File Explorer

1"use strict";2Object.defineProperty(exports, "__esModule", { value: true });3exports.fromTemporaryCredentials = void 0;4const core_1 = require("@smithy/core");5const config_1 = require("@smithy/core/config");6const ASSUME_ROLE_DEFAULT_REGION = "us-east-1";7const fromTemporaryCredentials = (options, credentialDefaultProvider, regionProvider) => {8    let stsClient;9    return async (awsIdentityProperties = {}) => {10        const { callerClientConfig } = awsIdentityProperties;11        const profile = options.clientConfig?.profile ?? callerClientConfig?.profile;12        const logger = options.logger ?? callerClientConfig?.logger;13        logger?.debug("@aws-sdk/credential-providers - fromTemporaryCredentials (STS)");14        const params = { ...options.params, RoleSessionName: options.params.RoleSessionName ?? "aws-sdk-js-" + Date.now() };15        if (params?.SerialNumber) {16            if (!options.mfaCodeProvider) {17                throw new config_1.CredentialsProviderError(`Temporary credential requires multi-factor authentication, but no MFA code callback was provided.`, {18                    tryNextLink: false,19                    logger,20                });21            }22            params.TokenCode = await options.mfaCodeProvider(params?.SerialNumber);23        }24        const { AssumeRoleCommand, STSClient } = await import("./loadSts.js");25        if (!stsClient) {26            const defaultCredentialsOrError = typeof credentialDefaultProvider === "function" ? credentialDefaultProvider() : undefined;27            const credentialSources = [28                options.masterCredentials,29                options.clientConfig?.credentials,30                void callerClientConfig?.credentials,31                callerClientConfig?.credentialDefaultProvider?.(),32                defaultCredentialsOrError,33            ];34            let credentialSource = "STS client default credentials";35            if (credentialSources[0]) {36                credentialSource = "options.masterCredentials";37            }38            else if (credentialSources[1]) {39                credentialSource = "options.clientConfig.credentials";40            }41            else if (credentialSources[2]) {42                credentialSource = "caller client's credentials";43                throw new Error("fromTemporaryCredentials recursion in callerClientConfig.credentials");44            }45            else if (credentialSources[3]) {46                credentialSource = "caller client's credentialDefaultProvider";47            }48            else if (credentialSources[4]) {49                credentialSource = "AWS SDK default credentials";50            }51            const regionSources = [52                options.clientConfig?.region,53                callerClientConfig?.region,54                await regionProvider?.({55                    profile,56                }),57                ASSUME_ROLE_DEFAULT_REGION,58            ];59            let regionSource = "default partition's default region";60            if (regionSources[0]) {61                regionSource = "options.clientConfig.region";62            }63            else if (regionSources[1]) {64                regionSource = "caller client's region";65            }66            else if (regionSources[2]) {67                regionSource = "file or env region";68            }69            const requestHandlerSources = [70                filterRequestHandler(options.clientConfig?.requestHandler),71                filterRequestHandler(callerClientConfig?.requestHandler),72            ];73            let requestHandlerSource = "STS default requestHandler";74            if (requestHandlerSources[0]) {75                requestHandlerSource = "options.clientConfig.requestHandler";76            }77            else if (requestHandlerSources[1]) {78                requestHandlerSource = "caller client's requestHandler";79            }80            logger?.debug?.(`@aws-sdk/credential-providers - fromTemporaryCredentials STS client init with ` +81                `${regionSource}=${await (0, core_1.normalizeProvider)(coalesce(regionSources))()}, ${credentialSource}, ${requestHandlerSource}.`);82            stsClient = new STSClient({83                userAgentAppId: callerClientConfig?.userAgentAppId,84                ...options.clientConfig,85                credentials: coalesce(credentialSources),86                logger,87                profile,88                region: coalesce(regionSources),89                requestHandler: coalesce(requestHandlerSources),90            });91        }92        if (options.clientPlugins) {93            for (const plugin of options.clientPlugins) {94                stsClient.middlewareStack.use(plugin);95            }96        }97        const { Credentials } = await stsClient.send(new AssumeRoleCommand(params));98        if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {99            throw new config_1.CredentialsProviderError(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`, {100                logger,101            });102        }103        return {104            accessKeyId: Credentials.AccessKeyId,105            secretAccessKey: Credentials.SecretAccessKey,106            sessionToken: Credentials.SessionToken,107            expiration: Credentials.Expiration,108            credentialScope: Credentials.CredentialScope,109        };110    };111};112exports.fromTemporaryCredentials = fromTemporaryCredentials;113const filterRequestHandler = (requestHandler) => {114    return requestHandler?.metadata?.handlerProtocol === "h2" ? undefined : requestHandler;115};116const coalesce = (args) => {117    for (const item of args) {118        if (item !== undefined) {119            return item;120        }121    }122};123