auth: support `endpoint_url` + `ca_bundle` credentials configuration
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
### Discussed in https://github.com/aws/aws-toolkit-vscode/discussions/3960
Originally posted by **asant-leitha** October 26, 2023
In order to access my corporate aws instance I need to set a custom root otherwise I get 403 Unauthorized. How to do that using the config file or the vscode toolkit plugin?
# Problem
Toolkit doesn't support this kind of credentials config:
```
[default]
endpoint_url = https://url.it:port
aws_access_key_id = XXXXXXXXXX
aws_secret_access_key = xxxxxxxx/xxxxxxx
ca_bundle = "path/to/file.pem"
```
- `ca_bundle` is docmented at https://awscli.amazonaws.com/v2/documentation/api/latest/topic/config-vars.html
- `endpoint_url` is documented at https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-endpoints.html
## Notes
This related discussion for aws _java_ sdk mentions that `ca_bundle` is not supported by the sdk:
- https://github.com/aws/aws-sdk-java-v2/discussions/3974
# Expected behavior
- Toolkit supports `endpoint_url` and `ca_bundle` fields in the credentials config.
- Supporting `endpoint_url` is essentially a variation of https://github.com/aws/aws-toolkit-vscode/issues/2007
- But based on an offline conversation, **aws-sdk-js-v3 already supports `endpoint_url` for static credentials.** References:
- https://docs.aws.amazon.com/sdkref/latest/guide/feature-ss-endpoints.html
- https://github.com/awslabs/smithy-typescript/blob/93274e37a28e508e5137493ffdf7aa63b0c8daed/packages/middleware-endpoint/src/adaptors/getEndpointUrlConfig.ts
- Support `ca_bundle` likely requires us to dynamically configure nodejs (e.g. via `NODE_EXTRA_CA_CERTS`, see also [#2970](https://github.com/aws/aws-sdk-js/issues/2970)) and/or [configure the sdk client](https://github.com/aws/aws-toolkit-vscode/issues/185#issuecomment-589500254).
Contributor guide
Research direction
Start with the credentials config and AWS SDK client configuration, then read the AWS CLI endpoint and config-vars documentation and related issues #2007, #185, and #2970. Investigate endpoint_url support and the proposed NODE_EXTRA_CA_CERTS or SDK-client approaches for ca_bundle. Done means Toolkit credentials accept and apply both fields.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript, vscode
- Domain
- authentication, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100