Skip to content

Commit 274a1d2

Browse files
waahm7waahm7
authored
Add Account Id to Credentials (#260)
1 parent 8927de4 commit 274a1d2

File tree

5 files changed

+123
-16
lines changed

5 files changed

+123
-16
lines changed

‎.github/workflows/codecov.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ on:
44
push:
55

66
env:
7-
BUILDER_VERSION: v0.9.72
7+
BUILDER_VERSION: v0.9.74
88
BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
99
BUILDER_SOURCE: releases
1010
PACKAGE_NAME: aws-c-auth
@@ -28,4 +28,4 @@ jobs:
2828
run: |
2929
python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
3030
chmod a+x builder
31-
./builder build -p ${{ env.PACKAGE_NAME }} --compiler=gcc-9 --cmake-extra=-DASSERT_LOCK_HELD=ON --coverage
31+
./builder build -p ${{ env.PACKAGE_NAME }} --compiler=gcc --cmake-extra=-DASSERT_LOCK_HELD=ON --coverage

‎include/aws/auth/credentials.h

+32
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ struct aws_credentials_provider_static_options {
8282
struct aws_byte_cursor access_key_id;
8383
struct aws_byte_cursor secret_access_key;
8484
struct aws_byte_cursor session_token;
85+
struct aws_byte_cursor account_id;
8586
};
8687

8788
/**
@@ -743,6 +744,28 @@ struct aws_credentials *aws_credentials_new(
743744
struct aws_byte_cursor session_token_cursor,
744745
uint64_t expiration_timepoint_seconds);
745746

747+
/**
748+
* Creates a new set of aws credentials with account_id
749+
*
750+
* @param allocator memory allocator to use
751+
* @param access_key_id_cursor value for the aws access key id field
752+
* @param secret_access_key_cursor value for the secret access key field
753+
* @param session_token_cursor (optional) security token associated with the credentials
754+
* @param account_id (optional) value for the account_id field
755+
* @param expiration_timepoint_seconds timepoint, in seconds since epoch, that the credentials will no longer
756+
* be valid past. For credentials that do not expire, use UINT64_MAX
757+
*
758+
* @return a valid credentials object, or NULL
759+
*/
760+
AWS_AUTH_API
761+
struct aws_credentials *aws_credentials_new_with_account_id(
762+
struct aws_allocator *allocator,
763+
struct aws_byte_cursor access_key_id_cursor,
764+
struct aws_byte_cursor secret_access_key_cursor,
765+
struct aws_byte_cursor session_token_cursor,
766+
struct aws_byte_cursor account_id_cursor,
767+
uint64_t expiration_timepoint_seconds);
768+
746769
/**
747770
* Creates a new set of aws anonymous credentials.
748771
* Use Anonymous credentials, when you want to skip the signing process.
@@ -848,6 +871,15 @@ struct aws_byte_cursor aws_credentials_get_secret_access_key(const struct aws_cr
848871
AWS_AUTH_API
849872
struct aws_byte_cursor aws_credentials_get_session_token(const struct aws_credentials *credentials);
850873

874+
/**
875+
* Get the AWS account id from a set of credentials
876+
*
877+
* @param credentials to get the account id from
878+
* @return a byte cursor to the account id or an empty byte cursor if there is no account id
879+
*/
880+
AWS_AUTH_API
881+
struct aws_byte_cursor aws_credentials_get_account_id(const struct aws_credentials *credentials);
882+
851883
/**
852884
* Get the expiration timepoint (in seconds since epoch) associated with a set of credentials
853885
*

‎source/credentials.c

+44
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ struct aws_credentials_identity {
2222
struct aws_string *access_key_id;
2323
struct aws_string *secret_access_key;
2424
struct aws_string *session_token;
25+
struct aws_string *account_id;
2526
};
2627

2728
/* aws_token identity contains only a token to represent token only identities like a bearer token. */
@@ -85,13 +86,34 @@ struct aws_credentials {
8586
/*
8687
* Credentials API implementations
8788
*/
89+
8890
struct aws_credentials *aws_credentials_new(
8991
struct aws_allocator *allocator,
9092
struct aws_byte_cursor access_key_id_cursor,
9193
struct aws_byte_cursor secret_access_key_cursor,
9294
struct aws_byte_cursor session_token_cursor,
9395
uint64_t expiration_timepoint_seconds) {
9496

97+
struct aws_byte_cursor account_id;
98+
AWS_ZERO_STRUCT(account_id);
99+
100+
return aws_credentials_new_with_account_id(
101+
allocator,
102+
access_key_id_cursor,
103+
secret_access_key_cursor,
104+
session_token_cursor,
105+
account_id,
106+
expiration_timepoint_seconds);
107+
}
108+
109+
struct aws_credentials *aws_credentials_new_with_account_id(
110+
struct aws_allocator *allocator,
111+
struct aws_byte_cursor access_key_id_cursor,
112+
struct aws_byte_cursor secret_access_key_cursor,
113+
struct aws_byte_cursor session_token_cursor,
114+
struct aws_byte_cursor account_id_cursor,
115+
uint64_t expiration_timepoint_seconds) {
116+
95117
if (access_key_id_cursor.ptr == NULL || access_key_id_cursor.len == 0) {
96118
aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
97119
return NULL;
@@ -133,6 +155,14 @@ struct aws_credentials *aws_credentials_new(
133155
}
134156
}
135157

158+
if (account_id_cursor.ptr != NULL && account_id_cursor.len > 0) {
159+
credentials_identity->account_id =
160+
aws_string_new_from_array(allocator, account_id_cursor.ptr, account_id_cursor.len);
161+
if (credentials_identity->account_id == NULL) {
162+
goto error;
163+
}
164+
}
165+
136166
credentials->expiration_timepoint_seconds = expiration_timepoint_seconds;
137167

138168
return credentials;
@@ -166,6 +196,7 @@ static void s_aws_credentials_destroy(struct aws_credentials *credentials) {
166196
aws_string_destroy(credentials->identity.credentials_identity.access_key_id);
167197
aws_string_destroy_secure(credentials->identity.credentials_identity.secret_access_key);
168198
aws_string_destroy_secure(credentials->identity.credentials_identity.session_token);
199+
aws_string_destroy_secure(credentials->identity.credentials_identity.account_id);
169200
break;
170201
case ECC_IDENTITY:
171202
aws_string_destroy(credentials->identity.ecc_identity.access_key_id);
@@ -255,6 +286,19 @@ struct aws_byte_cursor aws_credentials_get_session_token(const struct aws_creden
255286
return s_empty_token_cursor;
256287
}
257288

289+
struct aws_byte_cursor aws_credentials_get_account_id(const struct aws_credentials *credentials) {
290+
switch (credentials->identity_type) {
291+
case AWS_CREDENTIALS_IDENTITY:
292+
if (credentials->identity.credentials_identity.account_id != NULL) {
293+
return aws_byte_cursor_from_string(credentials->identity.credentials_identity.account_id);
294+
}
295+
break;
296+
default:
297+
break;
298+
}
299+
return s_empty_token_cursor;
300+
}
301+
258302
struct aws_byte_cursor aws_credentials_get_token(const struct aws_credentials *credentials) {
259303
switch (credentials->identity_type) {
260304
case TOKEN_IDENTITY:

‎source/credentials_provider_static.c

+7-2
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,13 @@ struct aws_credentials_provider *aws_credentials_provider_new_static(
5151

5252
AWS_ZERO_STRUCT(*provider);
5353

54-
struct aws_credentials *credentials = aws_credentials_new(
55-
allocator, options->access_key_id, options->secret_access_key, options->session_token, UINT64_MAX);
54+
struct aws_credentials *credentials = aws_credentials_new_with_account_id(
55+
allocator,
56+
options->access_key_id,
57+
options->secret_access_key,
58+
options->session_token,
59+
options->account_id,
60+
UINT64_MAX);
5661
if (credentials == NULL) {
5762
goto on_new_credentials_failure;
5863
}

‎tests/credentials_tests.c

+38-12
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
AWS_STATIC_STRING_FROM_LITERAL(s_access_key_id_test_value, "My Access Key");
2929
AWS_STATIC_STRING_FROM_LITERAL(s_secret_access_key_test_value, "SekritKey");
3030
AWS_STATIC_STRING_FROM_LITERAL(s_session_token_test_value, "Some Session Token");
31+
AWS_STATIC_STRING_FROM_LITERAL(s_account_id_test_value, "Some Account Value");
3132

3233
static int s_credentials_create_destroy_test(struct aws_allocator *allocator, void *ctx) {
3334
(void)ctx;
@@ -115,7 +116,8 @@ static int s_do_basic_provider_test(
115116
int expected_calls,
116117
const struct aws_string *expected_access_key_id,
117118
const struct aws_string *expected_secret_access_key,
118-
const struct aws_string *expected_session_token) {
119+
const struct aws_string *expected_session_token,
120+
const struct aws_string *expected_account_id) {
119121

120122
struct aws_get_credentials_test_callback_result callback_results;
121123
aws_get_credentials_test_callback_result_init(&callback_results, expected_calls);
@@ -141,6 +143,13 @@ static int s_do_basic_provider_test(
141143
} else {
142144
ASSERT_TRUE(aws_credentials_get_session_token(callback_results.credentials).len == 0);
143145
}
146+
147+
if (expected_account_id != NULL) {
148+
ASSERT_CURSOR_VALUE_STRING_EQUALS(
149+
aws_credentials_get_account_id(callback_results.credentials), expected_account_id);
150+
} else {
151+
ASSERT_TRUE(aws_credentials_get_account_id(callback_results.credentials).len == 0);
152+
}
144153
} else {
145154
ASSERT_TRUE(expected_access_key_id == NULL);
146155
ASSERT_TRUE(expected_secret_access_key == NULL);
@@ -159,6 +168,7 @@ static int s_static_credentials_provider_basic_test(struct aws_allocator *alloca
159168
.access_key_id = aws_byte_cursor_from_string(s_access_key_id_test_value),
160169
.secret_access_key = aws_byte_cursor_from_string(s_secret_access_key_test_value),
161170
.session_token = aws_byte_cursor_from_string(s_session_token_test_value),
171+
.account_id = aws_byte_cursor_from_string(s_account_id_test_value),
162172
.shutdown_options =
163173
{
164174
.shutdown_callback = s_on_shutdown_complete,
@@ -172,8 +182,12 @@ static int s_static_credentials_provider_basic_test(struct aws_allocator *alloca
172182

173183
ASSERT_TRUE(
174184
s_do_basic_provider_test(
175-
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
176-
AWS_OP_SUCCESS);
185+
provider,
186+
1,
187+
s_access_key_id_test_value,
188+
s_secret_access_key_test_value,
189+
s_session_token_test_value,
190+
s_account_id_test_value) == AWS_OP_SUCCESS);
177191

178192
aws_credentials_provider_release(provider);
179193

@@ -198,7 +212,7 @@ static int s_anonymous_credentials_provider_basic_test(struct aws_allocator *all
198212

199213
struct aws_credentials_provider *provider = aws_credentials_provider_new_anonymous(allocator, &shutdown_options);
200214

201-
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL) == AWS_OP_SUCCESS);
215+
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL, NULL) == AWS_OP_SUCCESS);
202216

203217
aws_credentials_provider_release(provider);
204218

@@ -236,8 +250,12 @@ static int s_environment_credentials_provider_basic_test(struct aws_allocator *a
236250

237251
ASSERT_TRUE(
238252
s_do_basic_provider_test(
239-
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
240-
AWS_OP_SUCCESS);
253+
provider,
254+
1,
255+
s_access_key_id_test_value,
256+
s_secret_access_key_test_value,
257+
s_session_token_test_value,
258+
NULL) == AWS_OP_SUCCESS);
241259

242260
aws_credentials_provider_release(provider);
243261

@@ -270,7 +288,7 @@ static int s_environment_credentials_provider_empty_env_test(struct aws_allocato
270288

271289
struct aws_credentials_provider *provider = aws_credentials_provider_new_environment(allocator, &options);
272290
/* Instead of getting an empty credentials, should just fail to fetch credentials */
273-
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL) == AWS_OP_SUCCESS);
291+
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL, NULL) == AWS_OP_SUCCESS);
274292

275293
aws_credentials_provider_release(provider);
276294

@@ -300,7 +318,7 @@ static int s_do_environment_credentials_provider_failure(struct aws_allocator *a
300318

301319
struct aws_credentials_provider *provider = aws_credentials_provider_new_environment(allocator, &options);
302320

303-
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL) == AWS_OP_SUCCESS);
321+
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL, NULL) == AWS_OP_SUCCESS);
304322

305323
aws_credentials_provider_release(provider);
306324

@@ -1338,8 +1356,12 @@ static int s_credentials_provider_default_test(struct aws_allocator *allocator,
13381356

13391357
ASSERT_TRUE(
13401358
s_do_basic_provider_test(
1341-
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
1342-
AWS_OP_SUCCESS);
1359+
provider,
1360+
1,
1361+
s_access_key_id_test_value,
1362+
s_secret_access_key_test_value,
1363+
s_session_token_test_value,
1364+
NULL) == AWS_OP_SUCCESS);
13431365

13441366
/*
13451367
* Verify that there's some caching before the environment by modifying the environment and requerying
@@ -1350,8 +1372,12 @@ static int s_credentials_provider_default_test(struct aws_allocator *allocator,
13501372

13511373
ASSERT_TRUE(
13521374
s_do_basic_provider_test(
1353-
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
1354-
AWS_OP_SUCCESS);
1375+
provider,
1376+
1,
1377+
s_access_key_id_test_value,
1378+
s_secret_access_key_test_value,
1379+
s_session_token_test_value,
1380+
NULL) == AWS_OP_SUCCESS);
13551381

13561382
aws_credentials_provider_release(provider);
13571383

0 commit comments

Comments
 (0)