davsclaus opened a new pull request, #29281: URL: https://github.com/apache/camel/pull/29281
Fixes [CAMEL-26042](https://issues.apache.org/jira/browse/CAMEL-26042). ## What was wrong Since CAMEL-22805, the `assumeRole`, `getSessionToken` and `getFederationToken` operations of `aws2-sts` (header mode) copied the secret access key and the session token of the temporary credentials into the `CamelAwsStsSecretKey` and `CamelAwsStsSessionToken` headers, as plain text. The body already holds them: it is the AWS SDK response (such as `AssumeRoleResponse`) with the credentials in `credentials()`. Message headers show up and travel in more places than the body: the log EIP with `showHeaders`, tracing, the developer console, and producers that send the message headers on. ## What changed - `STS2Producer` no longer sets `CamelAwsStsSecretKey` and `CamelAwsStsSessionToken` for the three operations. `CamelAwsStsAccessKeyId`, `CamelAwsStsExpiration` and `CamelAwsStsAssumedRoleArn` are still set. - `STS2Constants.SECRET_KEY_ID` and `SESSION_TOKEN` are kept (so code that uses them still compiles) but are `@Deprecated`, with a `deprecationNote` that says to read them from the body, such as `${body.credentials().secretAccessKey()}`. This follows the pattern of other deprecated header constants (e.g. `AWS2S3VectorsConstants`). ## Tests - `STS2ProducerTest`: three new tests (one per operation) check that the access key id and expiration headers are set, the secret key and session token headers are not, and the body still has both values. They failed before the fix (3 failures) and pass now. - One test checks that a route can take both values from the body with Simple: `${body.credentials().secretAccessKey()} ${body.credentials().sessionToken()}`. - `AmazonSTSClientMock.assumeRole` now returns credentials too, and all three responses get an expiration. - Module: 23 unit tests and 3 ITs pass with `-Psourcecheck`. ## Docs and generated files - Component doc: new section "The temporary credentials" saying which headers are set and how to read the secret key and session token from the body. - Upgrade guide 4.24: new `camel-aws2-sts` section. - Regenerated: component JSON, catalog JSON and doc copy, `STS2EndpointBuilderFactory` (the two header name methods are now `@Deprecated`). ## Not changed - The constants are deprecated, not removed, so user code that references them keeps compiling; they can be removed in a later release. - In `pojoRequest=true` mode the producer never set these headers; no change there. _Claude Code on behalf of Claus Ibsen (davsclaus)_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
