oscerd opened a new pull request, #28625: URL: https://github.com/apache/camel/pull/28625
## Description [CAMEL-26367](https://issues.apache.org/jira/browse/CAMEL-26367) With `useDefaultCredentialsProvider=true`, every camel-aws client got the JVM-wide singleton returned by `DefaultCredentialsProvider.create()`. An AWS SDK client closes its credentials provider when it is closed: `client.close()` closes the client configuration, and the SDK closes every value in it, including a provider passed to `credentialsProvider(...)` (only HTTP clients you pass in are protected). So stopping one endpoint closed the provider of every other client in the JVM. With web identity credentials (IRSA on EKS, OpenShift STS), closing the chain closes the STS client of `WebIdentityTokenFileCredentialsProvider`. The other clients keep working on their cached credentials until those go stale. After that, every refresh fails with `IllegalStateException: Connection pool shut down`, permanently. The SDK deprecated `create()` for this reason. This is a regression from CAMEL-22786 (4.17.0). The per-service client classes it replaced, for example `Sqs2ClientIAMOptimized`, set no credentials provider, so each client got its own. The S3 producer had the same problem in its presigner. `createDownloadLink` and `createUploadLink` build a presigner with `DefaultCredentialsProvider.create()` and close it after each call, and closing a presigner closes its credentials provider. So every presigned URL closed the shared provider, without any endpoint being stopped. ## Changes - `AwsClientBuilderUtil.resolveCredentialsProvider()` in camel-aws-common now returns `DefaultCredentialsProvider.builder().build()`: a new provider for each client, owned and closed by that client. Every camel-aws client factory uses it, sync and async. - `AWS2S3Producer.getOrCreatePresigner()` does the same for each presigner. `builder().build()` is the replacement the SDK documents for `create()`. No option or default changes. ## Behaviour Each client resolves and caches its own credentials again, as it did before 4.17. The bug affected credential sources whose providers hold resources that `close()` shuts down: web identity token files, and profiles that delegate to STS or SSO. Environment variables, system properties, plain profile keys, ECS/EKS Pod Identity and EC2 instance profiles keep working after `close()`, so they were not affected. The presigner is still created and closed for each presigned URL. With `useDefaultCredentialsProvider=true` it now resolves credentials on each call (one STS call per link with web identity), as the profile credentials branch already does. ## Tests - `SqsClientFactoryTest`: two SQS clients built with `useDefaultCredentialsProvider=true` get separate `DefaultCredentialsProvider` instances, checked through the SDK's `serviceClientConfiguration().credentialsProvider()`. - `AWS2S3ProducerPresignerCredentialsTest`: two `createDownloadLink` calls give each presigner its own `DefaultCredentialsProvider`, and close the presigner after use. Both tests fail without the fix. ## Backports `camel-4.22.x` and `camel-4.18.x` have the same code. Backports will follow once this is merged. _Claude Code on behalf of Andrea Cosentino_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
