feat: STS web identity creds resolver #1949

sichanyoo · 2025-06-02T21:29:35Z

Companion PR:

feat: STS web identity creds resolver smithy-lang/smithy-swift#933

Issue #

2380

Description of changes

SDK-side implementation of STS web identity credential identity resolver.
Uses new extension point in smithy-swift for AuthSchemeResolverGenerator. Writes a line that constructs & adds IdentityProvisingSTSClient struct instance into auth option's identityProperties.
*Contains generated STS client in AWSSDKIdentity module.

New/existing dependencies impact assessment, if applicable

Conventional Commits

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…nerated in AWSSDKIdentity module.

…vice clients used by creds resolvers.

This reverts commit 5794bc3.

sichanyoo

Comments to help with reviews.

sichanyoo · 2025-06-03T18:44:17Z

.swiftlint.yml

@@ -4,7 +4,7 @@ included:
  - Sources/Core/AWSSDKCommon/Sources
  - Sources/Core/AWSSDKEventStreamsAuth/Sources
  - Sources/Core/AWSSDKHTTPAuth/Sources
-  - Sources/Core/AWSSDKIdentity/Sources
+  - Sources/Core/AWSSDKIdentity/Sources/AWSSDKIdentity


Limits swiftlint to be more specific, so the generated STS client files doesn't get linted.

sichanyoo · 2025-06-03T18:47:25Z

AWSSDKSwiftCLI/Sources/AWSSDKSwiftCLI/Resources/Package.Base.txt

@@ -129,12 +129,32 @@ private var runtimeTargets: [Target] {
        ),
        .target(
            name: "AWSSDKHTTPAuth",
-            dependencies: [.crt, .smithy, .clientRuntime, .smithyHTTPAuth, "AWSSDKIdentity", "AWSSDKChecksums"],
+            dependencies: [.crt, .smithy, .clientRuntime, .smithyHTTPAuth, "AWSSDKChecksums"],


The generated STS client in AWSSDKIdentity depends on AWSClientRuntime.
That caused this circular dependency:

AWSSDKIdentity => AWSClientRuntime => AWSSDKHTTPAuth => AWSSDKIdentity

Removed AWSSDKIdentity dependency from AWSSDKHTTPAuth as needed.

sichanyoo · 2025-06-03T18:50:20Z

AWSSDKSwiftCLI/Sources/AWSSDKSwiftCLI/Resources/Package.Base.txt

+            dependencies: [
+                .crt,
+                .smithy,
+                .clientRuntime,
+                .smithyIdentity,
+                .smithyIdentityAPI,
+                .smithyHTTPAPI,
+                .awsSDKCommon,
+                "AWSClientRuntime",
+                .smithyRetriesAPI,
+                .smithyRetries,
+                .smithyEventStreamsAPI,
+                .smithyEventStreamsAuthAPI,
+                .smithyEventStreams,
+                .smithyChecksumsAPI,
+                .smithyChecksums,
+                .smithyWaitersAPI,
+                .awsSDKHTTPAuth,
+                .awsSDKEventStreamsAuth,
+                .awsSDKChecksums,
+            ],


Generated STS client in AWSSDKIdentity module needs dependencies that service modules use.

sichanyoo · 2025-06-03T18:50:58Z

AWSSDKSwiftCLI/Sources/AWSSDKSwiftCLI/Resources/Package.Base.txt

@@ -160,7 +180,7 @@ private var runtimeTestTargets: [Target] {
        ),
        .testTarget(
            name: "AWSSDKEventStreamsAuthTests",
-            dependencies: ["AWSClientRuntime", "AWSSDKEventStreamsAuth", .smithyStreams, .smithyTestUtils],
+            dependencies: ["AWSClientRuntime", "AWSSDKEventStreamsAuth", "AWSSDKIdentity", .smithyStreams, .smithyTestUtils],


This was the only spot where AWSSDKIdentity module was actually needed under AWSSDKHTTPAuth/. So moved dependency directly to test module instead.

sichanyoo · 2025-06-03T18:51:51Z

...nTests/Services/AWSSTSIntegrationTests/STSAssumeRoleAWSCredentialIdentityResolverTests.swift

@@ -97,7 +97,7 @@ class STSAssumeRoleAWSCredentialIdentityResolverTests: XCTestCase {
        ))

        // Construct STS client wih assume-role credentials provider.
-        let underlyingResolver = try DefaultAWSCredentialIdentityResolverChain()
+        let underlyingResolver = DefaultAWSCredentialIdentityResolverChain()


Remove unnecessary try, now that default chain init doesn't do any throwing operation. Not related to any of the changes in the PR; just done here because I saw build warning.

sichanyoo · 2025-06-03T18:55:46Z

Sources/Core/AWSSDKIdentity/Sources/InternalAWSSTS/Plugins.swift

@@ -0,0 +1,82 @@
+//


Generated STS client file.

sichanyoo · 2025-06-03T18:56:03Z

Sources/Core/AWSSDKIdentity/Sources/InternalAWSSTS/STSClient.swift

Generated STS client file.

sichanyoo · 2025-06-03T18:56:08Z

Sources/Core/AWSSDKIdentity/Tests/InternalAWSSTSTests/EndpointResolverTest.swift

Generated STS client file.

sichanyoo · 2025-06-03T18:56:37Z

codegen/sdk-codegen/build.gradle.kts

@@ -71,7 +71,8 @@ data class AwsService(
    val modelFile: File,


Adds STS client generation into AWSSDKIdentity, as well as visibility codegen setting for the client.

sichanyoo · 2025-06-03T18:59:37Z

...WSSDKIdentity/AWSCredentialIdentityResolvers/DefaultAWSCredentialIdentityResolverChain.swift

+            { return ( STSWebIdentityAWSCredentialIdentityResolver(source: .env)) },
+            { return ( STSWebIdentityAWSCredentialIdentityResolver(source: .configFile)) },
+            { return ( ECSAWSCredentialIdentityResolver()) },


The old STSWebIdentity creds resolver that depends on CRT tried to resolve from env, then from config file. New ordering with new implementation uses same ordering.

…ume role APIs needed for credential resolvers.

sichanyoo · 2025-06-03T19:35:19Z

...hy/aws/swift/codegen/customization/credentialresolverservices/InternalSTSModelIntegration.kt

@@ -0,0 +1,31 @@
+package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices


Model integration to remove all operations except assume role & assumer role web identity when generating internal STS client for credential resolvers.

…e clients. Also, separate InternalAWSSTS into its own target in Package.Base.txt.

…inversion principle (DIP) so that AWSSDKIdentity doesn't directly depend on the internal STS client.

…into auth options returned by auth scheme resolver.

…eme resolver codegen & add codegen for IdentityProvidingSTSClient struct in internal AWS STS target.

…ETA-INF.

sichanyoo

More comments to help review, now that dependency inversion is complete.

sichanyoo · 2025-06-11T04:17:11Z

AWSSDKSwiftCLI/Sources/AWSSDKSwiftCLI/Resources/Package.Base.txt

+        .target(
+            name: "InternalAWSSTS",
+            dependencies: [
+                .clientRuntime,
+                .awsClientRuntime,
+                .smithyRetriesAPI,
+                .smithyRetries,
+                .smithy,
+                .smithyIdentity,
+                .smithyIdentityAPI,
+                .smithyEventStreamsAPI,
+                .smithyEventStreamsAuthAPI,
+                .smithyEventStreams,
+                .smithyChecksumsAPI,
+                .smithyChecksums,
+                .smithyWaitersAPI,
+                .awsSDKCommon,
+                .awsSDKIdentity,
+                .awsSDKHTTPAuth,
+                .awsSDKEventStreamsAuth,
+                .awsSDKChecksums,
+            ],
+            path: "Sources/Core/AWSSDKIdentity/Sources/InternalAWSSTS"


InternalAWSSTS is separated out into its own target.

sichanyoo · 2025-06-11T04:17:34Z

AWSSDKSwiftCLI/Sources/AWSSDKSwiftCLI/Resources/Package.Base.txt

@@ -199,6 +223,7 @@ private func target(_ service: String) -> Target {
            .awsSDKHTTPAuth,
            .awsSDKEventStreamsAuth,
            .awsSDKChecksums,
+            "InternalAWSSTS",


All services depend on InternalAWSSTS, used for credential resolution as needed.

sichanyoo · 2025-06-11T04:20:06Z

...SDKIdentity/Sources/AWSSDKIdentity/IdentityProvidingClients/IdentityProvidingSTSClient.swift

@@ -0,0 +1,24 @@
+//


This protocl is what allows dependency inversion. The actual IdentityProvidingSTSClient struct that conforms to the protocol here will be generated under InternalAWSSTS. Then, the auth scheme resolver of each public service module will construct an instance of the IdentityProvidingSTSClient struct and save it to auth option's identityProperties. Over in STS web identity cred resolver in AWSSDKIdentity, we just use the protocol to call the getCredentialsWithWebIdentity. This allows AWSSDKIdentity to use InternalAWSSTS without having direct dependency.

sichanyoo · 2025-06-11T04:21:59Z

...Core/AWSSDKIdentity/Sources/AWSSDKIdentity/IdentityProvidingClients/InternalClientKeys.swift

+public enum InternalClientKeys {
+    /// The STS client to be used in credential resolution.
+    public static let internalSTSClientKey = AttributeKey<any IdentityProvidingSTSClient>(
+        name: "IdentityProvidingSTSClient"
+    )
+}


This attribute key is used by auth scheme resolvers (generated for each public service module) to save an instance of IdentityProvidingSTSClient into identityProperties attributes of auth option.

sichanyoo · 2025-06-11T04:23:03Z

Sources/Core/AWSSDKIdentity/Sources/InternalAWSSTS/IdentityProvidingSTSClient.swift

@@ -0,0 +1,42 @@
+//


Generated STS client file. This is the concrete implementation of IdenttiyProvidingSTSClient protocol. It constructs an instance of the internal STS client generated in InternalAWSSTS target, uses it to fetch creds, and returns AWSCredentialIdentity.

sichanyoo · 2025-06-11T04:24:26Z

...en/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSHTTPProtocolCustomizations.kt

+        AuthSchemeResolverGenerator { authOptionName, writer ->
+            writer.write(
+                "$authOptionName.identityProperties.set(key: \$N.internalSTSClientKey, value: \$N())",
+                AWSSDKIdentityTypes.InternalClientKeys,
+                InternalClientTypes.IdentityProvidingSTSClient,
+            )
+        }.render(ctx)


This is where we use the new extension point added in companion smithy-swift PR. Allows us to construct & add IdentityProvidingSTSClient struct to identityProperties, without leaking type info in generic smithy codegen.

sichanyoo · 2025-06-11T04:24:47Z

...swift-codegen/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSSwiftDependency.kt

+        val INTERNAL_AWS_STS =
+            SwiftDependency(
+                "InternalAWSSTS",
+                "main",
+                "0.0.1",
+                "aws-sdk-swift",
+                "../../../aws-sdk-swift",
+                "InternalAWSSTS",
+                SwiftDependency.DistributionMethod.SPR,
+            )


New target that contains internal STS client generated for credential resolution purposes.

sichanyoo · 2025-06-11T04:25:21Z

...ft/codegen/customization/credentialresolverservices/IdentityProvidingSTSClientIntegration.kt

@@ -0,0 +1,100 @@
+package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices


Customization to generate IdentityProvidingSTSClient struct under InternalAWSSTS.

sichanyoo · 2025-06-11T04:26:00Z

...mithy/aws/swift/codegen/customization/credentialresolverservices/InternalModelIntegration.kt

@@ -0,0 +1,43 @@
+package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices


The model integration that removes unused operations from internal service clients. For STS, we only need assumeRole and assumeRoleWithWebIdentity. Reduces runtime module size.

This reverts commit e328aa1.

…ol test codegen.

…SSDKIdentity.

...Tests/Services/AWSSTSIntegrationTests/STSWebIdentityAWSCredentialIdentityResolverTests.swift

Package.swift

Sources/Core/AWSSDKIdentity/Sources/InternalAWSSTS/Models.swift

…staged for release.

Sichan Yoo added 5 commits June 2, 2025 12:42

Rough draft implementation w/ generated internal STS client.

6795e09

Resolve circular dependency issues with custom internal STS client ge…

34110d2

…nerated in AWSSDKIdentity module.

Changed AWSSDKIdentity dependencies; required for custom internal ser…

d7f7973

…vice clients used by creds resolvers.

Merge main into feat/sts-web-identity-creds-resolver.

5736a0e

Remove throws keyword from STS web identity creds resolver initializer.

d5d1673

sichanyoo mentioned this pull request Jun 2, 2025

feat: STS web identity creds resolver smithy-lang/smithy-swift#933

Merged

2 tasks

Sichan Yoo added 4 commits June 3, 2025 10:06

Remove unnecessary import.

b38d3fd

Add missing dependency to AWSSDKEventStreamsAuthTests

4cb29a8

Temp release manifest logic change for internal build test

5794bc3

Revert "Temp release manifest logic change for internal build test"

d594231

This reverts commit 5794bc3.

sichanyoo commented Jun 3, 2025

View reviewed changes

Sichan Yoo added 2 commits June 3, 2025 12:28

Filter STS client generated in AWSSDKIdentity to contain only the ass…

4e91782

…ume role APIs needed for credential resolvers.

Undo accidental removal.

117fbe2

sichanyoo commented Jun 3, 2025

View reviewed changes

Sichan Yoo added 16 commits June 3, 2025 12:47

ktlint

a42d5e0

Delete old FieldResolver.

7fdd73a

Limit visibility of plugins generated for internal use.

42bf26e

Newly generated internal STS with internal access levels for everything.

874db10

Delete accidentally commited generated endpoint reoslver tests for STS.

fd17646

Generic-fy the model preprocessing & build script for internal servic…

2e2fe06

…e clients. Also, separate InternalAWSSTS into its own target in Package.Base.txt.

Make runtime module changes in AWSSDKIdentity, needed for dependency …

e5e0a72

…inversion principle (DIP) so that AWSSDKIdentity doesn't directly depend on the internal STS client.

Add attribute key for internal STS client.

79de694

Add InternalAWSSTS as dependency to service clients.

1d91db1

Codegen changes for constructing & saving IdentityResolvingSTSClient …

11cc78f

…into auth options returned by auth scheme resolver.

Add IdentityProvidingSTSClient construction into rules based auth sch…

8306959

…eme resolver codegen & add codegen for IdentityProvidingSTSClient struct in internal AWS STS target.

ktlint

e746831

Fix IdentityProvidingSTSClient codegen location.

02f072b

Fix import in writer & add IdentityProvidingSTSClientIntegration to M…

bd40a8c

…ETA-INF.

Fix SwiftDeclaration type for AWSCredentialIdentityResolverError.

e8124d4

Commit most up to date generated InternalAWSSTS.

a4a5cec

Sichan Yoo added 2 commits June 10, 2025 21:02

Add generated Package.swift for reference in PR.

3e75e06

Update codegen test.

5fa33e4

sichanyoo commented Jun 11, 2025

View reviewed changes

Sichan Yoo added 5 commits June 11, 2025 12:48

Add InternalAWSSTS to protocol test package manifest.

e328aa1

Revert "Add InternalAWSSTS to protocol test package manifest."

612e765

This reverts commit e328aa1.

Skip auth option customization w/ internal service clients for protoc…

e3a26f5

…ol test codegen.

ktlint

087e32c

Add Sendable conformance to IdentityProvidingSTSClient protocol in AW…

bf0d9d7

…SSDKIdentity.

sichanyoo requested a review from jbelkins June 12, 2025 18:50

jbelkins approved these changes Jun 17, 2025

View reviewed changes

...Tests/Services/AWSSTSIntegrationTests/STSWebIdentityAWSCredentialIdentityResolverTests.swift Show resolved Hide resolved

Package.swift Show resolved Hide resolved

Sources/Core/AWSSDKIdentity/Sources/InternalAWSSTS/Models.swift Show resolved Hide resolved

sichanyoo and others added 5 commits June 17, 2025 11:56

Merge branch 'main' into feat/sts-web-identity-creds-resolver

595c264

Update internal STS client.

7b92ee7

Add generated internal service clients under AWSSDKIdentity as files …

a894abd

…staged for release.

Merge branch 'main' into feat/sts-web-identity-creds-resolver

39ed7d3

Update stage files unit test.

1bb811d

sichanyoo merged commit 34fe2eb into main Jun 17, 2025
31 checks passed

sichanyoo deleted the feat/sts-web-identity-creds-resolver branch June 17, 2025 21:33

		@@ -71,7 +71,8 @@ data class AwsService(
		val modelFile: File,

		@@ -0,0 +1,31 @@
		package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices

		@@ -0,0 +1,100 @@
		package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices

		@@ -0,0 +1,43 @@
		package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices

feat: STS web identity creds resolver #1949

feat: STS web identity creds resolver #1949

Uh oh!

Conversation

sichanyoo commented Jun 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue #

Description of changes

New/existing dependencies impact assessment, if applicable

Conventional Commits

Uh oh!

sichanyoo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sichanyoo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sichanyoo commented Jun 2, 2025 •

edited

Loading