Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Account Id to Credentials #260

Merged
merged 8 commits into from
Jan 27, 2025
Merged

Add Account Id to Credentials #260

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f8ef5ed
Add account id
waahm7 Jan 13, 2025
8bcd1da
add blank line
waahm7 Jan 13, 2025
ff9eabd
fix doc
waahm7 Jan 13, 2025
2112587
fix codecoverage
waahm7 Jan 13, 2025
f12e9a8
try gcc
waahm7 Jan 17, 2025
5c2eece
Merge branch 'main' into account-id-in-creds
waahm7 Jan 24, 2025
aa8ed61
update builder
waahm7 Jan 24, 2025
ff1ba7a
Merge branch 'main' into account-id-in-creds
waahm7 Jan 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codecov.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,4 @@ jobs:
run: |
python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')"
chmod a+x builder
./builder build -p ${{ env.PACKAGE_NAME }} --compiler=gcc-9 --cmake-extra=-DASSERT_LOCK_HELD=ON --coverage
./builder build -p ${{ env.PACKAGE_NAME }} --compiler=gcc-12 --cmake-extra=-DASSERT_LOCK_HELD=ON --coverage
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why? Add some comments about this?
Do we need it to be applied to other codecov jobs?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have added the comment. Yes, we need to fix it everywhere where we updated the code coverage action ubuntu version.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmmm looks like the ci before the commit changing the compiler still work? https://github.com/awslabs/aws-c-auth/actions/runs/12757805423/job/35558824650

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you expand the build step and scroll to the end, you can see the errors. No idea why the overall CI says success.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmmm, maybe instead of updating the gcc version for every codecov ci, we should update our builder

https://github.com/awslabs/aws-crt-builder/blob/42d15ba4ee3fbe0e812e25094a8cf59eaef0cf1e/builder/actions/cmake.py#L254-L258

We install our own version of gcc, but the ctest -T coverage probably still use the default one in the system.

Seems like we can pass --gcov to chose what version of gcov to solve the version mismatch thing. https://stackoverflow.com/questions/12454175/gcov-out-of-memory-mismatched-version

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, fixed by awslabs/aws-crt-builder#317.

32 changes: 32 additions & 0 deletions include/aws/auth/credentials.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ struct aws_credentials_provider_static_options {
struct aws_byte_cursor access_key_id;
struct aws_byte_cursor secret_access_key;
struct aws_byte_cursor session_token;
struct aws_byte_cursor account_id;
};

/**
Expand Down Expand Up @@ -743,6 +744,28 @@ struct aws_credentials *aws_credentials_new(
struct aws_byte_cursor session_token_cursor,
uint64_t expiration_timepoint_seconds);

/**
* Creates a new set of aws credentials with account_id
*
* @param allocator memory allocator to use
* @param access_key_id_cursor value for the aws access key id field
* @param secret_access_key_cursor value for the secret access key field
* @param session_token_cursor (optional) security token associated with the credentials
* @param account_id (optional) value for the account_id field
* @param expiration_timepoint_seconds timepoint, in seconds since epoch, that the credentials will no longer
* be valid past. For credentials that do not expire, use UINT64_MAX
*
* @return a valid credentials object, or NULL
*/
AWS_AUTH_API
struct aws_credentials *aws_credentials_new_with_account_id(
struct aws_allocator *allocator,
struct aws_byte_cursor access_key_id_cursor,
struct aws_byte_cursor secret_access_key_cursor,
struct aws_byte_cursor session_token_cursor,
struct aws_byte_cursor account_id_cursor,
uint64_t expiration_timepoint_seconds);

/**
* Creates a new set of aws anonymous credentials.
* Use Anonymous credentials, when you want to skip the signing process.
Expand Down Expand Up @@ -848,6 +871,15 @@ struct aws_byte_cursor aws_credentials_get_secret_access_key(const struct aws_cr
AWS_AUTH_API
struct aws_byte_cursor aws_credentials_get_session_token(const struct aws_credentials *credentials);

/**
* Get the AWS account id from a set of credentials
*
* @param credentials to get the account id from
* @return a byte cursor to the account id or an empty byte cursor if there is no account id
*/
AWS_AUTH_API
struct aws_byte_cursor aws_credentials_get_account_id(const struct aws_credentials *credentials);

/**
* Get the expiration timepoint (in seconds since epoch) associated with a set of credentials
*
Expand Down
44 changes: 44 additions & 0 deletions source/credentials.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ struct aws_credentials_identity {
struct aws_string *access_key_id;
struct aws_string *secret_access_key;
struct aws_string *session_token;
struct aws_string *account_id;
};

/* aws_token identity contains only a token to represent token only identities like a bearer token. */
Expand Down Expand Up @@ -85,13 +86,34 @@ struct aws_credentials {
/*
* Credentials API implementations
*/

struct aws_credentials *aws_credentials_new(
struct aws_allocator *allocator,
struct aws_byte_cursor access_key_id_cursor,
struct aws_byte_cursor secret_access_key_cursor,
struct aws_byte_cursor session_token_cursor,
uint64_t expiration_timepoint_seconds) {

struct aws_byte_cursor account_id;
AWS_ZERO_STRUCT(account_id);

return aws_credentials_new_with_account_id(
allocator,
access_key_id_cursor,
secret_access_key_cursor,
session_token_cursor,
account_id,
expiration_timepoint_seconds);
}

struct aws_credentials *aws_credentials_new_with_account_id(
struct aws_allocator *allocator,
struct aws_byte_cursor access_key_id_cursor,
struct aws_byte_cursor secret_access_key_cursor,
struct aws_byte_cursor session_token_cursor,
struct aws_byte_cursor account_id_cursor,
uint64_t expiration_timepoint_seconds) {

if (access_key_id_cursor.ptr == NULL || access_key_id_cursor.len == 0) {
aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
return NULL;
Expand Down Expand Up @@ -133,6 +155,14 @@ struct aws_credentials *aws_credentials_new(
}
}

if (account_id_cursor.ptr != NULL && account_id_cursor.len > 0) {
credentials_identity->account_id =
aws_string_new_from_array(allocator, account_id_cursor.ptr, account_id_cursor.len);
if (credentials_identity->account_id == NULL) {
goto error;
}
}

credentials->expiration_timepoint_seconds = expiration_timepoint_seconds;

return credentials;
Expand Down Expand Up @@ -166,6 +196,7 @@ static void s_aws_credentials_destroy(struct aws_credentials *credentials) {
aws_string_destroy(credentials->identity.credentials_identity.access_key_id);
aws_string_destroy_secure(credentials->identity.credentials_identity.secret_access_key);
aws_string_destroy_secure(credentials->identity.credentials_identity.session_token);
aws_string_destroy_secure(credentials->identity.credentials_identity.account_id);
break;
case ECC_IDENTITY:
aws_string_destroy(credentials->identity.ecc_identity.access_key_id);
Expand Down Expand Up @@ -255,6 +286,19 @@ struct aws_byte_cursor aws_credentials_get_session_token(const struct aws_creden
return s_empty_token_cursor;
}

struct aws_byte_cursor aws_credentials_get_account_id(const struct aws_credentials *credentials) {
switch (credentials->identity_type) {
case AWS_CREDENTIALS_IDENTITY:
if (credentials->identity.credentials_identity.account_id != NULL) {
return aws_byte_cursor_from_string(credentials->identity.credentials_identity.account_id);
}
break;
default:
break;
}
return s_empty_token_cursor;
}

struct aws_byte_cursor aws_credentials_get_token(const struct aws_credentials *credentials) {
switch (credentials->identity_type) {
case TOKEN_IDENTITY:
Expand Down
9 changes: 7 additions & 2 deletions source/credentials_provider_static.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,13 @@ struct aws_credentials_provider *aws_credentials_provider_new_static(

AWS_ZERO_STRUCT(*provider);

struct aws_credentials *credentials = aws_credentials_new(
allocator, options->access_key_id, options->secret_access_key, options->session_token, UINT64_MAX);
struct aws_credentials *credentials = aws_credentials_new_with_account_id(
allocator,
options->access_key_id,
options->secret_access_key,
options->session_token,
options->account_id,
UINT64_MAX);
if (credentials == NULL) {
goto on_new_credentials_failure;
}
Expand Down
50 changes: 38 additions & 12 deletions tests/credentials_tests.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
AWS_STATIC_STRING_FROM_LITERAL(s_access_key_id_test_value, "My Access Key");
AWS_STATIC_STRING_FROM_LITERAL(s_secret_access_key_test_value, "SekritKey");
AWS_STATIC_STRING_FROM_LITERAL(s_session_token_test_value, "Some Session Token");
AWS_STATIC_STRING_FROM_LITERAL(s_account_id_test_value, "Some Account Value");

static int s_credentials_create_destroy_test(struct aws_allocator *allocator, void *ctx) {
(void)ctx;
Expand Down Expand Up @@ -115,7 +116,8 @@ static int s_do_basic_provider_test(
int expected_calls,
const struct aws_string *expected_access_key_id,
const struct aws_string *expected_secret_access_key,
const struct aws_string *expected_session_token) {
const struct aws_string *expected_session_token,
const struct aws_string *expected_account_id) {

struct aws_get_credentials_test_callback_result callback_results;
aws_get_credentials_test_callback_result_init(&callback_results, expected_calls);
Expand All @@ -141,6 +143,13 @@ static int s_do_basic_provider_test(
} else {
ASSERT_TRUE(aws_credentials_get_session_token(callback_results.credentials).len == 0);
}

if (expected_account_id != NULL) {
ASSERT_CURSOR_VALUE_STRING_EQUALS(
aws_credentials_get_account_id(callback_results.credentials), expected_account_id);
} else {
ASSERT_TRUE(aws_credentials_get_account_id(callback_results.credentials).len == 0);
}
} else {
ASSERT_TRUE(expected_access_key_id == NULL);
ASSERT_TRUE(expected_secret_access_key == NULL);
Expand All @@ -159,6 +168,7 @@ static int s_static_credentials_provider_basic_test(struct aws_allocator *alloca
.access_key_id = aws_byte_cursor_from_string(s_access_key_id_test_value),
.secret_access_key = aws_byte_cursor_from_string(s_secret_access_key_test_value),
.session_token = aws_byte_cursor_from_string(s_session_token_test_value),
.account_id = aws_byte_cursor_from_string(s_account_id_test_value),
.shutdown_options =
{
.shutdown_callback = s_on_shutdown_complete,
Expand All @@ -172,8 +182,12 @@ static int s_static_credentials_provider_basic_test(struct aws_allocator *alloca

ASSERT_TRUE(
s_do_basic_provider_test(
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
AWS_OP_SUCCESS);
provider,
1,
s_access_key_id_test_value,
s_secret_access_key_test_value,
s_session_token_test_value,
s_account_id_test_value) == AWS_OP_SUCCESS);

aws_credentials_provider_release(provider);

Expand All @@ -198,7 +212,7 @@ static int s_anonymous_credentials_provider_basic_test(struct aws_allocator *all

struct aws_credentials_provider *provider = aws_credentials_provider_new_anonymous(allocator, &shutdown_options);

ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL) == AWS_OP_SUCCESS);
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL, NULL) == AWS_OP_SUCCESS);

aws_credentials_provider_release(provider);

Expand Down Expand Up @@ -236,8 +250,12 @@ static int s_environment_credentials_provider_basic_test(struct aws_allocator *a

ASSERT_TRUE(
s_do_basic_provider_test(
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
AWS_OP_SUCCESS);
provider,
1,
s_access_key_id_test_value,
s_secret_access_key_test_value,
s_session_token_test_value,
NULL) == AWS_OP_SUCCESS);

aws_credentials_provider_release(provider);

Expand Down Expand Up @@ -270,7 +288,7 @@ static int s_environment_credentials_provider_empty_env_test(struct aws_allocato

struct aws_credentials_provider *provider = aws_credentials_provider_new_environment(allocator, &options);
/* Instead of getting an empty credentials, should just fail to fetch credentials */
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL) == AWS_OP_SUCCESS);
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL, NULL) == AWS_OP_SUCCESS);

aws_credentials_provider_release(provider);

Expand Down Expand Up @@ -300,7 +318,7 @@ static int s_do_environment_credentials_provider_failure(struct aws_allocator *a

struct aws_credentials_provider *provider = aws_credentials_provider_new_environment(allocator, &options);

ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL) == AWS_OP_SUCCESS);
ASSERT_TRUE(s_do_basic_provider_test(provider, 1, NULL, NULL, NULL, NULL) == AWS_OP_SUCCESS);

aws_credentials_provider_release(provider);

Expand Down Expand Up @@ -1338,8 +1356,12 @@ static int s_credentials_provider_default_test(struct aws_allocator *allocator,

ASSERT_TRUE(
s_do_basic_provider_test(
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
AWS_OP_SUCCESS);
provider,
1,
s_access_key_id_test_value,
s_secret_access_key_test_value,
s_session_token_test_value,
NULL) == AWS_OP_SUCCESS);

/*
* Verify that there's some caching before the environment by modifying the environment and requerying
Expand All @@ -1350,8 +1372,12 @@ static int s_credentials_provider_default_test(struct aws_allocator *allocator,

ASSERT_TRUE(
s_do_basic_provider_test(
provider, 1, s_access_key_id_test_value, s_secret_access_key_test_value, s_session_token_test_value) ==
AWS_OP_SUCCESS);
provider,
1,
s_access_key_id_test_value,
s_secret_access_key_test_value,
s_session_token_test_value,
NULL) == AWS_OP_SUCCESS);

aws_credentials_provider_release(provider);

Expand Down