aws / aws/aws-toolkit-vscode

auth: support `endpoint_url` + `ca_bundle` credentials configuration

Open
#3,961 0 comments 1 reaction 0 assignees View on GitHub
auth-credentials feature-request network
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

### Discussed in https://github.com/aws/aws-toolkit-vscode/discussions/3960

Originally posted by **asant-leitha** October 26, 2023
In order to access my corporate aws instance I need to set a custom root otherwise I get 403 Unauthorized. How to do that using the config file or the vscode toolkit plugin?

# Problem

Toolkit doesn't support this kind of credentials config:

```
[default]
endpoint_url = https://url.it:port
aws_access_key_id = XXXXXXXXXX
aws_secret_access_key = xxxxxxxx/xxxxxxx
ca_bundle = "path/to/file.pem"
```

- `ca_bundle` is docmented at https://awscli.amazonaws.com/v2/documentation/api/latest/topic/config-vars.html
- `endpoint_url` is documented at https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-endpoints.html

## Notes

This related discussion for aws _java_ sdk mentions that `ca_bundle` is not supported by the sdk:

- https://github.com/aws/aws-sdk-java-v2/discussions/3974

# Expected behavior

- Toolkit supports `endpoint_url` and `ca_bundle` fields in the credentials config.
- Supporting `endpoint_url` is essentially a variation of https://github.com/aws/aws-toolkit-vscode/issues/2007
- But based on an offline conversation, **aws-sdk-js-v3 already supports `endpoint_url` for static credentials.** References:
- https://docs.aws.amazon.com/sdkref/latest/guide/feature-ss-endpoints.html
- https://github.com/awslabs/smithy-typescript/blob/93274e37a28e508e5137493ffdf7aa63b0c8daed/packages/middleware-endpoint/src/adaptors/getEndpointUrlConfig.ts
- Support `ca_bundle` likely requires us to dynamically configure nodejs (e.g. via `NODE_EXTRA_CA_CERTS`, see also [#2970](https://github.com/aws/aws-sdk-js/issues/2970)) and/or [configure the sdk client](https://github.com/aws/aws-toolkit-vscode/issues/185#issuecomment-589500254).

Contributor guide

Open the contributing guide

Research direction

Start with the credentials config and AWS SDK client configuration, then read the AWS CLI endpoint and config-vars documentation and related issues #2007, #185, and #2970. Investigate endpoint_url support and the proposed NODE_EXTRA_CA_CERTS or SDK-client approaches for ca_bundle. Done means Toolkit credentials accept and apply both fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript, vscode
Domain
authentication, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.