This is an automated email from the ASF dual-hosted git repository.
tustvold pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/master by this push:
new f5c165acc Reload token from AWS_WEB_IDENTITY_TOKEN_FILE (#3274)
f5c165acc is described below
commit f5c165acc0e6cc4b34e0eaea006aab7e5bd28d66
Author: Raphael Taylor-Davies <[email protected]>
AuthorDate: Mon Dec 5 22:52:20 2022 +0000
Reload token from AWS_WEB_IDENTITY_TOKEN_FILE (#3274)
* Reload token from AWS_WEB_IDENTITY_TOKEN_FILE
* Clippy
* Update object_store/src/aws/credential.rs
Co-authored-by: Andrew Lamb <[email protected]>
Co-authored-by: Andrew Lamb <[email protected]>
---
object_store/src/aws/credential.rs | 11 +++++++----
object_store/src/aws/mod.rs | 11 +++--------
2 files changed, 10 insertions(+), 12 deletions(-)
diff --git a/object_store/src/aws/credential.rs
b/object_store/src/aws/credential.rs
index 900af2406..199899d6f 100644
--- a/object_store/src/aws/credential.rs
+++ b/object_store/src/aws/credential.rs
@@ -341,7 +341,7 @@ impl CredentialProvider for InstanceCredentialProvider {
#[derive(Debug)]
pub struct WebIdentityProvider {
pub cache: TokenCache<Arc<AwsCredential>>,
- pub token: String,
+ pub token_path: String,
pub role_arn: String,
pub session_name: String,
pub endpoint: String,
@@ -355,7 +355,7 @@ impl CredentialProvider for WebIdentityProvider {
web_identity(
&self.client,
&self.retry_config,
- &self.token,
+ &self.token_path,
&self.role_arn,
&self.session_name,
&self.endpoint,
@@ -477,11 +477,14 @@ impl From<AssumeRoleCredentials> for AwsCredential {
async fn web_identity(
client: &Client,
retry_config: &RetryConfig,
- token: &str,
+ token_path: &str,
role_arn: &str,
session_name: &str,
endpoint: &str,
) -> Result<TemporaryToken<Arc<AwsCredential>>, StdError> {
+ let token = std::fs::read_to_string(token_path)
+ .map_err(|e| format!("Failed to read token file '{}': {}", token_path,
e))?;
+
let bytes = client
.request(Method::POST, endpoint)
.query(&[
@@ -490,7 +493,7 @@ async fn web_identity(
("RoleArn", role_arn),
("RoleSessionName", session_name),
("Version", "2011-06-15"),
- ("WebIdentityToken", token),
+ ("WebIdentityToken", &token),
])
.send_retry(retry_config)
.await?
diff --git a/object_store/src/aws/mod.rs b/object_store/src/aws/mod.rs
index c92b8c29a..aa419d605 100644
--- a/object_store/src/aws/mod.rs
+++ b/object_store/src/aws/mod.rs
@@ -116,9 +116,6 @@ enum Error {
#[snafu(display("Received header containing non-ASCII data"))]
BadHeader { source: reqwest::header::ToStrError },
-
- #[snafu(display("Error reading token file: {}", source))]
- ReadTokenFile { source: std::io::Error },
}
impl From<Error> for super::Error {
@@ -588,13 +585,11 @@ impl AmazonS3Builder {
(Some(_), None, _) => return
Err(Error::MissingSecretAccessKey.into()),
// TODO: Replace with `AmazonS3Builder::credentials_from_env`
_ => match (
- std::env::var_os("AWS_WEB_IDENTITY_TOKEN_FILE"),
+ std::env::var("AWS_WEB_IDENTITY_TOKEN_FILE"),
std::env::var("AWS_ROLE_ARN"),
) {
- (Some(token_file), Ok(role_arn)) => {
+ (Ok(token_path), Ok(role_arn)) => {
info!("Using WebIdentity credential provider");
- let token = std::fs::read_to_string(token_file)
- .context(ReadTokenFileSnafu)?;
let session_name = std::env::var("AWS_ROLE_SESSION_NAME")
.unwrap_or_else(|_| "WebIdentitySession".to_string());
@@ -610,7 +605,7 @@ impl AmazonS3Builder {
Box::new(WebIdentityProvider {
cache: Default::default(),
- token,
+ token_path,
session_name,
role_arn,
endpoint,
