Skip to content

Commit 656fd34

Browse files
cenedhryncenedhryn
committed
Adds accountId as a parameter to AWS credentials identity (#4029)
1 parent ba36033 commit 656fd34

File tree

8 files changed

+78
-2
lines changed

8 files changed

+78
-2
lines changed

‎core/aws-core/src/main/java/software/amazon/awssdk/awscore/internal/authcontext/AwsCredentialsAuthorizationStrategy.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import software.amazon.awssdk.auth.credentials.AwsCredentials;
2121
import software.amazon.awssdk.auth.credentials.CredentialUtils;
2222
import software.amazon.awssdk.auth.signer.AwsSignerExecutionAttribute;
23+
import software.amazon.awssdk.awscore.AwsExecutionAttribute;
2324
import software.amazon.awssdk.awscore.AwsRequestOverrideConfiguration;
2425
import software.amazon.awssdk.core.RequestOverrideConfiguration;
2526
import software.amazon.awssdk.core.SdkRequest;
@@ -84,6 +85,8 @@ public void addCredentialsToExecutionAttributes(ExecutionAttributes executionAtt
8485
resolveCredentialsProvider(request, defaultCredentialsProvider);
8586
AwsCredentials credentials = CredentialUtils.toCredentials(resolveCredentials(credentialsProvider, metricCollector));
8687
executionAttributes.putAttribute(AwsSignerExecutionAttribute.AWS_CREDENTIALS, credentials);
88+
// TODO: A separate execution attribute is not strictly needed; this can be optimized before release
89+
executionAttributes.putAttribute(AwsExecutionAttribute.AWS_AUTH_ACCOUNT_ID, credentials.accountId().orElse(null));
8790
}
8891

8992
/**

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/AwsCredentialsIdentity.java

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515

1616
package software.amazon.awssdk.identity.spi;
1717

18+
import java.util.Optional;
1819
import software.amazon.awssdk.annotations.SdkPublicApi;
1920
import software.amazon.awssdk.annotations.ThreadSafe;
2021
import software.amazon.awssdk.identity.spi.internal.DefaultAwsCredentialsIdentity;
@@ -32,6 +33,7 @@
3233
@SdkPublicApi
3334
@ThreadSafe
3435
public interface AwsCredentialsIdentity extends Identity {
36+
3537
/**
3638
* Retrieve the AWS access key, used to identify the user interacting with services.
3739
*/
@@ -42,6 +44,12 @@ public interface AwsCredentialsIdentity extends Identity {
4244
*/
4345
String secretAccessKey();
4446

47+
/**
48+
* Retrieve the AWS account id associated with this credentials identity, if found.
49+
*/
50+
default Optional<String> accountId() {
51+
return Optional.empty();
52+
}
4553

4654
static Builder builder() {
4755
return DefaultAwsCredentialsIdentity.builder();
@@ -70,6 +78,11 @@ interface Builder {
7078
*/
7179
Builder secretAccessKey(String secretAccessKey);
7280

81+
/**
82+
* The AWS account id associated with this credentials identity.
83+
*/
84+
Builder accountId(String accountId);
85+
7386
/**
7487
* The name of the identity provider that created this credential identity.
7588
*/

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/AwsSessionCredentialsIdentity.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ interface Builder extends AwsCredentialsIdentity.Builder {
6060
@Override
6161
Builder secretAccessKey(String secretAccessKey);
6262

63+
@Override
64+
Builder accountId(String accountId);
65+
6366
/**
6467
* The AWS session token, retrieved from an AWS token service, used for authenticating that this user has
6568
* received temporary permission to access some resource.

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/internal/DefaultAwsCredentialsIdentity.java

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,13 @@ public final class DefaultAwsCredentialsIdentity implements AwsCredentialsIdenti
2828
private final String accessKeyId;
2929
private final String secretAccessKey;
3030
private final String providerName;
31+
private final String accountId;
3132

3233
private DefaultAwsCredentialsIdentity(Builder builder) {
3334
this.accessKeyId = builder.accessKeyId;
3435
this.secretAccessKey = builder.secretAccessKey;
3536
this.providerName = builder.providerName;
37+
this.accountId = builder.accountId;
3638

3739
Validate.paramNotNull(accessKeyId, "accessKeyId");
3840
Validate.paramNotNull(secretAccessKey, "secretAccessKey");
@@ -57,11 +59,17 @@ public Optional<String> providerName() {
5759
return Optional.ofNullable(providerName);
5860
}
5961

62+
@Override
63+
public Optional<String> accountId() {
64+
return Optional.ofNullable(accountId);
65+
}
66+
6067
@Override
6168
public String toString() {
6269
return ToString.builder("AwsCredentialsIdentity")
6370
.add("accessKeyId", accessKeyId)
6471
.add("providerName", providerName)
72+
.add("accountId", accountId)
6573
.build();
6674
}
6775

@@ -75,21 +83,24 @@ public boolean equals(Object o) {
7583
}
7684
AwsCredentialsIdentity that = (AwsCredentialsIdentity) o;
7785
return Objects.equals(accessKeyId, that.accessKeyId()) &&
78-
Objects.equals(secretAccessKey, that.secretAccessKey());
86+
Objects.equals(secretAccessKey, that.secretAccessKey()) &&
87+
Objects.equals(accountId, that.accountId().orElse(null));
7988
}
8089

8190
@Override
8291
public int hashCode() {
8392
int hashCode = 1;
8493
hashCode = 31 * hashCode + Objects.hashCode(accessKeyId);
8594
hashCode = 31 * hashCode + Objects.hashCode(secretAccessKey);
95+
hashCode = 31 * hashCode + Objects.hashCode(accountId);
8696
return hashCode;
8797
}
8898

8999
private static final class Builder implements AwsCredentialsIdentity.Builder {
90100
private String accessKeyId;
91101
private String secretAccessKey;
92102
private String providerName;
103+
private String accountId;
93104

94105
private Builder() {
95106
}
@@ -112,6 +123,12 @@ public Builder providerName(String providerName) {
112123
return this;
113124
}
114125

126+
@Override
127+
public Builder accountId(String accountId) {
128+
this.accountId = accountId;
129+
return this;
130+
}
131+
115132
@Override
116133
public AwsCredentialsIdentity build() {
117134
return new DefaultAwsCredentialsIdentity(this);

‎core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/internal/DefaultAwsSessionCredentialsIdentity.java

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,15 @@ public final class DefaultAwsSessionCredentialsIdentity implements AwsSessionCre
2929
private final String secretAccessKey;
3030
private final String sessionToken;
3131
private final String providerName;
32+
private final String accountId;
33+
3234

3335
private DefaultAwsSessionCredentialsIdentity(Builder builder) {
3436
this.accessKeyId = builder.accessKeyId;
3537
this.secretAccessKey = builder.secretAccessKey;
3638
this.sessionToken = builder.sessionToken;
3739
this.providerName = builder.providerName;
40+
this.accountId = builder.accountId;
3841

3942
Validate.paramNotNull(accessKeyId, "accessKeyId");
4043
Validate.paramNotNull(secretAccessKey, "secretAccessKey");
@@ -55,6 +58,11 @@ public String secretAccessKey() {
5558
return secretAccessKey;
5659
}
5760

61+
@Override
62+
public Optional<String> accountId() {
63+
return Optional.ofNullable(accountId);
64+
}
65+
5866
@Override
5967
public String sessionToken() {
6068
return sessionToken;
@@ -70,6 +78,7 @@ public String toString() {
7078
return ToString.builder("AwsSessionCredentialsIdentity")
7179
.add("accessKeyId", accessKeyId)
7280
.add("providerName", providerName)
81+
.add("accountId", accountId)
7382
.build();
7483
}
7584

@@ -84,7 +93,8 @@ public boolean equals(Object o) {
8493
AwsSessionCredentialsIdentity that = (AwsSessionCredentialsIdentity) o;
8594
return Objects.equals(accessKeyId, that.accessKeyId()) &&
8695
Objects.equals(secretAccessKey, that.secretAccessKey()) &&
87-
Objects.equals(sessionToken, that.sessionToken());
96+
Objects.equals(sessionToken, that.sessionToken()) &&
97+
Objects.equals(accountId, that.accountId().orElse(null));
8898
}
8999

90100
@Override
@@ -93,6 +103,7 @@ public int hashCode() {
93103
hashCode = 31 * hashCode + Objects.hashCode(accessKeyId);
94104
hashCode = 31 * hashCode + Objects.hashCode(secretAccessKey);
95105
hashCode = 31 * hashCode + Objects.hashCode(sessionToken);
106+
hashCode = 31 * hashCode + Objects.hashCode(accountId);
96107
return hashCode;
97108
}
98109

@@ -101,6 +112,7 @@ private static final class Builder implements AwsSessionCredentialsIdentity.Buil
101112
private String secretAccessKey;
102113
private String sessionToken;
103114
private String providerName;
115+
private String accountId;
104116

105117
private Builder() {
106118
}
@@ -129,6 +141,13 @@ public Builder providerName(String providerName) {
129141
return this;
130142
}
131143

144+
145+
@Override
146+
public Builder accountId(String accountId) {
147+
this.accountId = accountId;
148+
return this;
149+
}
150+
132151
@Override
133152
public AwsSessionCredentialsIdentity build() {
134153
return new DefaultAwsSessionCredentialsIdentity(this);

‎core/identity-spi/src/test/java/software/amazon/awssdk/identity/spi/AwsCredentialsIdentityTest.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@
1616
package software.amazon.awssdk.identity.spi;
1717

1818
import static org.junit.jupiter.api.Assertions.assertEquals;
19+
import static org.junit.jupiter.api.Assertions.assertFalse;
1920
import static org.junit.jupiter.api.Assertions.assertThrows;
21+
import static org.junit.jupiter.api.Assertions.assertTrue;
2022

2123
import nl.jqno.equalsverifier.EqualsVerifier;
2224
import org.junit.jupiter.api.Test;
@@ -26,6 +28,7 @@
2628
public class AwsCredentialsIdentityTest {
2729
private static final String ACCESS_KEY_ID = "accessKeyId";
2830
private static final String SECRET_ACCESS_KEY = "secretAccessKey";
31+
private static final String ACCOUNT_ID = "accountId";
2932

3033
@Test
3134
public void equalsHashcode() {
@@ -54,15 +57,19 @@ public void create_isSuccessful() {
5457
AwsCredentialsIdentity identity = AwsCredentialsIdentity.create(ACCESS_KEY_ID, SECRET_ACCESS_KEY);
5558
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
5659
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
60+
assertFalse(identity.accountId().isPresent());
5761
}
5862

5963
@Test
6064
public void build_isSuccessful() {
6165
AwsCredentialsIdentity identity = AwsCredentialsIdentity.builder()
6266
.accessKeyId(ACCESS_KEY_ID)
6367
.secretAccessKey(SECRET_ACCESS_KEY)
68+
.accountId(ACCOUNT_ID)
6469
.build();
6570
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
6671
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
72+
assertTrue(identity.accountId().isPresent());
73+
assertEquals(ACCOUNT_ID, identity.accountId().get());
6774
}
6875
}

‎core/identity-spi/src/test/java/software/amazon/awssdk/identity/spi/AwsSessionCredentialsIdentityTest.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@
1616
package software.amazon.awssdk.identity.spi;
1717

1818
import static org.junit.jupiter.api.Assertions.assertEquals;
19+
import static org.junit.jupiter.api.Assertions.assertFalse;
1920
import static org.junit.jupiter.api.Assertions.assertThrows;
21+
import static org.junit.jupiter.api.Assertions.assertTrue;
2022

2123
import nl.jqno.equalsverifier.EqualsVerifier;
2224
import org.junit.jupiter.api.Test;
@@ -27,6 +29,7 @@ public class AwsSessionCredentialsIdentityTest {
2729
private static final String ACCESS_KEY_ID = "accessKeyId";
2830
private static final String SECRET_ACCESS_KEY = "secretAccessKey";
2931
private static final String SESSION_TOKEN = "sessionToken";
32+
private static final String ACCOUNT_ID = "accountId";
3033

3134
@Test
3235
public void equalsHashcode() {
@@ -64,6 +67,7 @@ public void create_isSuccessful() {
6467
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
6568
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
6669
assertEquals(SESSION_TOKEN, identity.sessionToken());
70+
assertFalse(identity.accountId().isPresent());
6771
}
6872

6973
@Test
@@ -72,9 +76,12 @@ public void build_isSuccessful() {
7276
.accessKeyId(ACCESS_KEY_ID)
7377
.secretAccessKey(SECRET_ACCESS_KEY)
7478
.sessionToken(SESSION_TOKEN)
79+
.accountId(ACCOUNT_ID)
7580
.build();
7681
assertEquals(ACCESS_KEY_ID, identity.accessKeyId());
7782
assertEquals(SECRET_ACCESS_KEY, identity.secretAccessKey());
7883
assertEquals(SESSION_TOKEN, identity.sessionToken());
84+
assertTrue(identity.accountId().isPresent());
85+
assertEquals(ACCOUNT_ID, identity.accountId().get());
7986
}
8087
}

‎test/codegen-generated-classes-test/src/test/java/software/amazon/awssdk/services/endpointproviders/AwsEndpointProviderUtilsTest.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,13 @@ public void fipsEnabledBuiltIn_returnsAttrValue() {
124124
assertThat(AwsEndpointProviderUtils.fipsEnabledBuiltIn(attrs)).isEqualTo(true);
125125
}
126126

127+
@Test
128+
public void accountIdAuthBuiltIn_returnsAttrValue() {
129+
ExecutionAttributes attrs = new ExecutionAttributes();
130+
attrs.putAttribute(AwsExecutionAttribute.AWS_AUTH_ACCOUNT_ID, "1234567890");
131+
assertThat(AwsEndpointProviderUtils.accountIdBuiltIn(attrs)).isEqualTo("1234567890");
132+
}
133+
127134
@Test
128135
public void endpointBuiltIn_doesNotIncludeQueryParams() {
129136
URI endpoint = URI.create("https://example.com/path?foo=bar");

0 commit comments

Comments
 (0)