to return V3 providers. While it is now possible to return V3 Credential Providers from the plugin protocol, plugin writers cannot easily take advantage of that protocol because there have been ~8 CLI releases that only support V3 credentials and will fail at runtime of V3 providers are returned.
To support this, pass a new options argument into
getProvider(): this will indicate whether V3 Providers are supported or not. Plugins can return a provider if the CLI indicates that it supports V3 providers, and avoid doing that if the CLI indicates it won't. That way, plugins can be rewritten to take advantage of returning V3 providers without crashing on CLI versions2.167.0..(this releases).This also affects #32111 in which the plugin contract is being moved.
Closes #32287.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license