Skip to content

Commit 978251f

Browse files
ashishdhingraashishdhingra
committed
Updated credential providers to provide Async version for generating credentials.
1 parent d32fd15 commit 978251f

27 files changed

+1441
-308
lines changed

‎generator/.DevConfigs/9fa1d027-8266-430e-b4c0-a541eb733f8e.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"core": {
3+
"changeLogMessages": [
4+
"Updated credential providers to provide Async version for generating credentials."
5+
],
6+
"type": "patch",
7+
"updateMinimum": true
8+
},
9+
"services": [
10+
{
11+
"serviceName": "SecurityToken",
12+
"type": "patch",
13+
"changeLogMessages": [
14+
"Added async code paths for the SAML and Assume role credentials providers."
15+
]
16+
}
17+
]
18+
}

‎sdk/src/Core/Amazon.Runtime/Credentials/AWSCredentials.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,9 @@ public abstract class AWSCredentials : BaseIdentity
3535
/// </summary>
3636
protected virtual void Validate() { }
3737

38-
#if AWS_ASYNC_API
3938
public virtual System.Threading.Tasks.Task<ImmutableCredentials> GetCredentialsAsync()
4039
{
4140
return System.Threading.Tasks.Task.FromResult<ImmutableCredentials>(this.GetCredentials());
4241
}
43-
#endif
4442
}
4543
}

‎sdk/src/Core/Amazon.Runtime/Credentials/AssumeRoleAWSCredentials.cs‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
using System.Net;
2323
using System.Diagnostics.CodeAnalysis;
2424
using ThirdParty.RuntimeBackports;
25+
using System.Threading.Tasks;
2526

2627
namespace Amazon.Runtime
2728
{
@@ -91,13 +92,32 @@ public AssumeRoleAWSCredentials(AWSCredentials sourceCredentials, string roleArn
9192
PreemptExpiryTime = TimeSpan.FromMinutes(15);
9293
}
9394

94-
[UnconditionalSuppressMessage("ReflectionAnalysis", "IL2026",
95-
Justification = "Reflection code is only used as a fallback in case the SDK was not trimmed. Trimmed scenarios should register dependencies with Amazon.RuntimeDependencyRegistry.GlobalRuntimeDependencyRegistry")]
9695
protected override CredentialsRefreshState GenerateNewCredentials()
9796
{
9897
var region = FallbackRegionFactory.GetRegionEndpoint() ?? DefaultSTSClientRegion;
98+
ICoreAmazonSTS coreSTSClient = GetSTSClient(region);
99+
100+
var credentials = coreSTSClient.CredentialsFromAssumeRoleAuthentication(RoleArn, RoleSessionName, Options);
101+
_logger.DebugFormat("New credentials created for assume role that expire at {0}", credentials.Expiration.ToString("yyyy-MM-ddTHH:mm:ss.fffffffK", CultureInfo.InvariantCulture));
102+
return new CredentialsRefreshState(credentials, credentials.Expiration);
103+
}
104+
105+
protected override async Task<CredentialsRefreshState> GenerateNewCredentialsAsync()
106+
{
107+
var region = FallbackRegionFactory.GetRegionEndpoint() ?? DefaultSTSClientRegion;
108+
ICoreAmazonSTS coreSTSClient = GetSTSClient(region);
109+
110+
var credentials = await coreSTSClient.CredentialsFromAssumeRoleAuthenticationAsync(RoleArn, RoleSessionName, Options).ConfigureAwait(false);
111+
_logger.DebugFormat("New credentials created for assume role that expire at {0}", credentials.Expiration.ToString("yyyy-MM-ddTHH:mm:ss.fffffffK", CultureInfo.InvariantCulture));
112+
return new CredentialsRefreshState(credentials, credentials.Expiration);
113+
}
114+
115+
[UnconditionalSuppressMessage("ReflectionAnalysis", "IL2026",
116+
Justification = "Reflection code is only used as a fallback in case the SDK was not trimmed. Trimmed scenarios should register dependencies with Amazon.RuntimeDependencyRegistry.GlobalRuntimeDependencyRegistry")]
117+
private ICoreAmazonSTS GetSTSClient(RegionEndpoint region)
118+
{
99119
ICoreAmazonSTS coreSTSClient = GlobalRuntimeDependencyRegistry.Instance.GetInstance<ICoreAmazonSTS>(ServiceClientHelpers.STS_ASSEMBLY_NAME, ServiceClientHelpers.STS_SERVICE_CLASS_NAME,
100-
new CreateInstanceContext(new SecurityTokenServiceClientContext {Action = SecurityTokenServiceClientContext.ActionContext.AssumeRoleAWSCredentials, Region = region, ProxySettings = Options?.ProxySettings } ));
120+
new CreateInstanceContext(new SecurityTokenServiceClientContext { Action = SecurityTokenServiceClientContext.ActionContext.AssumeRoleAWSCredentials, Region = region, ProxySettings = Options?.ProxySettings }));
101121

102122
if (coreSTSClient == null)
103123
{
@@ -130,11 +150,7 @@ protected override CredentialsRefreshState GenerateNewCredentials()
130150
}
131151
}
132152

133-
134-
135-
var credentials = coreSTSClient.CredentialsFromAssumeRoleAuthentication(RoleArn, RoleSessionName, Options);
136-
_logger.DebugFormat("New credentials created for assume role that expire at {0}", credentials.Expiration.ToString("yyyy-MM-ddTHH:mm:ss.fffffffK", CultureInfo.InvariantCulture));
137-
return new CredentialsRefreshState(credentials, credentials.Expiration);
153+
return coreSTSClient;
138154
}
139155
}
140156
}

‎sdk/src/Core/Amazon.Runtime/Credentials/AssumeRoleWithWebIdentityCredentials.cs‎

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,7 @@
2525
using System.IO;
2626
using System.Net;
2727
using System.Text.RegularExpressions;
28-
#if AWS_ASYNC_API
2928
using System.Threading.Tasks;
30-
#endif
3129

3230
namespace Amazon.Runtime
3331
{
@@ -172,16 +170,12 @@ protected override CredentialsRefreshState GenerateNewCredentials()
172170
}
173171
}
174172

175-
AssumeRoleImmutableCredentials credentials;
176-
using (var coreStsClient = CreateClient())
177-
{
178-
credentials = coreStsClient.CredentialsFromAssumeRoleWithWebIdentityAuthentication(token, RoleArn, RoleSessionName, _options); // Will retry InvalidIdentityToken and IDPCommunicationError
179-
}
173+
var coreStsClient = CreateClient();
174+
AssumeRoleImmutableCredentials credentials = coreStsClient.CredentialsFromAssumeRoleWithWebIdentityAuthentication(token, RoleArn, RoleSessionName, _options); // Will retry InvalidIdentityToken and IDPCommunicationError
180175
_logger.DebugFormat("New credentials created using assume role with web identity that expire at {0}", credentials.Expiration.ToString("yyyy-MM-ddTHH:mm:ss.fffffffK", CultureInfo.InvariantCulture));
181176
return new CredentialsRefreshState(credentials, credentials.Expiration);
182177
}
183178

184-
#if AWS_ASYNC_API
185179
protected override async Task<CredentialsRefreshState> GenerateNewCredentialsAsync()
186180
{
187181
string token = null;
@@ -210,27 +204,23 @@ protected override async Task<CredentialsRefreshState> GenerateNewCredentialsAsy
210204
}
211205
}
212206

213-
AssumeRoleImmutableCredentials credentials;
214-
using (var coreStsClient = CreateClient())
215-
{
216-
credentials = await coreStsClient.CredentialsFromAssumeRoleWithWebIdentityAuthenticationAsync(token, RoleArn, RoleSessionName, _options).ConfigureAwait(false); // Will retry InvalidIdentityToken and IDPCommunicationError
217-
}
207+
var coreStsClient = CreateClient();
208+
AssumeRoleImmutableCredentials credentials = await coreStsClient.CredentialsFromAssumeRoleWithWebIdentityAuthenticationAsync(token, RoleArn, RoleSessionName, _options).ConfigureAwait(false); // Will retry InvalidIdentityToken and IDPCommunicationError
218209
_logger.DebugFormat("New credentials created using assume role with web identity that expire at {0}", credentials.Expiration.ToString("yyyy-MM-ddTHH:mm:ss.fffffffK", CultureInfo.InvariantCulture));
219210
return new CredentialsRefreshState(credentials, credentials.Expiration);
220211
}
221-
#endif
222212

223213
/// <summary>
224214
/// Gets a client to be used for AssumeRoleWithWebIdentity requests.
225215
/// </summary>
226216
/// <returns>The STS client.</returns>
227217
[UnconditionalSuppressMessage("ReflectionAnalysis", "IL2026",
228218
Justification = "Reflection code is only used as a fallback in case the SDK was not trimmed. Trimmed scenarios should register dependencies with Amazon.RuntimeDependencyRegistry.GlobalRuntimeDependencyRegistry")]
229-
protected virtual ICoreAmazonSTS_WebIdentity CreateClient()
219+
protected virtual ICoreAmazonSTS CreateClient()
230220
{
231221
var region = FallbackRegionFactory.GetRegionEndpoint() ?? _defaultSTSClientRegion;
232222

233-
ICoreAmazonSTS_WebIdentity coreSTSClient = GlobalRuntimeDependencyRegistry.Instance.GetInstance<ICoreAmazonSTS_WebIdentity>(ServiceClientHelpers.STS_ASSEMBLY_NAME, ServiceClientHelpers.STS_SERVICE_CLASS_NAME,
223+
ICoreAmazonSTS coreSTSClient = GlobalRuntimeDependencyRegistry.Instance.GetInstance<ICoreAmazonSTS>(ServiceClientHelpers.STS_ASSEMBLY_NAME, ServiceClientHelpers.STS_SERVICE_CLASS_NAME,
234224
new CreateInstanceContext(new SecurityTokenServiceClientContext { Action = SecurityTokenServiceClientContext.ActionContext.AssumeRoleAWSCredentials, Region = region, ProxySettings = _options?.ProxySettings }));
235225
if(coreSTSClient == null)
236226
{
@@ -244,7 +234,7 @@ protected virtual ICoreAmazonSTS_WebIdentity CreateClient()
244234
stsConfig.SetWebProxy(_options.ProxySettings);
245235
}
246236

247-
coreSTSClient = ServiceClientHelpers.CreateServiceFromAssembly<ICoreAmazonSTS_WebIdentity>(
237+
coreSTSClient = ServiceClientHelpers.CreateServiceFromAssembly<ICoreAmazonSTS>(
248238
ServiceClientHelpers.STS_ASSEMBLY_NAME, ServiceClientHelpers.STS_SERVICE_CLASS_NAME, new AnonymousAWSCredentials(), region);
249239
}
250240
catch (Exception e)

‎sdk/src/Core/Amazon.Runtime/Credentials/DefaultInstanceProfileAWSCredentials.cs‎

Lines changed: 107 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ private DefaultInstanceProfileAWSCredentials()
8181

8282
_logger = Logger.GetLogger(typeof(DefaultInstanceProfileAWSCredentials));
8383

84-
_credentialsRetrieverTimer = new Timer(RenewCredentials, null, TimeSpan.Zero, _neverTimespan);
84+
_credentialsRetrieverTimer = new Timer(RenewCredentials, null, TimeSpan.Zero, _neverTimespan); // This invokes synchronous calls in seperate thread.
8585
}
8686

8787
#region Overrides
@@ -174,15 +174,94 @@ public override ImmutableCredentials GetCredentials()
174174
return credentials;
175175
}
176176

177-
#if AWS_ASYNC_API
178177
/// <summary>
179178
/// Returns a copy of the most recent instance profile credentials.
180179
/// </summary>
181-
public override Task<ImmutableCredentials> GetCredentialsAsync()
180+
public override async Task<ImmutableCredentials> GetCredentialsAsync()
182181
{
183-
return Task.FromResult<ImmutableCredentials>(GetCredentials());
182+
CheckIsIMDSEnabled();
183+
ImmutableCredentials credentials = null;
184+
185+
// Try to acquire read lock. The thread would be blocked if another thread has write lock.
186+
if (_credentialsLock.TryEnterReadLock(_credentialsLockTimeout))
187+
{
188+
try
189+
{
190+
if (null != _lastRetrievedCredentials)
191+
{
192+
if (_lastRetrievedCredentials.IsExpiredWithin(TimeSpan.Zero) &&
193+
!_imdsRefreshFailed)
194+
{
195+
// this is the first failure - immediately try to renew
196+
_imdsRefreshFailed = true;
197+
_lastRetrievedCredentials = await FetchCredentialsAsync().ConfigureAwait(false);
198+
}
199+
200+
// if credentials are expired, we'll still return them, but log a message about
201+
// them being expired.
202+
if (_lastRetrievedCredentials.IsExpiredWithin(TimeSpan.Zero))
203+
{
204+
_logger.InfoFormat(_usingExpiredCredentialsFromIMDS);
205+
}
206+
else
207+
{
208+
_imdsRefreshFailed = false;
209+
}
210+
211+
return _lastRetrievedCredentials?.Credentials.Copy();
212+
}
213+
}
214+
finally
215+
{
216+
_credentialsLock.ExitReadLock();
217+
}
218+
}
219+
220+
// If there's no credentials cached, hit IMDS directly. Try to acquire write lock.
221+
if (_credentialsLock.TryEnterWriteLock(_credentialsLockTimeout))
222+
{
223+
try
224+
{
225+
// Check for last retrieved credentials again in case other thread might have already fetched it.
226+
if (null == _lastRetrievedCredentials)
227+
{
228+
_lastRetrievedCredentials = await FetchCredentialsAsync().ConfigureAwait(false);
229+
}
230+
231+
if (_lastRetrievedCredentials.IsExpiredWithin(TimeSpan.Zero) &&
232+
!_imdsRefreshFailed)
233+
{
234+
// this is the first failure - immediately try to renew
235+
_imdsRefreshFailed = true;
236+
_lastRetrievedCredentials = await FetchCredentialsAsync().ConfigureAwait(false);
237+
}
238+
239+
// if credentials are expired, we'll still return them, but log a message about
240+
// them being expired.
241+
if (_lastRetrievedCredentials.IsExpiredWithin(TimeSpan.Zero))
242+
{
243+
_logger.InfoFormat(_usingExpiredCredentialsFromIMDS);
244+
}
245+
else
246+
{
247+
_imdsRefreshFailed = false;
248+
}
249+
250+
credentials = _lastRetrievedCredentials.Credentials?.Copy();
251+
}
252+
finally
253+
{
254+
_credentialsLock.ExitWriteLock();
255+
}
256+
}
257+
258+
if (credentials == null)
259+
{
260+
throw new AmazonServiceException(FailedToGetCredentialsMessage);
261+
}
262+
263+
return credentials;
184264
}
185-
#endif
186265
#endregion
187266

188267
#region Private members
@@ -241,6 +320,28 @@ private static RefreshingAWSCredentials.CredentialsRefreshState FetchCredentials
241320
if (securityCredentials == null)
242321
throw new AmazonServiceException("Unable to get IAM security credentials from EC2 Instance Metadata Service.");
243322

323+
IAMSecurityCredentialMetadata metadata = GetMetadataFromSecurityCredentials(securityCredentials);
324+
325+
return new RefreshingAWSCredentials.CredentialsRefreshState(
326+
new ImmutableCredentials(metadata.AccessKeyId, metadata.SecretAccessKey, metadata.Token),
327+
metadata.Expiration);
328+
}
329+
330+
private static async Task<RefreshingAWSCredentials.CredentialsRefreshState> FetchCredentialsAsync()
331+
{
332+
var securityCredentials = await EC2InstanceMetadata.GetIAMSecurityCredentialsAsync().ConfigureAwait(false);
333+
if (securityCredentials == null)
334+
throw new AmazonServiceException("Unable to get IAM security credentials from EC2 Instance Metadata Service.");
335+
336+
IAMSecurityCredentialMetadata metadata = GetMetadataFromSecurityCredentials(securityCredentials);
337+
338+
return new RefreshingAWSCredentials.CredentialsRefreshState(
339+
new ImmutableCredentials(metadata.AccessKeyId, metadata.SecretAccessKey, metadata.Token),
340+
metadata.Expiration);
341+
}
342+
343+
private static IAMSecurityCredentialMetadata GetMetadataFromSecurityCredentials(System.Collections.Generic.IDictionary<string, IAMSecurityCredentialMetadata> securityCredentials)
344+
{
244345
string firstRole = null;
245346
foreach (var role in securityCredentials.Keys)
246347
{
@@ -255,9 +356,7 @@ private static RefreshingAWSCredentials.CredentialsRefreshState FetchCredentials
255356
if (metadata == null)
256357
throw new AmazonServiceException("Unable to get credentials for role \"" + firstRole + "\" from EC2 Instance Metadata Service.");
257358

258-
return new RefreshingAWSCredentials.CredentialsRefreshState(
259-
new ImmutableCredentials(metadata.AccessKeyId, metadata.SecretAccessKey, metadata.Token),
260-
metadata.Expiration);
359+
return metadata;
261360
}
262361

263362
private static void CheckIsIMDSEnabled()

0 commit comments

Comments
 (0)