File Explorer

1const { ProviderError, CredentialsProviderError, loadConfig, NODE_REGION_CONFIG_FILE_OPTIONS } = require("@smithy/core/config");2const { normalizeProvider } = require("@smithy/core");3 4const createCredentialChain = (...credentialProviders) => {5    let expireAfter = -1;6    const baseFunction = async (awsIdentityProperties) => {7        const credentials = await propertyProviderChain(...credentialProviders)(awsIdentityProperties);8        if (!credentials.expiration && expireAfter !== -1) {9            credentials.expiration = new Date(Date.now() + expireAfter);10        }11        return credentials;12    };13    const withOptions = Object.assign(baseFunction, {14        expireAfter(milliseconds) {15            if (milliseconds < 5 * 60_000) {16                throw new Error("@aws-sdk/credential-providers - createCredentialChain(...).expireAfter(ms) may not be called with a duration lower than five minutes.");17            }18            expireAfter = milliseconds;19            return withOptions;20        },21    });22    return withOptions;23};24const propertyProviderChain = (...providers) => async (awsIdentityProperties) => {25    if (providers.length === 0) {26        throw new ProviderError("No providers in chain", { tryNextLink: false });27    }28    let lastProviderError;29    for (const provider of providers) {30        try {31            return await provider(awsIdentityProperties);32        }33        catch (err) {34            lastProviderError = err;35            if (err?.tryNextLink) {36                continue;37            }38            throw err;39        }40    }41    throw lastProviderError;42};43 44const fromCognitoIdentity = (options) => {45    return async (args) => {46        const { fromCognitoIdentity: _fromCognitoIdentity } = require('@aws-sdk/credential-provider-cognito-identity');47        return _fromCognitoIdentity(options)(args);48    };49};50 51const fromCognitoIdentityPool = (options) => {52    return async (args) => {53        const { fromCognitoIdentityPool: _fromCognitoIdentityPool } = require('@aws-sdk/credential-provider-cognito-identity');54        return _fromCognitoIdentityPool(options)(args);55    };56};57 58const fromContainerMetadata = (init) => {59    return async (props) => {60        init?.logger?.debug("@smithy/credential-provider-imds", "fromContainerMetadata");61        const { fromContainerMetadata: _fromContainerMetadata } = require('@smithy/credential-provider-imds');62        return _fromContainerMetadata(init)();63    };64};65 66const fromEnv = (init) => {67    return async (args) => {68        const { fromEnv: _fromEnv } = require('@aws-sdk/credential-provider-env');69        return _fromEnv(init)(args);70    };71};72 73const fromHttp = (options = {}) => {74    return async (args) => {75        const { fromHttp: _fromHttp } = require('@aws-sdk/credential-provider-http');76        return _fromHttp(options)(args);77    };78};79 80const fromIni = (init = {}) => {81    return async (args) => {82        const { fromIni: _fromIni } = require('@aws-sdk/credential-provider-ini');83        return _fromIni({ ...init })(args);84    };85};86 87const fromInstanceMetadata = (init) => {88    return async (props) => {89        init?.logger?.debug("@smithy/credential-provider-imds", "fromInstanceMetadata");90        const { setCredentialFeature } = require('@aws-sdk/core/client');91        const { fromInstanceMetadata: _fromInstanceMetadata } = require('@smithy/credential-provider-imds');92        return _fromInstanceMetadata(init)().then((creds) => setCredentialFeature(creds, "CREDENTIALS_IMDS", "0"));93    };94};95 96const fromLoginCredentials = (init) => {97    return async (args) => {98        const { fromLoginCredentials: _fromLoginCredentials } = require('@aws-sdk/credential-provider-login');99        return _fromLoginCredentials({ ...init })(args);100    };101};102 103const fromNodeProviderChain = (init = {}) => {104    let chain;105    return async (args) => {106        if (!chain) {107            const { defaultProvider } = require('@aws-sdk/credential-provider-node');108            chain = defaultProvider({ ...init });109        }110        return chain(args);111    };112};113 114const fromProcess = (init) => {115    return async (args) => {116        const { fromProcess: _fromProcess } = require('@aws-sdk/credential-provider-process');117        return _fromProcess(init)(args);118    };119};120 121const fromSSO = (init = {}) => {122    return async (args) => {123        const { fromSSO: _fromSSO } = require('@aws-sdk/credential-provider-sso');124        return _fromSSO({ ...init })(args);125    };126};127 128const ASSUME_ROLE_DEFAULT_REGION = "us-east-1";129const fromTemporaryCredentials$1 = (options, credentialDefaultProvider, regionProvider) => {130    let stsClient;131    return async (awsIdentityProperties = {}) => {132        const { callerClientConfig } = awsIdentityProperties;133        const profile = options.clientConfig?.profile ?? callerClientConfig?.profile;134        const logger = options.logger ?? callerClientConfig?.logger;135        logger?.debug("@aws-sdk/credential-providers - fromTemporaryCredentials (STS)");136        const params = { ...options.params, RoleSessionName: options.params.RoleSessionName ?? "aws-sdk-js-" + Date.now() };137        if (params?.SerialNumber) {138            if (!options.mfaCodeProvider) {139                throw new CredentialsProviderError(`Temporary credential requires multi-factor authentication, but no MFA code callback was provided.`, {140                    tryNextLink: false,141                    logger,142                });143            }144            params.TokenCode = await options.mfaCodeProvider(params?.SerialNumber);145        }146        const { AssumeRoleCommand, STSClient } = require('./loadSts-C4jOcYxJ.js');147        if (!stsClient) {148            const defaultCredentialsOrError = typeof credentialDefaultProvider === "function" ? credentialDefaultProvider() : undefined;149            const credentialSources = [150                options.masterCredentials,151                options.clientConfig?.credentials,152                void callerClientConfig?.credentials,153                callerClientConfig?.credentialDefaultProvider?.(),154                defaultCredentialsOrError,155            ];156            let credentialSource = "STS client default credentials";157            if (credentialSources[0]) {158                credentialSource = "options.masterCredentials";159            }160            else if (credentialSources[1]) {161                credentialSource = "options.clientConfig.credentials";162            }163            else if (credentialSources[2]) {164                credentialSource = "caller client's credentials";165                throw new Error("fromTemporaryCredentials recursion in callerClientConfig.credentials");166            }167            else if (credentialSources[3]) {168                credentialSource = "caller client's credentialDefaultProvider";169            }170            else if (credentialSources[4]) {171                credentialSource = "AWS SDK default credentials";172            }173            const regionSources = [174                options.clientConfig?.region,175                callerClientConfig?.region,176                await regionProvider?.({177                    profile,178                }),179                ASSUME_ROLE_DEFAULT_REGION,180            ];181            let regionSource = "default partition's default region";182            if (regionSources[0]) {183                regionSource = "options.clientConfig.region";184            }185            else if (regionSources[1]) {186                regionSource = "caller client's region";187            }188            else if (regionSources[2]) {189                regionSource = "file or env region";190            }191            const requestHandlerSources = [192                filterRequestHandler(options.clientConfig?.requestHandler),193                filterRequestHandler(callerClientConfig?.requestHandler),194            ];195            let requestHandlerSource = "STS default requestHandler";196            if (requestHandlerSources[0]) {197                requestHandlerSource = "options.clientConfig.requestHandler";198            }199            else if (requestHandlerSources[1]) {200                requestHandlerSource = "caller client's requestHandler";201            }202            logger?.debug?.(`@aws-sdk/credential-providers - fromTemporaryCredentials STS client init with ` +203                `${regionSource}=${await normalizeProvider(coalesce(regionSources))()}, ${credentialSource}, ${requestHandlerSource}.`);204            stsClient = new STSClient({205                userAgentAppId: callerClientConfig?.userAgentAppId,206                ...options.clientConfig,207                credentials: coalesce(credentialSources),208                logger,209                profile,210                region: coalesce(regionSources),211                requestHandler: coalesce(requestHandlerSources),212            });213        }214        if (options.clientPlugins) {215            for (const plugin of options.clientPlugins) {216                stsClient.middlewareStack.use(plugin);217            }218        }219        const { Credentials } = await stsClient.send(new AssumeRoleCommand(params));220        if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {221            throw new CredentialsProviderError(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`, {222                logger,223            });224        }225        return {226            accessKeyId: Credentials.AccessKeyId,227            secretAccessKey: Credentials.SecretAccessKey,228            sessionToken: Credentials.SessionToken,229            expiration: Credentials.Expiration,230            credentialScope: Credentials.CredentialScope,231        };232    };233};234const filterRequestHandler = (requestHandler) => {235    return requestHandler?.metadata?.handlerProtocol === "h2" ? undefined : requestHandler;236};237const coalesce = (args) => {238    for (const item of args) {239        if (item !== undefined) {240            return item;241        }242    }243};244 245const fromTemporaryCredentials = (options) => {246    return fromTemporaryCredentials$1(options, fromNodeProviderChain, async ({ profile = process.env.AWS_PROFILE }) => loadConfig({247        environmentVariableSelector: (env) => env.AWS_REGION,248        configFileSelector: (profileData) => {249            return profileData.region;250        },251        default: () => undefined,252    }, { ...NODE_REGION_CONFIG_FILE_OPTIONS, profile })());253};254 255const fromTokenFile = (init = {}) => {256    return async (args) => {257        const { fromTokenFile: _fromTokenFile } = require('@aws-sdk/credential-provider-web-identity');258        return _fromTokenFile({ ...init })(args);259    };260};261 262const fromWebToken = (init) => {263    return async (args) => {264        const { fromWebToken: _fromWebToken } = require('@aws-sdk/credential-provider-web-identity');265        return _fromWebToken({ ...init })(args);266    };267};268 269exports.createCredentialChain = createCredentialChain;270exports.fromCognitoIdentity = fromCognitoIdentity;271exports.fromCognitoIdentityPool = fromCognitoIdentityPool;272exports.fromContainerMetadata = fromContainerMetadata;273exports.fromEnv = fromEnv;274exports.fromHttp = fromHttp;275exports.fromIni = fromIni;276exports.fromInstanceMetadata = fromInstanceMetadata;277exports.fromLoginCredentials = fromLoginCredentials;278exports.fromNodeProviderChain = fromNodeProviderChain;279exports.fromProcess = fromProcess;280exports.fromSSO = fromSSO;281exports.fromTemporaryCredentials = fromTemporaryCredentials;282exports.fromTokenFile = fromTokenFile;283exports.fromWebToken = fromWebToken;284exports.propertyProviderChain = propertyProviderChain;285