awslabs / awslabs/aws-sdk-rust

[request]: Support static & STS assume role credentials in the ECS / HTTPS credentials provider

Open
#340 0 comments 3 reactions 0 assignees View on GitHub
feature-request p2
Dominant language
Rust
Stars
3.3k
Forks
290
Avg merge
1d 12h
Merged PRs (30d)
3

Description

### Tell us about your request

Currently, the ECS/HTTPS credentials provider only supports refreshable credentials with a token & an expiry but this doesn't support all use cases effectively eg. for customers with their own HTTPS credentials provider that returns static credentials. Add support for static credentials:
```
// {
// "AccessKeyId" : "MUA...",
// "SecretAccessKey" : "/7PC5om...."
// }
```

and assume role credentials:
```
// {
// // fields to construct STS client:
// "Region": "sts-region-name",
// "AccessKeyId" : "MUA...",
// "Expiration" : "2016-02-25T06:03:31Z", // optional
// "SecretAccessKey" : "/7PC5om....",
// "Token" : "AQoDY....=", // optional
// // fields controlling the STS role:
// "RoleArn": "...", // required
// "RoleSessionName": "...", // required
// // and also: DurationSeconds, ExternalId, SerialNumber, TokenCode, Policy
// ...
// }
```

### Tell us about the problem you're trying to solve.

use my HTTP credential provider that I use with other AWS SDKs

### Are you currently working around this issue?

with my own custom credentials provider

### Additional context

_No response_

### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue, please leave a comment

Contributor guide

Open the contributing guide

Research direction

Start by locating the ECS/HTTPS credentials provider implementation in the aws-sdk-rust repository and inspect how it currently parses refreshable credentials. Determine how the supplied static and assume-role JSON fields should map to credential handling, then identify or add coverage for both response shapes and verify that the provider can return the resulting credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, rust
Domain
authentication, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.