This is an automated email from the ASF dual-hosted git repository. davsclaus pushed a commit to branch CAMEL-26042-sts-no-secret-headers in repository https://gitbox.apache.org/repos/asf/camel.git
commit 6befb5d9e5ef9ca891b37165fc018ea0a7248225 Author: Claus Ibsen <[email protected]> AuthorDate: Thu Nov 5 21:27:58 2026 +0100 CAMEL-26042: camel-aws2-sts - do not copy the temporary secret key and session token into message headers The assumeRole, getSessionToken and getFederationToken operations copied the secret access key and the session token of the temporary credentials into the CamelAwsStsSecretKey and CamelAwsStsSessionToken headers. The body, the AWS SDK response, already holds them in credentials(). The producer no longer sets these two headers; CamelAwsStsAccessKeyId, CamelAwsStsExpiration and CamelAwsStsAssumedRoleArn are still set. The two constants are deprecated, and the component doc and the 4.24 upgrade guide say how to read them from the body. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Claus Ibsen <[email protected]> --- .../apache/camel/catalog/components/aws2-sts.json | 4 +- .../camel/catalog/docs/aws2-sts-component.adoc | 11 ++++ .../apache/camel/component/aws2/sts/aws2-sts.json | 4 +- .../src/main/docs/aws2-sts-component.adoc | 11 ++++ .../camel/component/aws2/sts/STS2Constants.java | 18 ++++++- .../camel/component/aws2/sts/STS2Producer.java | 9 ++-- .../component/aws2/sts/AmazonSTSClientMock.java | 15 ++++-- .../camel/component/aws2/sts/STS2ProducerTest.java | 58 ++++++++++++++++++++++ .../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 10 ++++ .../endpoint/dsl/STS2EndpointBuilderFactory.java | 10 +++- 10 files changed, 133 insertions(+), 17 deletions(-) diff --git a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json index 7c8f668b5c00..36b27b636612 100644 --- a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json +++ b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json @@ -50,8 +50,8 @@ "CamelAwsStsFederatedName": { "index": 3, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The name of the federated user.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#FEDERATED_NAME" }, "CamelAwsStsAssumeRoleDurationSeconds": { "index": 4, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "Integer", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The duration, in seconds, of the role session. It could go from 900 seconds, to 1 to 12 hours (dependent on administrator settings. The default if not specified is 3600 seconds.", "constantName": "org.apache.camel.component. [...] "CamelAwsStsAccessKeyId": { "index": 5, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary access key ID.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ACCESS_KEY_ID" }, - "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary secret access key.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SECRET_KEY_ID" }, - "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary session token.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SESSION_TOKEN" }, + "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the secret access key from the body, such as ${body.credentials().secretAccessKey()}.", "autowired": false, "secret": false, "description": "The temporary secret access k [...] + "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the session token from the body, such as ${body.credentials().sessionToken()}.", "autowired": false, "secret": false, "description": "The temporary session token. Depr [...] "CamelAwsStsExpiration": { "index": 8, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "java.time.Instant", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The expiration date and time of the credentials.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#EXPIRATION" }, "CamelAwsStsAssumedRoleArn": { "index": 9, "kind": "header", "displayName": "", "group": "assumeRole", "label": "assumeRole", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The Amazon Resource Name (ARN) of the assumed role.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ASSUMED_ROLE_ARN" } }, diff --git a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc index a50c8648328b..6fde69e131ac 100644 --- a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc +++ b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc @@ -81,6 +81,17 @@ Camel-AWS STS component provides the following operation on the producer side: - getSessionToken - getFederationToken +=== The temporary credentials + +The body of the message is the response of the AWS SDK, such as an `AssumeRoleResponse`, and its `credentials()` hold +the temporary credentials. + +The producer also sets the `CamelAwsStsAccessKeyId` and `CamelAwsStsExpiration` headers, and for `assumeRole` the +`CamelAwsStsAssumedRoleArn` header. It does not set headers with the secret access key and the session token: take them +from the body, such as `${body.credentials().secretAccessKey()}` and `${body.credentials().sessionToken()}` with the +xref:languages:simple-language.adoc[Simple] language. To keep them for later steps of the route, store them in a +variable rather than in a header, as message headers are logged, traced and sent on by many producers. + == Examples === Producer Examples diff --git a/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json b/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json index 7c8f668b5c00..36b27b636612 100644 --- a/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json +++ b/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json @@ -50,8 +50,8 @@ "CamelAwsStsFederatedName": { "index": 3, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The name of the federated user.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#FEDERATED_NAME" }, "CamelAwsStsAssumeRoleDurationSeconds": { "index": 4, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "Integer", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The duration, in seconds, of the role session. It could go from 900 seconds, to 1 to 12 hours (dependent on administrator settings. The default if not specified is 3600 seconds.", "constantName": "org.apache.camel.component. [...] "CamelAwsStsAccessKeyId": { "index": 5, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary access key ID.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ACCESS_KEY_ID" }, - "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary secret access key.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SECRET_KEY_ID" }, - "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary session token.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SESSION_TOKEN" }, + "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the secret access key from the body, such as ${body.credentials().secretAccessKey()}.", "autowired": false, "secret": false, "description": "The temporary secret access k [...] + "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the session token from the body, such as ${body.credentials().sessionToken()}.", "autowired": false, "secret": false, "description": "The temporary session token. Depr [...] "CamelAwsStsExpiration": { "index": 8, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "java.time.Instant", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The expiration date and time of the credentials.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#EXPIRATION" }, "CamelAwsStsAssumedRoleArn": { "index": 9, "kind": "header", "displayName": "", "group": "assumeRole", "label": "assumeRole", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The Amazon Resource Name (ARN) of the assumed role.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ASSUMED_ROLE_ARN" } }, diff --git a/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc b/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc index a50c8648328b..6fde69e131ac 100644 --- a/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc +++ b/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc @@ -81,6 +81,17 @@ Camel-AWS STS component provides the following operation on the producer side: - getSessionToken - getFederationToken +=== The temporary credentials + +The body of the message is the response of the AWS SDK, such as an `AssumeRoleResponse`, and its `credentials()` hold +the temporary credentials. + +The producer also sets the `CamelAwsStsAccessKeyId` and `CamelAwsStsExpiration` headers, and for `assumeRole` the +`CamelAwsStsAssumedRoleArn` header. It does not set headers with the secret access key and the session token: take them +from the body, such as `${body.credentials().secretAccessKey()}` and `${body.credentials().sessionToken()}` with the +xref:languages:simple-language.adoc[Simple] language. To keep them for later steps of the route, store them in a +variable rather than in a header, as message headers are logged, traced and sent on by many producers. + == Examples === Producer Examples diff --git a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java index 4dd8f30655d8..6f052ae3e55a 100644 --- a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java +++ b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java @@ -37,11 +37,25 @@ public interface STS2Constants { @Metadata(label = "assumeRole getSessionToken getFederationToken", description = "The temporary access key ID.", javaType = "String") String ACCESS_KEY_ID = "CamelAwsStsAccessKeyId"; + /** + * @deprecated the producer no longer sets this header. Take the secret access key from the body, such as + * {@code ${body.credentials().secretAccessKey()}}. + */ @Metadata(label = "assumeRole getSessionToken getFederationToken", - description = "The temporary secret access key.", javaType = "String") + description = "The temporary secret access key.", javaType = "String", + deprecationNote = "The producer no longer sets this header. Take the secret access key from the body," + + " such as ${body.credentials().secretAccessKey()}.") + @Deprecated String SECRET_KEY_ID = "CamelAwsStsSecretKey"; + /** + * @deprecated the producer no longer sets this header. Take the session token from the body, such as + * {@code ${body.credentials().sessionToken()}}. + */ @Metadata(label = "assumeRole getSessionToken getFederationToken", - description = "The temporary session token.", javaType = "String") + description = "The temporary session token.", javaType = "String", + deprecationNote = "The producer no longer sets this header. Take the session token from the body, such" + + " as ${body.credentials().sessionToken()}.") + @Deprecated String SESSION_TOKEN = "CamelAwsStsSessionToken"; @Metadata(label = "assumeRole getSessionToken getFederationToken", description = "The expiration date and time of the credentials.", javaType = "java.time.Instant") diff --git a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java index b795028b1e6e..78faf42b4eb9 100644 --- a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java +++ b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java @@ -137,9 +137,8 @@ public class STS2Producer extends DefaultProducer { Message message = getMessageForResponse(exchange); message.setBody(result); if (ObjectHelper.isNotEmpty(result.credentials())) { + // the secret access key and the session token are only in the body, not in headers message.setHeader(STS2Constants.ACCESS_KEY_ID, result.credentials().accessKeyId()); - message.setHeader(STS2Constants.SECRET_KEY_ID, result.credentials().secretAccessKey()); - message.setHeader(STS2Constants.SESSION_TOKEN, result.credentials().sessionToken()); message.setHeader(STS2Constants.EXPIRATION, result.credentials().expiration()); } if (ObjectHelper.isNotEmpty(result.assumedRoleUser())) { @@ -177,9 +176,8 @@ public class STS2Producer extends DefaultProducer { Message message = getMessageForResponse(exchange); message.setBody(result); if (ObjectHelper.isNotEmpty(result.credentials())) { + // the secret access key and the session token are only in the body, not in headers message.setHeader(STS2Constants.ACCESS_KEY_ID, result.credentials().accessKeyId()); - message.setHeader(STS2Constants.SECRET_KEY_ID, result.credentials().secretAccessKey()); - message.setHeader(STS2Constants.SESSION_TOKEN, result.credentials().sessionToken()); message.setHeader(STS2Constants.EXPIRATION, result.credentials().expiration()); } } @@ -220,9 +218,8 @@ public class STS2Producer extends DefaultProducer { Message message = getMessageForResponse(exchange); message.setBody(result); if (ObjectHelper.isNotEmpty(result.credentials())) { + // the secret access key and the session token are only in the body, not in headers message.setHeader(STS2Constants.ACCESS_KEY_ID, result.credentials().accessKeyId()); - message.setHeader(STS2Constants.SECRET_KEY_ID, result.credentials().secretAccessKey()); - message.setHeader(STS2Constants.SESSION_TOKEN, result.credentials().sessionToken()); message.setHeader(STS2Constants.EXPIRATION, result.credentials().expiration()); } } diff --git a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java index 2ac6d4247cbf..832f25717772 100644 --- a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java +++ b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java @@ -16,6 +16,8 @@ */ package org.apache.camel.component.aws2.sts; +import java.time.Instant; + import software.amazon.awssdk.services.sts.StsClient; import software.amazon.awssdk.services.sts.StsServiceClientConfiguration; import software.amazon.awssdk.services.sts.model.AssumeRoleRequest; @@ -29,18 +31,24 @@ import software.amazon.awssdk.services.sts.model.GetSessionTokenResponse; public class AmazonSTSClientMock implements StsClient { + static final Instant EXPIRATION = Instant.parse("2026-01-01T00:00:00Z"); + public AmazonSTSClientMock() { } @Override public AssumeRoleResponse assumeRole(AssumeRoleRequest assumeRoleRequest) { - return AssumeRoleResponse.builder().assumedRoleUser(AssumedRoleUser.builder().arn("arn").build()).build(); + return AssumeRoleResponse.builder().assumedRoleUser(AssumedRoleUser.builder().arn("arn").build()) + .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test") + .expiration(EXPIRATION).build()) + .build(); } @Override public GetSessionTokenResponse getSessionToken(GetSessionTokenRequest getSessionTokenRequest) { return GetSessionTokenResponse.builder() - .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test").build()) + .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test") + .expiration(EXPIRATION).build()) .build(); } @@ -52,7 +60,8 @@ public class AmazonSTSClientMock implements StsClient { @Override public GetFederationTokenResponse getFederationToken(GetFederationTokenRequest getFederationTokenRequest) { return GetFederationTokenResponse.builder() - .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test").build()) + .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test") + .expiration(EXPIRATION).build()) .build(); } diff --git a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java index edd458bd86c8..88eb7de7ae4d 100644 --- a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java +++ b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java @@ -28,6 +28,7 @@ import software.amazon.awssdk.services.sts.model.AssumeRoleResponse; import software.amazon.awssdk.services.sts.model.GetFederationTokenResponse; import software.amazon.awssdk.services.sts.model.GetSessionTokenResponse; +import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.junit.jupiter.api.Assertions.assertEquals; @@ -121,6 +122,60 @@ public class STS2ProducerTest extends CamelTestSupport { .hasRootCauseMessage("getFederationToken operation requires GetFederationTokenRequest in POJO mode"); } + @Test + void assumeRoleDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() { + Exchange exchange = template.request("direct:assumeRole", e -> { + e.getIn().setHeader(STS2Constants.ROLE_ARN, "arn"); + e.getIn().setHeader(STS2Constants.ROLE_SESSION_NAME, "sessionarn"); + }); + + assertCredentialHeaders(exchange); + assertThat(exchange.getMessage().getHeader(STS2Constants.ASSUMED_ROLE_ARN)).isEqualTo("arn"); + AssumeRoleResponse body = exchange.getMessage().getBody(AssumeRoleResponse.class); + assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy"); + assertThat(body.credentials().sessionToken()).isEqualTo("test"); + } + + @Test + void getSessionTokenDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() { + Exchange exchange = template.request("direct:getSessionToken", e -> { + }); + + assertCredentialHeaders(exchange); + GetSessionTokenResponse body = exchange.getMessage().getBody(GetSessionTokenResponse.class); + assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy"); + assertThat(body.credentials().sessionToken()).isEqualTo("test"); + } + + @Test + void getFederationTokenDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() { + Exchange exchange = template.request("direct:getFederationToken", + e -> e.getIn().setHeader(STS2Constants.FEDERATED_NAME, "federation-account")); + + assertCredentialHeaders(exchange); + GetFederationTokenResponse body = exchange.getMessage().getBody(GetFederationTokenResponse.class); + assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy"); + assertThat(body.credentials().sessionToken()).isEqualTo("test"); + } + + @Test + void theSecretKeyAndSessionTokenCanBeTakenFromTheBody() { + Exchange exchange = template.request("direct:assumeRoleCredentialsFromBody", e -> { + e.getIn().setHeader(STS2Constants.ROLE_ARN, "arn"); + e.getIn().setHeader(STS2Constants.ROLE_SESSION_NAME, "sessionarn"); + }); + + assertThat(exchange.getMessage().getBody(String.class)).isEqualTo("yyy test"); + } + + private static void assertCredentialHeaders(Exchange exchange) { + assertThat(exchange.getException()).isNull(); + assertThat(exchange.getMessage().getHeaders()) + .containsEntry(STS2Constants.ACCESS_KEY_ID, "xxx") + .containsEntry(STS2Constants.EXPIRATION, AmazonSTSClientMock.EXPIRATION) + .doesNotContainKeys("CamelAwsStsSecretKey", "CamelAwsStsSessionToken"); + } + @Override protected RouteBuilder createRouteBuilder() { return new RouteBuilder() { @@ -138,6 +193,9 @@ public class STS2ProducerTest extends CamelTestSupport { .to("aws2-sts://test?stsClient=#amazonStsClient&operation=getSessionToken&pojoRequest=true"); from("direct:getFederationTokenPojo") .to("aws2-sts://test?stsClient=#amazonStsClient&operation=getFederationToken&pojoRequest=true"); + from("direct:assumeRoleCredentialsFromBody") + .to("aws2-sts://test?stsClient=#amazonStsClient&operation=assumeRole") + .setBody(simple("${body.credentials().secretAccessKey()} ${body.credentials().sessionToken()}")); } }; } diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc index c7fa7e136c87..ff6e7901f748 100644 --- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc +++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc @@ -1067,6 +1067,16 @@ will be removed in a later release. The image generation and embedding models do operations fail for such a model, and with a text model they are the same as `invokeTextModelStreaming`. Use `invokeImageModel`, `invokeEmbeddingsModel` or `invokeTextModelStreaming` instead. +=== camel-aws2-sts - the secret access key and the session token are no longer copied into headers + +The `assumeRole`, `getSessionToken` and `getFederationToken` operations of `aws2-sts` no longer set the +`CamelAwsStsSecretKey` and `CamelAwsStsSessionToken` headers. The body is the response of the AWS SDK, such as an +`AssumeRoleResponse`, and its `credentials()` hold them: use `${body.credentials().secretAccessKey()}` and +`${body.credentials().sessionToken()}` instead of the headers. The `CamelAwsStsAccessKeyId`, `CamelAwsStsExpiration` and +`CamelAwsStsAssumedRoleArn` headers are still set. + +The `STS2Constants.SECRET_KEY_ID` and `STS2Constants.SESSION_TOKEN` constants are deprecated. + === camel-weather - the CamelWeatherLocation header is the location that is queried The latitude and longitude of the current geolocation (a location of `current`, or no location) are no longer written diff --git a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java index c36966db185d..46f8225da822 100644 --- a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java +++ b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java @@ -621,7 +621,9 @@ public interface STS2EndpointBuilderFactory { return "CamelAwsStsAccessKeyId"; } /** - * The temporary secret access key. + * The temporary secret access key. Deprecation note: The producer no + * longer sets this header. Take the secret access key from the body, + * such as ${body.credentials().secretAccessKey()}. * * The option is a: {@code String} type. * @@ -629,11 +631,14 @@ public interface STS2EndpointBuilderFactory { * * @return the name of the header {@code AwsStsSecretKey}. */ + @Deprecated public String awsStsSecretKey() { return "CamelAwsStsSecretKey"; } /** - * The temporary session token. + * The temporary session token. Deprecation note: The producer no longer + * sets this header. Take the session token from the body, such as + * ${body.credentials().sessionToken()}. * * The option is a: {@code String} type. * @@ -641,6 +646,7 @@ public interface STS2EndpointBuilderFactory { * * @return the name of the header {@code AwsStsSessionToken}. */ + @Deprecated public String awsStsSessionToken() { return "CamelAwsStsSessionToken"; }
