aws_config/
provider_config.rs

1/*
2 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 * SPDX-License-Identifier: Apache-2.0
4 */
5
6//! Configuration Options for Credential Providers
7
8use crate::env_service_config::EnvServiceConfig;
9use crate::profile;
10#[allow(deprecated)]
11use crate::profile::profile_file::ProfileFiles;
12use crate::profile::{ProfileFileLoadError, ProfileSet};
13use aws_smithy_async::rt::sleep::{default_async_sleep, AsyncSleep, SharedAsyncSleep};
14use aws_smithy_async::time::{SharedTimeSource, TimeSource};
15use aws_smithy_runtime_api::client::behavior_version::BehaviorVersion;
16use aws_smithy_runtime_api::client::http::HttpClient;
17use aws_smithy_runtime_api::shared::IntoShared;
18use aws_smithy_types::error::display::DisplayErrorContext;
19use aws_smithy_types::retry::RetryConfig;
20use aws_types::os_shim_internal::{Env, Fs};
21use aws_types::region::Region;
22use aws_types::sdk_config::SharedHttpClient;
23use aws_types::SdkConfig;
24use std::borrow::Cow;
25use std::fmt::{Debug, Formatter};
26use std::sync::Arc;
27use tokio::sync::OnceCell;
28
29/// Configuration options for Credential Providers
30///
31/// Most credential providers builders offer a `configure` method which applies general provider configuration
32/// options.
33///
34/// To use a region from the default region provider chain use [`ProviderConfig::with_default_region`].
35/// Otherwise, use [`ProviderConfig::without_region`]. Note that some credentials providers require a region
36/// to be explicitly set.
37#[derive(Clone)]
38pub struct ProviderConfig {
39    env: Env,
40    fs: Fs,
41    time_source: SharedTimeSource,
42    http_client: Option<SharedHttpClient>,
43    retry_config: Option<RetryConfig>,
44    sleep_impl: Option<SharedAsyncSleep>,
45    region: Option<Region>,
46    use_fips: Option<bool>,
47    use_dual_stack: Option<bool>,
48    behavior_version: Option<BehaviorVersion>,
49    /// An AWS profile created from `ProfileFiles` and a `profile_name`
50    parsed_profile: Arc<OnceCell<Result<ProfileSet, ProfileFileLoadError>>>,
51    /// A list of [std::path::Path]s to profile files
52    #[allow(deprecated)]
53    profile_files: ProfileFiles,
54    /// An override to use when constructing a `ProfileSet`
55    profile_name_override: Option<Cow<'static, str>>,
56}
57
58impl Debug for ProviderConfig {
59    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
60        f.debug_struct("ProviderConfig")
61            .field("env", &self.env)
62            .field("fs", &self.fs)
63            .field("time_source", &self.time_source)
64            .field("http_client", &self.http_client)
65            .field("retry_config", &self.retry_config)
66            .field("sleep_impl", &self.sleep_impl)
67            .field("region", &self.region)
68            .field("use_fips", &self.use_fips)
69            .field("use_dual_stack", &self.use_dual_stack)
70            .field("profile_name_override", &self.profile_name_override)
71            .finish()
72    }
73}
74
75impl Default for ProviderConfig {
76    fn default() -> Self {
77        Self {
78            env: Env::default(),
79            fs: Fs::default(),
80            time_source: SharedTimeSource::default(),
81            http_client: None,
82            retry_config: None,
83            sleep_impl: default_async_sleep(),
84            region: None,
85            use_fips: None,
86            use_dual_stack: None,
87            behavior_version: None,
88            parsed_profile: Default::default(),
89            #[allow(deprecated)]
90            profile_files: ProfileFiles::default(),
91            profile_name_override: None,
92        }
93    }
94}
95
96#[cfg(test)]
97impl ProviderConfig {
98    /// ProviderConfig with all configuration removed
99    ///
100    /// Unlike [`ProviderConfig::empty`] where `env` and `fs` will use their non-mocked implementations,
101    /// this method will use an empty mock environment and an empty mock file system.
102    pub fn no_configuration() -> Self {
103        use aws_smithy_async::time::StaticTimeSource;
104        use std::collections::HashMap;
105        use std::time::UNIX_EPOCH;
106        let fs = Fs::from_raw_map(HashMap::new());
107        let env = Env::from_slice(&[]);
108        Self {
109            parsed_profile: Default::default(),
110            #[allow(deprecated)]
111            profile_files: ProfileFiles::default(),
112            env,
113            fs,
114            time_source: SharedTimeSource::new(StaticTimeSource::new(UNIX_EPOCH)),
115            http_client: None,
116            retry_config: None,
117            sleep_impl: None,
118            region: None,
119            use_fips: None,
120            use_dual_stack: None,
121            behavior_version: None,
122            profile_name_override: None,
123        }
124    }
125}
126
127impl ProviderConfig {
128    /// Create a default provider config with the region unset.
129    ///
130    /// Using this option means that you may need to set a region manually.
131    ///
132    /// This constructor will use a default value for the HTTPS connector and Sleep implementation
133    /// when they are enabled as crate features which is usually the correct option. To construct
134    /// a `ProviderConfig` without these fields set, use [`ProviderConfig::empty`].
135    ///
136    ///
137    /// # Examples
138    /// ```no_run
139    /// # #[cfg(feature = "default-https-client")]
140    /// # fn example() {
141    /// use aws_config::provider_config::ProviderConfig;
142    /// use aws_sdk_sts::config::Region;
143    /// use aws_config::web_identity_token::WebIdentityTokenCredentialsProvider;
144    /// let conf = ProviderConfig::without_region().with_region(Some(Region::new("us-east-1")));
145    ///
146    /// let credential_provider = WebIdentityTokenCredentialsProvider::builder().configure(&conf).build();
147    /// # }
148    /// ```
149    pub fn without_region() -> Self {
150        Self::default()
151    }
152
153    /// Constructs a ProviderConfig with no fields set
154    pub fn empty() -> Self {
155        ProviderConfig {
156            env: Env::default(),
157            fs: Fs::default(),
158            time_source: SharedTimeSource::default(),
159            http_client: None,
160            retry_config: None,
161            sleep_impl: None,
162            region: None,
163            use_fips: None,
164            use_dual_stack: None,
165            behavior_version: None,
166            parsed_profile: Default::default(),
167            #[allow(deprecated)]
168            profile_files: ProfileFiles::default(),
169            profile_name_override: None,
170        }
171    }
172
173    /// Initializer for ConfigBag to avoid possibly setting incorrect defaults.
174    pub(crate) fn init(
175        time_source: SharedTimeSource,
176        sleep_impl: Option<SharedAsyncSleep>,
177    ) -> Self {
178        Self {
179            parsed_profile: Default::default(),
180            #[allow(deprecated)]
181            profile_files: ProfileFiles::default(),
182            env: Env::default(),
183            fs: Fs::default(),
184            time_source,
185            http_client: None,
186            retry_config: None,
187            sleep_impl,
188            region: None,
189            use_fips: None,
190            use_dual_stack: None,
191            behavior_version: None,
192            profile_name_override: None,
193        }
194    }
195
196    /// Create a default provider config with the region region automatically loaded from the default chain.
197    ///
198    /// # Examples
199    /// ```no_run
200    /// # async fn test() {
201    /// use aws_config::provider_config::ProviderConfig;
202    /// use aws_sdk_sts::config::Region;
203    /// use aws_config::web_identity_token::WebIdentityTokenCredentialsProvider;
204    /// let conf = ProviderConfig::with_default_region().await;
205    /// let credential_provider = WebIdentityTokenCredentialsProvider::builder().configure(&conf).build();
206    /// }
207    /// ```
208    pub async fn with_default_region() -> Self {
209        Self::without_region().load_default_region().await
210    }
211
212    /// Attempt to get a representation of `SdkConfig` from this `ProviderConfig`.
213    ///
214    ///
215    /// **WARN**: Some options (e.g. `service_config`) can only be set if the profile has been
216    /// parsed already (e.g. by calling [`ProviderConfig::profile()`]). This is an
217    /// imperfect mapping and should be used sparingly.
218    pub(crate) fn client_config(&self) -> SdkConfig {
219        let profiles = self.parsed_profile.get().and_then(|v| v.as_ref().ok());
220        let service_config = EnvServiceConfig {
221            env: self.env(),
222            env_config_sections: profiles.cloned().unwrap_or_default(),
223        };
224
225        let mut builder = SdkConfig::builder()
226            .retry_config(
227                self.retry_config
228                    .as_ref()
229                    .map_or(RetryConfig::standard(), |config| config.clone()),
230            )
231            .region(self.region())
232            .time_source(self.time_source())
233            .use_fips(self.use_fips().unwrap_or_default())
234            .use_dual_stack(self.use_dual_stack().unwrap_or_default())
235            .service_config(service_config)
236            .behavior_version(crate::BehaviorVersion::latest());
237        builder.set_http_client(self.http_client.clone());
238        builder.set_sleep_impl(self.sleep_impl.clone());
239        builder.build()
240    }
241
242    // When all crate features are disabled, these accessors are unused
243
244    #[allow(dead_code)]
245    pub(crate) fn env(&self) -> Env {
246        self.env.clone()
247    }
248
249    #[allow(dead_code)]
250    pub(crate) fn fs(&self) -> Fs {
251        self.fs.clone()
252    }
253
254    #[allow(dead_code)]
255    pub(crate) fn time_source(&self) -> SharedTimeSource {
256        self.time_source.clone()
257    }
258
259    #[allow(dead_code)]
260    pub(crate) fn http_client(&self) -> Option<SharedHttpClient> {
261        self.http_client.clone()
262    }
263
264    #[allow(dead_code)]
265    pub(crate) fn retry_config(&self) -> Option<RetryConfig> {
266        self.retry_config.clone()
267    }
268
269    #[allow(dead_code)]
270    pub(crate) fn sleep_impl(&self) -> Option<SharedAsyncSleep> {
271        self.sleep_impl.clone()
272    }
273
274    #[allow(dead_code)]
275    pub(crate) fn region(&self) -> Option<Region> {
276        self.region.clone()
277    }
278
279    #[allow(dead_code)]
280    pub(crate) fn use_fips(&self) -> Option<bool> {
281        self.use_fips
282    }
283
284    #[allow(dead_code)]
285    pub(crate) fn use_dual_stack(&self) -> Option<bool> {
286        self.use_dual_stack
287    }
288
289    pub(crate) async fn try_profile(&self) -> Result<&ProfileSet, &ProfileFileLoadError> {
290        let parsed_profile = self
291            .parsed_profile
292            .get_or_init(|| async {
293                let profile = profile::load(
294                    &self.fs,
295                    &self.env,
296                    &self.profile_files,
297                    self.profile_name_override.clone(),
298                )
299                .await;
300                if let Err(err) = profile.as_ref() {
301                    tracing::warn!(err = %DisplayErrorContext(&err), "failed to parse profile")
302                }
303                profile
304            })
305            .await;
306        parsed_profile.as_ref()
307    }
308
309    pub(crate) async fn profile(&self) -> Option<&ProfileSet> {
310        self.try_profile().await.ok()
311    }
312
313    /// Override the region for the configuration
314    pub fn with_region(mut self, region: Option<Region>) -> Self {
315        self.region = region;
316        self
317    }
318
319    /// Override the `use_fips` setting.
320    ///
321    /// When set to `Some(true)`, credential providers configured with this
322    /// `ProviderConfig` (e.g., [`DefaultCredentialsChain`], `AssumeRoleProvider`,
323    /// `WebIdentityTokenCredentialsProvider`) will use FIPS-compliant endpoints.
324    ///
325    /// This is the `ProviderConfig` equivalent of
326    /// [`ConfigLoader::use_fips`](crate::ConfigLoader::use_fips). It is needed
327    /// when constructing a `ProviderConfig` directly (e.g., via
328    /// [`ProviderConfig::empty()`]) rather than going through the `ConfigLoader`.
329    ///
330    /// [`DefaultCredentialsChain`]: crate::default_provider::credentials::DefaultCredentialsChain
331    pub fn with_use_fips(mut self, use_fips: Option<bool>) -> Self {
332        self.use_fips = use_fips;
333        self
334    }
335
336    /// Override the `use_dual_stack` setting.
337    ///
338    /// When set to `Some(true)`, credential providers configured with this
339    /// `ProviderConfig` will use dual-stack endpoints.
340    ///
341    /// This is the `ProviderConfig` equivalent of
342    /// [`ConfigLoader::use_dual_stack`](crate::ConfigLoader::use_dual_stack).
343    pub fn with_use_dual_stack(mut self, use_dual_stack: Option<bool>) -> Self {
344        self.use_dual_stack = use_dual_stack;
345        self
346    }
347
348    pub(crate) fn behavior_version(&self) -> Option<BehaviorVersion> {
349        self.behavior_version
350    }
351
352    /// Sets the behavior version for this provider config.
353    pub fn with_behavior_version(mut self, behavior_version: Option<BehaviorVersion>) -> Self {
354        self.behavior_version = behavior_version;
355        self
356    }
357
358    pub(crate) fn with_profile_name(self, profile_name: String) -> Self {
359        let profile_files = self.profile_files.clone();
360        self.with_profile_config(Some(profile_files), Some(profile_name))
361    }
362
363    /// Override the profile file paths (`~/.aws/config` by default) and name (`default` by default)
364    #[allow(deprecated)]
365    pub(crate) fn with_profile_config(
366        self,
367        profile_files: Option<ProfileFiles>,
368        profile_name_override: Option<String>,
369    ) -> Self {
370        // if there is no override, then don't clear out `parsed_profile`.
371        if profile_files.is_none() && profile_name_override.is_none() {
372            return self;
373        }
374        ProviderConfig {
375            // clear out the profile since we need to reparse it
376            parsed_profile: Default::default(),
377            profile_files: profile_files.unwrap_or(self.profile_files),
378            profile_name_override: profile_name_override
379                .map(Cow::Owned)
380                .or(self.profile_name_override),
381            ..self
382        }
383    }
384
385    /// Use the [default region chain](crate::default_provider::region) to set the
386    /// region for this configuration
387    ///
388    /// Note: the `env` and `fs` already set on this provider will be used when loading the default region.
389    pub async fn load_default_region(self) -> Self {
390        use crate::default_provider::region::DefaultRegionChain;
391        let provider_chain = DefaultRegionChain::builder().configure(&self).build();
392        self.with_region(provider_chain.region().await)
393    }
394
395    pub(crate) fn with_fs(self, fs: Fs) -> Self {
396        ProviderConfig {
397            parsed_profile: Default::default(),
398            fs,
399            ..self
400        }
401    }
402
403    pub(crate) fn with_env(self, env: Env) -> Self {
404        ProviderConfig {
405            parsed_profile: Default::default(),
406            env,
407            ..self
408        }
409    }
410
411    /// Override the time source for this configuration
412    pub fn with_time_source(self, time_source: impl TimeSource + 'static) -> Self {
413        ProviderConfig {
414            time_source: time_source.into_shared(),
415            ..self
416        }
417    }
418
419    /// Override the HTTP client for this configuration
420    pub fn with_http_client(self, http_client: impl HttpClient + 'static) -> Self {
421        ProviderConfig {
422            http_client: Some(http_client.into_shared()),
423            ..self
424        }
425    }
426
427    /// Override the sleep implementation for this configuration
428    pub fn with_sleep_impl(self, sleep_impl: impl AsyncSleep + 'static) -> Self {
429        ProviderConfig {
430            sleep_impl: Some(sleep_impl.into_shared()),
431            ..self
432        }
433    }
434
435    /// Override the retry config for this configuration
436    pub fn with_retry_config(self, retry_config: RetryConfig) -> Self {
437        ProviderConfig {
438            retry_config: Some(retry_config),
439            ..self
440        }
441    }
442}
aws_config/provider_config.rs

aws_config/
provider_config.rs
