AWS SDK

# Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.

[package]

name = "aws-config"

version = "1.6.0"

authors = ["AWS Rust SDK Team <aws-sdk-rust@amazon.com>", "Russell Cohen <rcoh@amazon.com>"]

description = "AWS SDK config and credential provider implementations."

edition = "2021"

exclude = ["test-data/*", "integration-tests/*"]

license = "Apache-2.0"

repository = "https://github.com/smithy-lang/smithy-rs"

[package.metadata.docs.rs]

all-features = true

targets = ["x86_64-unknown-linux-gnu"]

cargo-args = ["-Zunstable-options", "-Zrustdoc-scrape-examples"]

[dependencies.aws-credential-types]

path = "../aws-credential-types"

features = ["test-util"]

version = "1.2.1"

[dependencies.aws-runtime]

path = "../aws-runtime"

version = "1.5.5"

[dependencies.aws-sdk-sts]

path = "../sts"

default-features = false

version = "0.0.0-local"

[dependencies.aws-smithy-async]

path = "../aws-smithy-async"

version = "1.2.5"

[dependencies.aws-smithy-http]

path = "../aws-smithy-http"

[dependencies.zeroize]

version = "1"

optional = true

[dependencies.aws-sdk-ssooidc]

path = "../ssooidc"

default-features = false

optional = true

version = "0.0.0-local"

[dependencies.proc-macro2]

version = "1.0.92"

optional = true

[dev-dependencies]

tracing-test = "0.2.4"

serde_json = "1"

[dev-dependencies.aws-smithy-async]

path = "../aws-smithy-async"

[dev-dependencies.tracing-subscriber]

version = "0.3.16"

features = ["fmt", "json"]

[dev-dependencies.tokio]

version = "1.23.1"

features = ["full", "test-util"]

[dev-dependencies.serde]

version = "1"

features = ["derive"]

/*

 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

 * SPDX-License-Identifier: Apache-2.0

 */

use std::borrow::Cow;

/// 1. Environment variables: [`EnvironmentVariableCredentialsProvider`]

/// 2. Shared config (`~/.aws/config`, `~/.aws/credentials`): [`SharedConfigCredentialsProvider`](crate::profile::ProfileFileCredentialsProvider)

/// 3. [Web Identity Tokens](crate::web_identity_token)

/// 4. ECS (IAM Roles for Tasks) & General HTTP credentials: [`ecs`](crate::ecs)

/// 5. [EC2 IMDSv2](crate::imds)

///

/// The outer provider is wrapped in a refreshing cache.

///

/// More providers are a work in progress.

///

/// # Examples

/// Create a default chain with a custom region:

/// ```no_run

/// use aws_types::region::Region;

/// use aws_config::default_provider::credentials::DefaultCredentialsChain;

/// let credentials_provider = DefaultCredentialsChain::builder()

///     .region(Region::new("us-west-1"))

///     .build();

/// ```

///

        self

    }

    /// Override the profile name used by this provider

    ///

    /// When unset, the value of the `AWS_PROFILE` environment variable will be used.

    pub fn profile_name(mut self, name: &str) -> Self {

        self.profile_file_builder = self.profile_file_builder.profile_name(name);

        self.region_chain = self.region_chain.profile_name(name);

        self

    }

    /// Override the IMDS client used for this provider

    ///

    /// When unset, the default IMDS client will be used.

    pub fn imds_client(mut self, client: crate::imds::Client) -> Self {

        self.imds_builder = self.imds_builder.imds_client(client);

        self

    }

        let profile_provider = self.profile_file_builder.configure(&conf).build();

        let web_identity_token_provider = self.web_identity_builder.configure(&conf).build();

        let imds_provider = self.imds_builder.configure(&conf).build();

        let ecs_provider = self.ecs_builder.configure(&conf).build();

        let provider_chain = CredentialsProviderChain::first_try("Environment", env_provider)

            .or_else("Profile", profile_provider)

            .or_else("WebIdentityToken", web_identity_token_provider)

            .or_else("EcsContainer", ecs_provider)

            .or_else("Ec2InstanceMetadata", imds_provider);

        DefaultCredentialsChain { provider_chain }

    }

}

#[cfg(test)]

mod test {

    use crate::default_provider::credentials::DefaultCredentialsChain;

    use crate::test_case::{StaticTestProvider, TestEnvironment};

    use aws_credential_types::provider::ProvideCredentials;

        )]);

        let err = client.get("/latest/metadata").await.expect_err("no token");

        assert_full_error_contains!(err, "invalid token");

        http_client.assert_requests_match(&[]);

    }

    #[tokio::test]

    async fn non_utf8_response() {

        let (client, http_client) = mock_imds_client(vec![

            ReplayEvent::new(

                token_request("http://169.254.169.254", 21600),

                token_response(21600, TOKEN_A).map(SdkBody::from),

            ),

            ReplayEvent::new(

                imds_request("http://169.254.169.254/latest/metadata", TOKEN_A),

                http::Response::builder()

                    .status(200)

                    .body(SdkBody::from(vec![0xA0, 0xA1]))

                    .unwrap(),

            ),

        let now = SystemTime::now();

        let resp = client

            .get("/latest/metadata")

            .await

            .expect_err("240.0.0.0 will never resolve");

        match resp {

            err @ ImdsError::FailedToLoadToken(_)

                if format!("{}", DisplayErrorContext(&err)).contains("timeout") => {} // ok,

            other => panic!(

                "wrong error, expected construction failure with TimedOutError inside: {}",

                DisplayErrorContext(&other)

            ),

        }

        let time_elapsed = now.elapsed().unwrap();

        assert!(

            time_elapsed > Duration::from_secs(1),

            "time_elapsed should be greater than 1s but was {:?}",

            time_elapsed

        );

        assert!(

                ReplayEvent::new(

                    imds_request("http://169.254.169.254/latest/meta-data/iam/security-credentials/profile-name", TOKEN_A),

                    imds_response("{\n  \"Code\" : \"Success\",\n  \"LastUpdated\" : \"2021-09-20T21:42:26Z\",\n  \"Type\" : \"AWS-HMAC\",\n  \"AccessKeyId\" : \"ASIARTEST\",\n  \"SecretAccessKey\" : \"testsecret\",\n  \"Token\" : \"testtoken\",\n  \"Expiration\" : \"2021-09-21T04:16:53Z\"\n}"),

                ),

            ]);

        // set to 2021-09-21T17:41:25Z that renders fetched credentials already expired (2021-09-21T04:16:53Z)

        let time_of_request_to_fetch_credentials = UNIX_EPOCH + Duration::from_secs(1632246085);

        let (time_source, sleep) = instant_time_and_sleep(time_of_request_to_fetch_credentials);

        let provider_config = ProviderConfig::no_configuration()

            .with_http_client(http_client.clone())

            .with_sleep_impl(sleep)

            .with_time_source(time_source);

        let client = crate::imds::Client::builder()

            .configure(&provider_config)

            .build();

        let provider = ImdsCredentialsProvider::builder()

            .configure(&provider_config)

            .imds_client(client)

            .configure(&ProviderConfig::no_configuration())

            // seed fallback credentials for testing

            .last_retrieved_credentials(expected.clone())

            .build();

        let sleeper = aws_smithy_async::rt::sleep::TokioSleep::new();

        let timeout = aws_smithy_async::future::timeout::Timeout::new(

            provider.provide_credentials(),

            // make sure `sleeper.sleep` will be timed out first by setting a shorter duration than connect timeout

            sleeper.sleep(std::time::Duration::from_millis(100)),

        );

        match timeout.await {

            Ok(_) => panic!("provide_credentials completed before timeout future"),

            Err(_err) => match provider.fallback_on_interrupt() {

                Some(actual) => assert_eq!(actual, expected),

                None => panic!(

                    "provide_credentials timed out and no credentials returned from fallback_on_interrupt"

                ),

            },

        };

    }

                self.endpoint_url

            } else {

                // Otherwise, check to see if we should ignore EP URLs set in the environment.

                let ignore_configured_endpoint_urls =

                    ignore_ep::ignore_configured_endpoint_urls_provider(&conf)

                        .await

                        .unwrap_or_default();

                if ignore_configured_endpoint_urls {

                    // If yes, log a trace and return `None`.

                    tracing::trace!(

                        "`ignore_configured_endpoint_urls` is set, any endpoint URLs configured in the environment will be ignored. \

                        NOTE: Endpoint URLs set programmatically WILL still be respected"

                    );

                    None

                } else {

                    // Otherwise, attempt to resolve one.

                    let (v, origin) = endpoint_url::endpoint_url_provider_with_origin(&conf).await;

                    builder.insert_origin("endpoint_url", origin);

                    v

                    Some(request_checksum_calculation)

                } else {

                    checksums::request_checksum_calculation_provider(&conf).await

                };

            let response_checksum_validation =

                if let Some(response_checksum_validation) = self.response_checksum_validation {

                    Some(response_checksum_validation)

                } else {

                    checksums::response_checksum_validation_provider(&conf).await

                };

            builder.set_request_checksum_calculation(request_checksum_calculation);

            builder.set_response_checksum_validation(response_checksum_validation);

            builder.set_identity_cache(identity_cache);

            builder.set_credentials_provider(credentials_provider);

            builder.set_token_provider(token_provider);

            builder.set_sleep_impl(sleep_impl);

            builder.set_use_fips(use_fips);

            builder.set_use_dual_stack(use_dual_stack);

        }

        #[tokio::test]

        async fn load_disable_request_compression() {

            let conf = base_conf().disable_request_compression(true).load().await;

            assert_eq!(Some(true), conf.disable_request_compression());

            let conf = base_conf().load().await;

            assert_eq!(None, conf.disable_request_compression());

        }

        #[tokio::test]

        async fn load_request_min_compression_size_bytes() {

            let conf = base_conf()

                .request_min_compression_size_bytes(99)

                .load()

                .await;

            assert_eq!(Some(99), conf.request_min_compression_size_bytes());

            let conf = base_conf().load().await;

            let num_requests = Arc::new(AtomicUsize::new(0));

            let movable = num_requests.clone();

            let http_client = infallible_client_fn(move |_req| {

                movable.fetch_add(1, Ordering::Relaxed);

                http::Response::new("ok!")

            });

            let config = defaults(BehaviorVersion::latest())

                .fs(Fs::from_slice(&[]))

                .env(Env::from_slice(&[]))

                .http_client(http_client.clone())

                .load()

                .await;

            config

                .credentials_provider()

                .unwrap()

                .provide_credentials()

                .await

                .expect_err("did not expect credentials to be loaded—no traffic is allowed");

            let num_requests = num_requests.load(Ordering::Relaxed);

            assert!(num_requests > 0, "{}", num_requests);

                    .iter()

                    .map(|provider| &provider.0)

                    .collect::<Vec<&Cow<'static, str>>>(),

            )

            .finish()

    }

}

impl CredentialsProviderChain {

    /// Create a `CredentialsProviderChain` that begins by evaluating this provider

    pub fn first_try(

        name: impl Into<Cow<'static, str>>,

        provider: impl ProvideCredentials + 'static,

    ) -> Self {

        CredentialsProviderChain {

            providers: vec![(name.into(), Box::new(provider))],

        }

    }

    /// Add a fallback provider to the credentials provider chain

            match provider.provide_credentials().instrument(span).await {

                Ok(credentials) => {

                    tracing::debug!(provider = %name, "loaded credentials");

                    return Ok(credentials);

                }

                Err(err @ CredentialsError::CredentialsNotLoaded(_)) => {

                    tracing::debug!(provider = %name, context = %DisplayErrorContext(&err), "provider in chain did not provide credentials");

                }

                Err(err) => {

                    tracing::warn!(provider = %name, error = %DisplayErrorContext(&err), "provider failed to provide credentials");

                    return Err(err);

                }

            }

        }

        Err(CredentialsError::not_loaded(

            "no providers in chain provided credentials",

        ))

    }

}

/// [default]

/// aws_access_key_id = 123

/// aws_secret_access_key = 456

/// ```

///

/// ### Assume Role Credentials loaded from a credential source

/// ```ini

/// [default]

/// role_arn = arn:aws:iam::123456789:role/RoleA

/// credential_source = Environment

/// ```

///

/// NOTE: Currently only the `Environment` credential source is supported although it is possible to

/// provide custom sources:

/// ```no_run

/// use aws_credential_types::provider::{self, future, ProvideCredentials};

/// use aws_config::profile::ProfileFileCredentialsProvider;

/// #[derive(Debug)]

/// struct MyCustomProvider;

/// impl MyCustomProvider {

/// source_profile = base

///

/// [profile base]

/// aws_access_key_id = 123

/// aws_secret_access_key = 456

/// ```

///

/// Other more complex configurations are possible, consult `test-data/assume-role-tests.json`.

///

/// ### Credentials loaded from an external process

/// ```ini

/// [default]

/// credential_process = /opt/bin/awscreds-custom --username helen

/// ```

///

/// An external process can be used to provide credentials.

///

/// ### Loading Credentials from SSO

/// ```ini

/// [default]

        let env = Env::from_slice(&[]);

        Self {

            parsed_profile: Default::default(),

            #[allow(deprecated)]

            profile_files: ProfileFiles::default(),

            env,

            fs,

            time_source: SharedTimeSource::new(StaticTimeSource::new(UNIX_EPOCH)),

            http_client: None,

            sleep_impl: None,

            region: None,

            use_fips: None,

            use_dual_stack: None,

            profile_name_override: None,

        }

    }

}

impl ProviderConfig {

    /// Create a default provider config with the region unset.

        Self::default()

    }

    /// Constructs a ProviderConfig with no fields set

    pub fn empty() -> Self {

        ProviderConfig {

            env: Env::default(),

            fs: Fs::default(),

            time_source: SharedTimeSource::default(),

            http_client: None,

            sleep_impl: None,

            region: None,

            use_fips: None,

            use_dual_stack: None,

            parsed_profile: Default::default(),

            #[allow(deprecated)]

            profile_files: ProfileFiles::default(),

            profile_name_override: None,

        }

    }

            .with_use_fips(use_fips)

            .with_use_dual_stack(use_dual_stack);

        Ok(Self {

            base_dir: dir.into(),

            metadata,

            http_client,

            provider_config,

            run_provider: Box::new(run_provider),

        })

    }

    pub(crate) fn map_provider_config<F>(mut self, provider_config_builder: F) -> Self

    where

        F: Fn(ProviderConfig) -> ProviderConfig,

    {

        self.provider_config = provider_config_builder(self.provider_config.clone());

        self

    }

            self.provider_config.sleep_impl(),

        )

        .expect("feature gate on this function makes this always return Some");

        let live_client = RecordingClient::new(live_connector);

        let config = self

            .provider_config

            .clone()

            .with_http_client(live_client.clone());

        let result = self.run_provider.run_provider(config).await;

        std::fs::write(

            self.base_dir.join("http-traffic-recorded.json"),

            serde_json::to_string(&live_client.network_traffic()).unwrap(),

        )

        .unwrap();

        self.check_results(result.as_ref());

    }

    #[allow(dead_code)]

    /// Execute the test suite & record a new traffic log

# Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.

[[example]]

name = "client-ring"

required-features = ["rustls-ring"]

doc-scrape-examples = true

[[example]]

name = "client-aws-lc"

required-features = ["rustls-aws-lc", "rustls-aws-lc-fips"]

doc-scrape-examples = true

[[example]]

name = "custom-dns"

required-features = ["rustls-ring"]

doc-scrape-examples = true

[package]

name = "aws-smithy-http-client"

[dependencies.aws-smithy-runtime-api]

path = "../aws-smithy-runtime-api"

features = ["client"]

version = "1.7.4"

[dependencies.aws-smithy-types]

path = "../aws-smithy-types"

version = "1.3.0"

[dependencies.aws-smithy-protocol-test]

path = "../aws-smithy-protocol-test"

optional = true

version = "0.63.0"

[dependencies.h2]

version = "0.4"

default-features = false

[dependencies.tokio]

version = "1.40"

    HttpClient, HttpConnector, HttpConnectorFuture, HttpConnectorSettings, SharedHttpClient,

    SharedHttpConnector,

};

use aws_smithy_runtime_api::client::orchestrator::{HttpRequest, HttpResponse};

use aws_smithy_runtime_api::client::result::ConnectorError;

use aws_smithy_runtime_api::client::runtime_components::{

    RuntimeComponents, RuntimeComponentsBuilder,

};

use aws_smithy_runtime_api::shared::IntoShared;

use aws_smithy_types::body::SdkBody;

use aws_smithy_types::config_bag::ConfigBag;

use aws_smithy_types::error::display::DisplayErrorContext;

use aws_smithy_types::retry::ErrorKind;

use client::connect::Connection;

use h2::Reason;

use http_1x::{Extensions, Uri};

use hyper::rt::{Read, Write};

use hyper_util::client::legacy as client;

use hyper_util::client::legacy::connect::dns::GaiResolver;

use hyper_util::client::legacy::connect::{

        if let Some(sleep) = sleep {

            conn_builder = conn_builder.sleep_impl(sleep);

        }

        let conn = conn_builder

            .tls_provider(tls::Provider::Rustls(

                tls::rustls_provider::CryptoMode::AwsLc,

            ))

            .build();

        Some(SharedHttpConnector::new(conn))

    }

    #[cfg(not(feature = "rustls-aws-lc"))]

    {

        tracing::trace!(settings = ?settings, sleep = ?sleep, "no default connector available");

        None

    }

}

/// [`HttpConnector`] used to make HTTP requests.

///

/*

 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

 * SPDX-License-Identifier: Apache-2.0

            $(

                #[cfg(any(

                    feature = "rustls-aws-lc",

                    feature = "rustls-aws-lc-fips",

                    feature = "rustls-ring"

                ))]

                #[cfg_attr(docsrs, doc(cfg(any(feature = "rustls-aws-lc", feature = "rustls-aws-lc-fips", feature = "rustls-ring"))))]

                $item

            )*

        }

    }

    /// Any rustls provider enabled

    macro_rules! cfg_rustls {

        ($($item:item)*) => {

            $(

                #[cfg(any(

                    feature = "rustls-aws-lc",

                    feature = "rustls-aws-lc-fips",

                    feature = "rustls-ring"

/*

 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

 * SPDX-License-Identifier: Apache-2.0

 */

        self.invocations.load(Ordering::SeqCst)

    }

}

impl HttpConnector for NeverClient {

    fn call(&self, _request: HttpRequest) -> HttpConnectorFuture {

        self.invocations.fetch_add(1, Ordering::SeqCst);

        HttpConnectorFuture::new(async move {

            Never::new().await;

            unreachable!()

        })

    }

}

impl HttpClient for NeverClient {

    fn http_connector(

        &self,

        _: &HttpConnectorSettings,

        _: &RuntimeComponents,

    ) -> SharedHttpConnector {

    use tokio::net::TcpStream;

    impl tower::Service<Uri> for NeverTcpConnector {

        type Response = TokioIo<TcpStream>;

        type Error = ConnectorError;

        type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;

        fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {

            Poll::Ready(Ok(()))

        }

        fn call(&mut self, _uri: Uri) -> Self::Future {

            Box::pin(async move {

                Never::new().await;

                unreachable!()

            })

        }

    }

    impl NeverTcpConnector {

    use aws_smithy_runtime_api::client::runtime_components::RuntimeComponentsBuilder;

    use std::time::Duration;

    #[cfg(feature = "hyper-014")]

    #[tokio::test]

    async fn never_tcp_connector_plugs_into_hyper_014() {

        use super::NeverTcpConnector;

        use crate::hyper_014::HyperClientBuilder;

        // it should compile

        let client = HyperClientBuilder::new().build(NeverTcpConnector::new());

        let components = RuntimeComponentsBuilder::for_tests()

            .with_sleep_impl(Some(TokioSleep::new()))

            .with_time_source(Some(SystemTimeSource::new()))

            .build()

            .unwrap();

        let http_connector = client.http_connector(

            &HttpConnectorSettings::builder()

                .connect_timeout(Duration::from_millis(100))

                .build(),

            &HttpConnectorSettings::builder()

                .connect_timeout(Duration::from_millis(100))

                .build(),

            &components,

        );

        let err = http_connector

            .call(HttpRequest::get("http://fakeuri.com").unwrap())

            .await

            .expect_err("it should time out");

        assert!(dbg!(err).is_timeout());

    }

}

    let client = Builder::new()

        .tls_provider(tls::Provider::Rustls(

            tls::rustls_provider::CryptoMode::Ring,

        ))

        .build_https();

    smoke_test_client(&client).await.unwrap();

}

#[cfg(feature = "rustls-aws-lc-fips")]

#[tokio::test]

async fn aws_lc_fips_client() {

    let client = Builder::new()

        .tls_provider(tls::Provider::Rustls(

            tls::rustls_provider::CryptoMode::AwsLcFips,

        ))

        .build_https();

    smoke_test_client(&client).await.unwrap();

}

#[cfg(feature = "rustls-aws-lc")]