Skip to content

Commit 17a7da5

Browse files
cenedhryncenedhryn
authored
Adds accountId as a parameter to AWS credentials identity (#4029)
1 parent bddbd56 commit 17a7da5

File tree

8 files changed

+80
-2
lines changed

8 files changed

+80
-2
lines changed

‎core/aws-core/src/main/java/software/amazon/awssdk/awscore/internal/authcontext/AwsCredentialsAuthorizationStrategy.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import software.amazon.awssdk.auth.credentials.AwsCredentials;
2121
import software.amazon.awssdk.auth.credentials.CredentialUtils;
2222
import software.amazon.awssdk.auth.signer.AwsSignerExecutionAttribute;
23+
import software.amazon.awssdk.awscore.AwsExecutionAttribute;
2324
import software.amazon.awssdk.awscore.AwsRequestOverrideConfiguration;
2425
import software.amazon.awssdk.core.RequestOverrideConfiguration;
2526
import software.amazon.awssdk.core.SdkRequest;
@@ -80,6 +81,8 @@ public void addCredentialsToExecutionAttributes(ExecutionAttributes executionAtt
8081
AwsCredentials credentials = CredentialUtils.toCredentials(resolveCredentials(credentialsProvider, metricCollector));
8182
// TODO: Should the signer be changed to use AwsCredentialsIdentity? Maybe with Signer SRA work, not now.
8283
executionAttributes.putAttribute(AwsSignerExecutionAttribute.AWS_CREDENTIALS, credentials);
84+
// TODO: A separate execution attribute is not strictly needed; this can be optimized before release
85+
executionAttributes.putAttribute(AwsExecutionAttribute.AWS_AUTH_ACCOUNT_ID, credentials.accountId().orElse(null));
8386
}
8487

8588
/**

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/AwsCredentialsIdentity.java

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515

1616
package software.amazon.awssdk.identity.spi;
1717

18+
import java.util.Optional;
1819
import software.amazon.awssdk.annotations.SdkPublicApi;
1920
import software.amazon.awssdk.annotations.ThreadSafe;
2021
import software.amazon.awssdk.identity.spi.internal.DefaultAwsCredentialsIdentity;
@@ -43,6 +44,13 @@ public interface AwsCredentialsIdentity extends Identity {
4344
*/
4445
String secretAccessKey();
4546

47+
/**
48+
* Retrieve the AWS account id associated with this credentials identity, if found.
49+
*/
50+
default Optional<String> accountId() {
51+
return Optional.empty();
52+
}
53+
4654
static Builder builder() {
4755
return DefaultAwsCredentialsIdentity.builder();
4856
}
@@ -70,6 +78,11 @@ interface Builder {
7078
*/
7179
Builder secretAccessKey(String secretAccessKey);
7280

81+
/**
82+
* The AWS account id associated with this credentials identity.
83+
*/
84+
Builder accountId(String accountId);
85+
7386
AwsCredentialsIdentity build();
7487
}
7588
}

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/AwsSessionCredentialsIdentity.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ interface Builder extends AwsCredentialsIdentity.Builder {
6060
@Override
6161
Builder secretAccessKey(String secretAccessKey);
6262

63+
@Override
64+
Builder accountId(String accountId);
65+
6366
/**
6467
* The AWS session token, retrieved from an AWS token service, used for authenticating that this user has
6568
* received temporary permission to access some resource.

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/internal/DefaultAwsCredentialsIdentity.java

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package software.amazon.awssdk.identity.spi.internal;
1717

1818
import java.util.Objects;
19+
import java.util.Optional;
1920
import software.amazon.awssdk.annotations.SdkInternalApi;
2021
import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
2122
import software.amazon.awssdk.utils.ToString;
@@ -26,10 +27,12 @@ public final class DefaultAwsCredentialsIdentity implements AwsCredentialsIdenti
2627

2728
private final String accessKeyId;
2829
private final String secretAccessKey;
30+
private final String accountId;
2931

3032
private DefaultAwsCredentialsIdentity(Builder builder) {
3133
this.accessKeyId = builder.accessKeyId;
3234
this.secretAccessKey = builder.secretAccessKey;
35+
this.accountId = builder.accountId;
3336

3437
Validate.paramNotNull(accessKeyId, "accessKeyId");
3538
Validate.paramNotNull(secretAccessKey, "secretAccessKey");
@@ -49,10 +52,16 @@ public String secretAccessKey() {
4952
return secretAccessKey;
5053
}
5154

55+
@Override
56+
public Optional<String> accountId() {
57+
return Optional.ofNullable(accountId);
58+
}
59+
5260
@Override
5361
public String toString() {
5462
return ToString.builder("AwsCredentialsIdentity")
5563
.add("accessKeyId", accessKeyId)
64+
.add("accountId", accountId)
5665
.build();
5766
}
5867

@@ -66,20 +75,23 @@ public boolean equals(Object o) {
6675
}
6776
AwsCredentialsIdentity that = (AwsCredentialsIdentity) o;
6877
return Objects.equals(accessKeyId, that.accessKeyId()) &&
69-
Objects.equals(secretAccessKey, that.secretAccessKey());
78+
Objects.equals(secretAccessKey, that.secretAccessKey()) &&
79+
Objects.equals(accountId, that.accountId().orElse(null));
7080
}
7181

7282
@Override
7383
public int hashCode() {
7484
int hashCode = 1;
7585
hashCode = 31 * hashCode + Objects.hashCode(accessKeyId);
7686
hashCode = 31 * hashCode + Objects.hashCode(secretAccessKey);
87+
hashCode = 31 * hashCode + Objects.hashCode(accountId);
7788
return hashCode;
7889
}
7990

8091
private static final class Builder implements AwsCredentialsIdentity.Builder {
8192
private String accessKeyId;
8293
private String secretAccessKey;
94+
private String accountId;
8395

8496
private Builder() {
8597
}
@@ -96,6 +108,12 @@ public Builder secretAccessKey(String secretAccessKey) {
96108
return this;
97109
}
98110

111+
@Override
112+
public Builder accountId(String accountId) {
113+
this.accountId = accountId;
114+
return this;
115+
}
116+
99117
@Override
100118
public AwsCredentialsIdentity build() {
101119
return new DefaultAwsCredentialsIdentity(this);

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/internal/DefaultAwsSessionCredentialsIdentity.java

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package software.amazon.awssdk.identity.spi.internal;
1717

1818
import java.util.Objects;
19+
import java.util.Optional;
1920
import software.amazon.awssdk.annotations.SdkInternalApi;
2021
import software.amazon.awssdk.identity.spi.AwsSessionCredentialsIdentity;
2122
import software.amazon.awssdk.utils.ToString;
@@ -27,11 +28,14 @@ public final class DefaultAwsSessionCredentialsIdentity implements AwsSessionCre
2728
private final String accessKeyId;
2829
private final String secretAccessKey;
2930
private final String sessionToken;
31+
private final String accountId;
32+
3033

3134
private DefaultAwsSessionCredentialsIdentity(Builder builder) {
3235
this.accessKeyId = builder.accessKeyId;
3336
this.secretAccessKey = builder.secretAccessKey;
3437
this.sessionToken = builder.sessionToken;
38+
this.accountId = builder.accountId;
3539

3640
Validate.paramNotNull(accessKeyId, "accessKeyId");
3741
Validate.paramNotNull(secretAccessKey, "secretAccessKey");
@@ -52,6 +56,11 @@ public String secretAccessKey() {
5256
return secretAccessKey;
5357
}
5458

59+
@Override
60+
public Optional<String> accountId() {
61+
return Optional.ofNullable(accountId);
62+
}
63+
5564
@Override
5665
public String sessionToken() {
5766
return sessionToken;
@@ -61,6 +70,7 @@ public String sessionToken() {
6170
public String toString() {
6271
return ToString.builder("AwsSessionCredentialsIdentity")
6372
.add("accessKeyId", accessKeyId)
73+
.add("accountId", accountId)
6474
.build();
6575
}
6676

@@ -75,7 +85,8 @@ public boolean equals(Object o) {
7585
AwsSessionCredentialsIdentity that = (AwsSessionCredentialsIdentity) o;
7686
return Objects.equals(accessKeyId, that.accessKeyId()) &&
7787
Objects.equals(secretAccessKey, that.secretAccessKey()) &&
78-
Objects.equals(sessionToken, that.sessionToken());
88+
Objects.equals(sessionToken, that.sessionToken()) &&
89+
Objects.equals(accountId, that.accountId().orElse(null));
7990
}
8091

8192
@Override
@@ -84,13 +95,15 @@ public int hashCode() {
8495
hashCode = 31 * hashCode + Objects.hashCode(accessKeyId);
8596
hashCode = 31 * hashCode + Objects.hashCode(secretAccessKey);
8697
hashCode = 31 * hashCode + Objects.hashCode(sessionToken);
98+
hashCode = 31 * hashCode + Objects.hashCode(accountId);
8799
return hashCode;
88100
}
89101

90102
private static final class Builder implements AwsSessionCredentialsIdentity.Builder {
91103
private String accessKeyId;
92104
private String secretAccessKey;
93105
private String sessionToken;
106+
private String accountId;
94107

95108
private Builder() {
96109
}
@@ -113,6 +126,13 @@ public Builder sessionToken(String sessionToken) {
113126
return this;
114127
}
115128

129+
130+
@Override
131+
public Builder accountId(String accountId) {
132+
this.accountId = accountId;
133+
return this;
134+
}
135+
116136
@Override
117137
public AwsSessionCredentialsIdentity build() {
118138
return new DefaultAwsSessionCredentialsIdentity(this);

‎core/identity-spi/src/test/java/software/amazon/awssdk/identity/spi/AwsCredentialsIdentityTest.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@
1616
package software.amazon.awssdk.identity.spi;
1717

1818
import static org.junit.jupiter.api.Assertions.assertEquals;
19+
import static org.junit.jupiter.api.Assertions.assertFalse;
1920
import static org.junit.jupiter.api.Assertions.assertThrows;
21+
import static org.junit.jupiter.api.Assertions.assertTrue;
2022

2123
import nl.jqno.equalsverifier.EqualsVerifier;
2224
import org.junit.jupiter.api.Test;
@@ -26,6 +28,7 @@
2628
public class AwsCredentialsIdentityTest {
2729
private static final String ACCESS_KEY_ID = "accessKeyId";
2830
private static final String SECRET_ACCESS_KEY = "secretAccessKey";
31+
private static final String ACCOUNT_ID = "accountId";
2932

3033
@Test
3134
public void equalsHashcode() {
@@ -53,15 +56,19 @@ public void create_isSuccessful() {
5356
AwsCredentialsIdentity identity = AwsCredentialsIdentity.create(ACCESS_KEY_ID, SECRET_ACCESS_KEY);
5457
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
5558
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
59+
assertFalse(identity.accountId().isPresent());
5660
}
5761

5862
@Test
5963
public void build_isSuccessful() {
6064
AwsCredentialsIdentity identity = AwsCredentialsIdentity.builder()
6165
.accessKeyId(ACCESS_KEY_ID)
6266
.secretAccessKey(SECRET_ACCESS_KEY)
67+
.accountId(ACCOUNT_ID)
6368
.build();
6469
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
6570
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
71+
assertTrue(identity.accountId().isPresent());
72+
assertEquals(ACCOUNT_ID, identity.accountId().get());
6673
}
6774
}

‎core/identity-spi/src/test/java/software/amazon/awssdk/identity/spi/AwsSessionCredentialsIdentityTest.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@
1616
package software.amazon.awssdk.identity.spi;
1717

1818
import static org.junit.jupiter.api.Assertions.assertEquals;
19+
import static org.junit.jupiter.api.Assertions.assertFalse;
1920
import static org.junit.jupiter.api.Assertions.assertThrows;
21+
import static org.junit.jupiter.api.Assertions.assertTrue;
2022

2123
import nl.jqno.equalsverifier.EqualsVerifier;
2224
import org.junit.jupiter.api.Test;
@@ -27,6 +29,7 @@ public class AwsSessionCredentialsIdentityTest {
2729
private static final String ACCESS_KEY_ID = "accessKeyId";
2830
private static final String SECRET_ACCESS_KEY = "secretAccessKey";
2931
private static final String SESSION_TOKEN = "sessionToken";
32+
private static final String ACCOUNT_ID = "accountId";
3033

3134
@Test
3235
public void equalsHashcode() {
@@ -63,6 +66,7 @@ public void create_isSuccessful() {
6366
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
6467
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
6568
assertEquals(SESSION_TOKEN, identity.sessionToken());
69+
assertFalse(identity.accountId().isPresent());
6670
}
6771

6872
@Test
@@ -71,9 +75,12 @@ public void build_isSuccessful() {
7175
.accessKeyId(ACCESS_KEY_ID)
7276
.secretAccessKey(SECRET_ACCESS_KEY)
7377
.sessionToken(SESSION_TOKEN)
78+
.accountId(ACCOUNT_ID)
7479
.build();
7580
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
7681
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
7782
assertEquals(SESSION_TOKEN, identity.sessionToken());
83+
assertTrue(identity.accountId().isPresent());
84+
assertEquals(ACCOUNT_ID, identity.accountId().get());
7885
}
7986
}

‎test/codegen-generated-classes-test/src/test/java/software/amazon/awssdk/services/endpointproviders/AwsEndpointProviderUtilsTest.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,13 @@ public void fipsEnabledBuiltIn_returnsAttrValue() {
218218
assertThat(AwsEndpointProviderUtils.fipsEnabledBuiltIn(attrs)).isEqualTo(true);
219219
}
220220

221+
@Test
222+
public void accountIdAuthBuiltIn_returnsAttrValue() {
223+
ExecutionAttributes attrs = new ExecutionAttributes();
224+
attrs.putAttribute(AwsExecutionAttribute.AWS_AUTH_ACCOUNT_ID, "1234567890");
225+
assertThat(AwsEndpointProviderUtils.accountIdBuiltIn(attrs)).isEqualTo("1234567890");
226+
}
227+
221228
@Test
222229
public void endpointBuiltIn_doesNotIncludeQueryParams() {
223230
URI endpoint = URI.create("https://example.com/path?foo=bar");

0 commit comments

Comments
 (0)