Skip to content

Commit c6397ee

Browse files
nbbeekennbbeeken
committed
fix(NODE-5477): set AWS region from environment variable for STSClient
1 parent a7ffdf5 commit c6397ee

File tree

3 files changed

+207
-5
lines changed

3 files changed

+207
-5
lines changed

‎src/cmap/auth/mongodb_aws.ts

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import * as crypto from 'crypto';
2+
import * as process from 'process';
23
import { promisify } from 'util';
34

45
import type { Binary, BSONSerializeOptions } from '../../bson';
@@ -15,6 +16,28 @@ import { type AuthContext, AuthProvider } from './auth_provider';
1516
import { MongoCredentials } from './mongo_credentials';
1617
import { AuthMechanism } from './providers';
1718

19+
/**
20+
* The following regions use the global AWS STS endpoint, sts.amazonaws.com, by default
21+
* https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
22+
*/
23+
const LEGACY_REGIONS = new Set([
24+
'ap-northeast-1',
25+
'ap-south-1',
26+
'ap-southeast-1',
27+
'ap-southeast-2',
28+
'aws-global',
29+
'ca-central-1',
30+
'eu-central-1',
31+
'eu-north-1',
32+
'eu-west-1',
33+
'eu-west-2',
34+
'eu-west-3',
35+
'sa-east-1',
36+
'us-east-1',
37+
'us-east-2',
38+
'us-west-1',
39+
'us-west-2'
40+
]);
1841
const ASCII_N = 110;
1942
const AWS_RELATIVE_URI = 'http://169.254.170.2';
2043
const AWS_EC2_URI = 'http://169.254.169.254';
@@ -34,6 +57,7 @@ interface AWSSaslContinuePayload {
3457
}
3558

3659
export class MongoDBAWS extends AuthProvider {
60+
static credentialProvider: ReturnType<typeof getAwsCredentialProvider> | null = null;
3761
randomBytesAsync: (size: number) => Promise<Buffer>;
3862

3963
constructor() {
@@ -174,11 +198,11 @@ async function makeTempCredentials(credentials: MongoCredentials): Promise<Mongo
174198
});
175199
}
176200

177-
const credentialProvider = getAwsCredentialProvider();
201+
MongoDBAWS.credentialProvider ??= getAwsCredentialProvider();
178202

179203
// Check if the AWS credential provider from the SDK is present. If not,
180204
// use the old method.
181-
if ('kModuleError' in credentialProvider) {
205+
if ('kModuleError' in MongoDBAWS.credentialProvider) {
182206
// If the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
183207
// is set then drivers MUST assume that it was set by an AWS ECS agent
184208
if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
@@ -209,6 +233,32 @@ async function makeTempCredentials(credentials: MongoCredentials): Promise<Mongo
209233

210234
return makeMongoCredentialsFromAWSTemp(creds);
211235
} else {
236+
let { AWS_STS_REGIONAL_ENDPOINTS = '', AWS_REGION = '' } = process.env;
237+
AWS_STS_REGIONAL_ENDPOINTS = AWS_STS_REGIONAL_ENDPOINTS.toLowerCase();
238+
AWS_REGION = AWS_REGION.toLowerCase();
239+
240+
/** The option setting should work only for users who have explicit settings in their environment, the driver should not encode "defaults" */
241+
const awsRegionSettingsExist =
242+
AWS_REGION.length !== 0 && AWS_STS_REGIONAL_ENDPOINTS.length !== 0;
243+
244+
/**
245+
* If AWS_STS_REGIONAL_ENDPOINTS is set to regional, users are opting into the new behavior of respecting the region settings
246+
*
247+
* If AWS_STS_REGIONAL_ENDPOINTS is set to legacy, then "old" regions need to keep using the global setting.
248+
* Technically the SDK gets this wrong, it reaches out to 'sts.us-east-1.amazonaws.com' when it should be 'sts.amazonaws.com'.
249+
* That is not our bug to fix here. We leave that up to the SDK.
250+
*/
251+
const useRegionalSts =
252+
AWS_STS_REGIONAL_ENDPOINTS === 'regional' ||
253+
(AWS_STS_REGIONAL_ENDPOINTS === 'legacy' && !LEGACY_REGIONS.has(AWS_REGION));
254+
255+
const provider =
256+
awsRegionSettingsExist && useRegionalSts
257+
? MongoDBAWS.credentialProvider.fromNodeProviderChain({
258+
clientConfig: { region: AWS_REGION }
259+
})
260+
: MongoDBAWS.credentialProvider.fromNodeProviderChain();
261+
212262
/*
213263
* Creates a credential provider that will attempt to find credentials from the
214264
* following sources (listed in order of precedence):
@@ -219,8 +269,6 @@ async function makeTempCredentials(credentials: MongoCredentials): Promise<Mongo
219269
* - Shared credentials and config ini files
220270
* - The EC2/ECS Instance Metadata Service
221271
*/
222-
const { fromNodeProviderChain } = credentialProvider;
223-
const provider = fromNodeProviderChain();
224272
try {
225273
const creds = await provider();
226274
return makeMongoCredentialsFromAWSTemp({

‎src/deps.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ export interface AWSCredentials {
8686
}
8787

8888
type CredentialProvider = {
89+
fromNodeProviderChain(
90+
this: void,
91+
options: { clientConfig: { region: string } }
92+
): () => Promise<AWSCredentials>;
8993
fromNodeProviderChain(this: void): () => Promise<AWSCredentials>;
9094
};
9195

‎test/integration/auth/mongodb_aws.test.ts

Lines changed: 151 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ import * as http from 'http';
33
import { performance } from 'perf_hooks';
44
import * as sinon from 'sinon';
55

6-
import { MongoAWSError, type MongoClient, MongoServerError } from '../../mongodb';
6+
import { MongoAWSError, type MongoClient, MongoDBAWS, MongoServerError } from '../../mongodb';
77

88
describe('MONGODB-AWS', function () {
99
let client: MongoClient;
@@ -88,4 +88,154 @@ describe('MONGODB-AWS', function () {
8888
expect(timeTaken).to.be.below(12000);
8989
});
9090
});
91+
92+
describe('when using AssumeRoleWithWebIdentity', () => {
93+
const tests = [
94+
{
95+
ctx: 'when no AWS region settings are set',
96+
title: 'uses the default region',
97+
env: {
98+
AWS_STS_REGIONAL_ENDPOINTS: undefined,
99+
AWS_REGION: undefined
100+
},
101+
outcome: null
102+
},
103+
{
104+
ctx: 'when only AWS_STS_REGIONAL_ENDPOINTS is set',
105+
title: 'uses the default region',
106+
env: {
107+
AWS_STS_REGIONAL_ENDPOINTS: 'regional',
108+
AWS_REGION: undefined
109+
},
110+
outcome: null
111+
},
112+
{
113+
ctx: 'when only AWS_REGION is set',
114+
title: 'uses the default region',
115+
env: {
116+
AWS_STS_REGIONAL_ENDPOINTS: undefined,
117+
AWS_REGION: 'us-west-2'
118+
},
119+
outcome: null
120+
},
121+
122+
{
123+
ctx: 'when AWS_STS_REGIONAL_ENDPOINTS is set to regional and region is legacy',
124+
title: 'uses the region from the environment',
125+
env: {
126+
AWS_STS_REGIONAL_ENDPOINTS: 'regional',
127+
AWS_REGION: 'us-west-2'
128+
},
129+
outcome: 'us-west-2'
130+
},
131+
{
132+
ctx: 'when AWS_STS_REGIONAL_ENDPOINTS is set to regional and region is new',
133+
title: 'uses the region from the environment',
134+
env: {
135+
AWS_STS_REGIONAL_ENDPOINTS: 'regional',
136+
AWS_REGION: 'sa-east-1'
137+
},
138+
outcome: 'sa-east-1'
139+
},
140+
141+
{
142+
ctx: 'when AWS_STS_REGIONAL_ENDPOINTS is set to legacy and region is legacy',
143+
title: 'uses the region from the environment',
144+
env: {
145+
AWS_STS_REGIONAL_ENDPOINTS: 'legacy',
146+
AWS_REGION: 'us-west-2'
147+
},
148+
outcome: null
149+
},
150+
{
151+
ctx: 'when AWS_STS_REGIONAL_ENDPOINTS is set to legacy and region is new',
152+
title: 'uses the region from the environment',
153+
env: {
154+
AWS_STS_REGIONAL_ENDPOINTS: 'legacy',
155+
AWS_REGION: 'sa-east-1'
156+
},
157+
outcome: null
158+
}
159+
];
160+
161+
for (const test of tests) {
162+
context(test.ctx, () => {
163+
let credentialProvider;
164+
let storedEnv;
165+
let calledArguments;
166+
167+
const shouldSkip = () => {
168+
const { AWS_WEB_IDENTITY_TOKEN_FILE = '' } = process.env;
169+
credentialProvider = (() => {
170+
try {
171+
return require('@aws-sdk/credential-providers');
172+
} catch {
173+
return null;
174+
}
175+
})();
176+
return AWS_WEB_IDENTITY_TOKEN_FILE.length === 0 || credentialProvider == null;
177+
};
178+
179+
beforeEach(function () {
180+
if (shouldSkip()) {
181+
this.skipReason = 'only relevant to AssumeRoleWithWebIdentity with SDK installed';
182+
return this.skip();
183+
}
184+
185+
client = this.configuration.newClient(process.env.MONGODB_URI);
186+
187+
storedEnv = process.env;
188+
if (test.env.AWS_STS_REGIONAL_ENDPOINTS === undefined) {
189+
delete process.env.AWS_STS_REGIONAL_ENDPOINTS;
190+
} else {
191+
process.env.AWS_STS_REGIONAL_ENDPOINTS = test.env.AWS_STS_REGIONAL_ENDPOINTS;
192+
}
193+
if (test.env.AWS_REGION === undefined) {
194+
delete process.env.AWS_REGION;
195+
} else {
196+
process.env.AWS_REGION = test.env.AWS_REGION;
197+
}
198+
199+
calledArguments = [];
200+
MongoDBAWS.credentialProvider = {
201+
fromNodeProviderChain(...args) {
202+
calledArguments = args;
203+
return credentialProvider.fromNodeProviderChain(...args);
204+
}
205+
};
206+
});
207+
208+
afterEach(() => {
209+
if (shouldSkip()) {
210+
return;
211+
}
212+
if (typeof storedEnv.AWS_STS_REGIONAL_ENDPOINTS === 'string') {
213+
process.env.AWS_STS_REGIONAL_ENDPOINTS = storedEnv.AWS_STS_REGIONAL_ENDPOINTS;
214+
}
215+
if (typeof storedEnv.AWS_STS_REGIONAL_ENDPOINTS === 'string') {
216+
process.env.AWS_REGION = storedEnv.AWS_REGION;
217+
}
218+
MongoDBAWS.credentialProvider = credentialProvider;
219+
calledArguments = [];
220+
});
221+
222+
it(test.title, async function () {
223+
const result = await client
224+
.db('aws')
225+
.collection('aws_test')
226+
.estimatedDocumentCount()
227+
.catch(error => error);
228+
229+
expect(result).to.not.be.instanceOf(MongoServerError);
230+
expect(result).to.be.a('number');
231+
232+
if (test.outcome != null) {
233+
expect(calledArguments).to.deep.equal([{ clientConfig: { region: test.outcome } }]);
234+
} else {
235+
expect(calledArguments).to.deep.equal([]);
236+
}
237+
});
238+
});
239+
}
240+
});
91241
});

0 commit comments

Comments
 (0)