← All changes
|
includes/sdk/s3/Aws/Credentials/AssumeRoleWithWebIdentityCredentialProvider.php
+22
-4
1.2.3
→
1.4.2
View file →
| @@ -28,8 +28,10 @@ | ||
| 28 | 28 | /** @var integer */ |
| 29 | 29 | private $authenticationAttempts; |
| 30 | 30 | /** @var integer */ |
| 31 | 31 | private $tokenFileReadAttempts; |
| 32 | + /** @var string */ | |
| 33 | + private $source; | |
| 32 | 34 | /** |
| 33 | 35 | * The constructor attempts to load config from environment variables. |
| 34 | 36 | * If not set, the following config options are used: |
| 35 | 37 | * - WebIdentityTokenFile: full path of token filename |
| @@ -34,8 +36,10 @@ | ||
| 34 | 36 | * If not set, the following config options are used: |
| 35 | 37 | * - WebIdentityTokenFile: full path of token filename |
| 36 | 38 | * - RoleArn: arn of role to be assumed |
| 37 | 39 | * - SessionName: (optional) set by SDK if not provided |
| 40 | + * - source: To identify if the provider was sourced by a profile or | |
| 41 | + * from environment definition. Default will be `sts_web_id_token`. | |
| 38 | 42 | * |
| 39 | 43 | * @param array $config Configuration options |
| 40 | 44 | * @throws \InvalidArgumentException |
| 41 | 45 | */ |
| @@ -54,15 +58,16 @@ | ||
| 54 | 58 | } |
| 55 | 59 | $this->retries = (int) \getenv(self::ENV_RETRIES) ?: (isset($config['retries']) ? $config['retries'] : 3); |
| 56 | 60 | $this->authenticationAttempts = 0; |
| 57 | 61 | $this->tokenFileReadAttempts = 0; |
| 58 | - $this->session = isset($config['SessionName']) ? $config['SessionName'] : 'aws-sdk-php-' . \round(\microtime(\true) * 1000); | |
| 59 | - $region = isset($config['region']) ? $config['region'] : 'us-east-1'; | |
| 62 | + $this->session = $config['SessionName'] ?? 'aws-sdk-php-' . \round(\microtime(\true) * 1000); | |
| 60 | 63 | if (isset($config['client'])) { |
| 61 | 64 | $this->client = $config['client']; |
| 62 | 65 | } else { |
| 63 | - $this->client = new StsClient(['credentials' => \false, 'region' => $region, 'version' => 'latest']); | |
| 66 | + $region = $config['region'] ?? \getEnv(CredentialProvider::ENV_REGION) ?: null; | |
| 67 | + $this->client = $this->createDefaultStsClient($region); | |
| 64 | 68 | } |
| 69 | + $this->source = $config['source'] ?? CredentialSources::STS_WEB_ID_TOKEN; | |
| 65 | 70 | } |
| 66 | 71 | /** |
| 67 | 72 | * Loads assume role with web identity credentials. |
| 68 | 73 | * |
| @@ -113,8 +118,21 @@ | ||
| 113 | 118 | throw new CredentialsException("Error retrieving web identity credentials: " . $e->getMessage() . " (" . $e->getCode() . ")"); |
| 114 | 119 | } |
| 115 | 120 | $this->authenticationAttempts++; |
| 116 | 121 | } |
| 117 | - (yield $this->client->createCredentials($result)); | |
| 122 | + (yield $this->client->createCredentials($result, $this->source)); | |
| 118 | 123 | }); |
| 124 | + } | |
| 125 | + /** | |
| 126 | + * @param string|null $region | |
| 127 | + * | |
| 128 | + * @return StsClient | |
| 129 | + */ | |
| 130 | + private function createDefaultStsClient(?string $region) : StsClient | |
| 131 | + { | |
| 132 | + if (empty($region)) { | |
| 133 | + $region = CredentialProvider::FALLBACK_REGION; | |
| 134 | + \trigger_error('NOTICE: STS client created without explicit `region` configuration.' . \PHP_EOL . "Defaulting to {$region}. This fallback behavior may be removed." . \PHP_EOL . 'To avoid potential disruptions, configure a region using one of the following methods:' . \PHP_EOL . '(1) Pass `region` in the `$config` array when calling the provider,' . \PHP_EOL . '(2) Set the `AWS_REGION` environment variable.' . \PHP_EOL . 'OR provide an STS client in the `$config` array when creating the provider as `client`.' . \PHP_EOL . 'See: https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/assume-role-with-web-identity-provider.html' . \PHP_EOL, \E_USER_NOTICE); | |
| 135 | + } | |
| 136 | + return new StsClient(['credentials' => \false, 'region' => $region]); | |
| 119 | 137 | } |
| 120 | 138 | } |