Consider expiration of security credentials for expiration of a PresignedRequest
- Lingua principale
- Java
- Stelle
- 2.6k
- Fork
- 1k
- Merge medio
- 2g 9h
- PR unite (30g)
- 51
Descrizione
## Describe the Feature
Update `software.amazon.awssdk.awscore.presigner.PresignedRequest#expiration` so that it returns the minimum out of the expiration time of the security credentials and the requested signed duration.
## Is your Feature Request related to a problem?
It is impossible to tell when a `PresignedRequest` will actually expire. It makes it difficult to generate a presigned URL using an instance profile as it could expire at any time up to a maximum of 6 hours. The provided `signatureDuration` is practically useless except to restrict that to something less than 6 hours.
## Proposed Solution
The `AwsSessionCredentials` would need to be modified to have an additional `expiration` field that is set in `software.amazon.awssdk.auth.credentials.HttpCredentialsProvider#refreshCredentials`. This would make a lot of sense since the [STS API](https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html) already returns it.
`software.amazon.awssdk.services.s3.internal.presigner.DefaultS3Presigner#initializePresignedRequest` can then be modified to get the `AWS_CREDENTIALS` attribute from the `ExecutionContext` and get the expiration if they are an instance of `AwsSessionCredentials`. Then it can use the minimum of that and the one from the `PRESIGNER_EXPIRATION` attribute as the expiration of the `presignedRequest`.
## Describe alternatives you've considered
I have to maintain my own cached credentials with a known expiration time and provide them to the presigner which is just duplicating all the same logic that the default implementations already do.
## Additional Context
I want to generate presigned URLs and know when they will expire.
- [x] I may be able to implement this feature request
## Your Environment
* AWS Java SDK version used: 2.15.25
* JDK version used: 1.8
* Operating System and version: Amazon Linux 2
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Inizia leggendo AwsSessionCredentials e software.amazon.awssdk.auth.credentials.HttpCredentialsProvider#refreshCredentials, quindi esamina DefaultS3Presigner#initializePresignedRequest e PresignedRequest#expiration. Traccia come vengono valorizzati AWS_CREDENTIALS e PRESIGNER_EXPIRATION; il lavoro è completato quando la scadenza della richiesta riflette il valore più breve tra la scadenza delle credenziali di sicurezza e la durata firmata richiesta.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- aws, java
- Ambito
- cloud, security
- Tipo di issue
- Funzionalità
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Specificata chiaramente
- Idoneità per principianti
- 35/100