Consider expiration of security credentials for expiration of a PresignedRequest
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 1k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 51
Description
## Describe the Feature
Update `software.amazon.awssdk.awscore.presigner.PresignedRequest#expiration` so that it returns the minimum out of the expiration time of the security credentials and the requested signed duration.
## Is your Feature Request related to a problem?
It is impossible to tell when a `PresignedRequest` will actually expire. It makes it difficult to generate a presigned URL using an instance profile as it could expire at any time up to a maximum of 6 hours. The provided `signatureDuration` is practically useless except to restrict that to something less than 6 hours.
## Proposed Solution
The `AwsSessionCredentials` would need to be modified to have an additional `expiration` field that is set in `software.amazon.awssdk.auth.credentials.HttpCredentialsProvider#refreshCredentials`. This would make a lot of sense since the [STS API](https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html) already returns it.
`software.amazon.awssdk.services.s3.internal.presigner.DefaultS3Presigner#initializePresignedRequest` can then be modified to get the `AWS_CREDENTIALS` attribute from the `ExecutionContext` and get the expiration if they are an instance of `AwsSessionCredentials`. Then it can use the minimum of that and the one from the `PRESIGNER_EXPIRATION` attribute as the expiration of the `presignedRequest`.
## Describe alternatives you've considered
I have to maintain my own cached credentials with a known expiration time and provide them to the presigner which is just duplicating all the same logic that the default implementations already do.
## Additional Context
I want to generate presigned URLs and know when they will expire.
- [x] I may be able to implement this feature request
## Your Environment
* AWS Java SDK version used: 2.15.25
* JDK version used: 1.8
* Operating System and version: Amazon Linux 2
Contributor guide
Assessment
This issue has not been assessed yet.