This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch backport/29281-to-camel-4.22.x in repository https://gitbox.apache.org/repos/asf/camel.git
commit 3b228762cf926d05c78c6c597d524f75d759d47e Author: Guillaume Nodet <[email protected]> AuthorDate: Fri Nov 6 07:33:30 2026 +0000 [backport camel-4.22.x] CAMEL-26042: camel-aws2-sts - do not copy the temporary secret key and session token into message headers --- .../apache/camel/catalog/components/aws2-sts.json | 4 +- .../camel/catalog/docs/aws2-sts-component.adoc | 11 ++++ .../apache/camel/component/aws2/sts/aws2-sts.json | 4 +- .../src/main/docs/aws2-sts-component.adoc | 11 ++++ .../camel/component/aws2/sts/STS2Constants.java | 18 ++++++- .../camel/component/aws2/sts/STS2Producer.java | 9 ++-- .../component/aws2/sts/AmazonSTSClientMock.java | 15 ++++-- .../camel/component/aws2/sts/STS2ProducerTest.java | 58 ++++++++++++++++++++++ .../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 10 ++++ .../endpoint/dsl/STS2EndpointBuilderFactory.java | 10 +++- 10 files changed, 133 insertions(+), 17 deletions(-) diff --git a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json index 8c245f082b55..cf9d1fb181ed 100644 --- a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json +++ b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json @@ -50,8 +50,8 @@ "CamelAwsStsFederatedName": { "index": 3, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The name of the federated user.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#FEDERATED_NAME" }, "CamelAwsStsAssumeRoleDurationSeconds": { "index": 4, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "Integer", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The duration, in seconds, of the role session. It could go from 900 seconds, to 1 to 12 hours (dependent on administrator settings. The default if not specified is 3600 seconds.", "constantName": "org.apache.camel.component. [...] "CamelAwsStsAccessKeyId": { "index": 5, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary access key ID.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ACCESS_KEY_ID" }, - "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary secret access key.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SECRET_KEY_ID" }, - "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary session token.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SESSION_TOKEN" }, + "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the secret access key from the body, such as ${body.credentials().secretAccessKey()}.", "autowired": false, "secret": false, "description": "The temporary secret access k [...] + "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the session token from the body, such as ${body.credentials().sessionToken()}.", "autowired": false, "secret": false, "description": "The temporary session token. Depr [...] "CamelAwsStsExpiration": { "index": 8, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "java.time.Instant", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The expiration date and time of the credentials.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#EXPIRATION" }, "CamelAwsStsAssumedRoleArn": { "index": 9, "kind": "header", "displayName": "", "group": "assumeRole", "label": "assumeRole", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The Amazon Resource Name (ARN) of the assumed role.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ASSUMED_ROLE_ARN" } }, diff --git a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc index ace70ab867b0..bffc07a2293c 100644 --- a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc +++ b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc @@ -81,6 +81,17 @@ Camel-AWS STS component provides the following operation on the producer side: - getSessionToken - getFederationToken +=== The temporary credentials + +The body of the message is the response of the AWS SDK, such as an `AssumeRoleResponse`, and its `credentials()` hold +the temporary credentials. + +The producer also sets the `CamelAwsStsAccessKeyId` and `CamelAwsStsExpiration` headers, and for `assumeRole` the +`CamelAwsStsAssumedRoleArn` header. It does not set headers with the secret access key and the session token: take them +from the body, such as `${body.credentials().secretAccessKey()}` and `${body.credentials().sessionToken()}` with the +xref:languages:simple-language.adoc[Simple] language. To keep them for later steps of the route, store them in a +variable rather than in a header, as message headers are logged, traced and sent on by many producers. + == Examples === Producer Examples diff --git a/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json b/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json index 8c245f082b55..cf9d1fb181ed 100644 --- a/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json +++ b/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json @@ -50,8 +50,8 @@ "CamelAwsStsFederatedName": { "index": 3, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The name of the federated user.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#FEDERATED_NAME" }, "CamelAwsStsAssumeRoleDurationSeconds": { "index": 4, "kind": "header", "displayName": "", "group": "producer", "label": "", "required": false, "javaType": "Integer", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The duration, in seconds, of the role session. It could go from 900 seconds, to 1 to 12 hours (dependent on administrator settings. The default if not specified is 3600 seconds.", "constantName": "org.apache.camel.component. [...] "CamelAwsStsAccessKeyId": { "index": 5, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary access key ID.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ACCESS_KEY_ID" }, - "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary secret access key.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SECRET_KEY_ID" }, - "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The temporary session token.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#SESSION_TOKEN" }, + "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the secret access key from the body, such as ${body.credentials().secretAccessKey()}.", "autowired": false, "secret": false, "description": "The temporary secret access k [...] + "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "String", "deprecated": true, "deprecationNote": "The producer no longer sets this header. Take the session token from the body, such as ${body.credentials().sessionToken()}.", "autowired": false, "secret": false, "description": "The temporary session token. Depr [...] "CamelAwsStsExpiration": { "index": 8, "kind": "header", "displayName": "", "group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole getSessionToken getFederationToken", "required": false, "javaType": "java.time.Instant", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The expiration date and time of the credentials.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#EXPIRATION" }, "CamelAwsStsAssumedRoleArn": { "index": 9, "kind": "header", "displayName": "", "group": "assumeRole", "label": "assumeRole", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The Amazon Resource Name (ARN) of the assumed role.", "constantName": "org.apache.camel.component.aws2.sts.STS2Constants#ASSUMED_ROLE_ARN" } }, diff --git a/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc b/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc index ace70ab867b0..bffc07a2293c 100644 --- a/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc +++ b/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc @@ -81,6 +81,17 @@ Camel-AWS STS component provides the following operation on the producer side: - getSessionToken - getFederationToken +=== The temporary credentials + +The body of the message is the response of the AWS SDK, such as an `AssumeRoleResponse`, and its `credentials()` hold +the temporary credentials. + +The producer also sets the `CamelAwsStsAccessKeyId` and `CamelAwsStsExpiration` headers, and for `assumeRole` the +`CamelAwsStsAssumedRoleArn` header. It does not set headers with the secret access key and the session token: take them +from the body, such as `${body.credentials().secretAccessKey()}` and `${body.credentials().sessionToken()}` with the +xref:languages:simple-language.adoc[Simple] language. To keep them for later steps of the route, store them in a +variable rather than in a header, as message headers are logged, traced and sent on by many producers. + == Examples === Producer Examples diff --git a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java index 4dd8f30655d8..6f052ae3e55a 100644 --- a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java +++ b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java @@ -37,11 +37,25 @@ public interface STS2Constants { @Metadata(label = "assumeRole getSessionToken getFederationToken", description = "The temporary access key ID.", javaType = "String") String ACCESS_KEY_ID = "CamelAwsStsAccessKeyId"; + /** + * @deprecated the producer no longer sets this header. Take the secret access key from the body, such as + * {@code ${body.credentials().secretAccessKey()}}. + */ @Metadata(label = "assumeRole getSessionToken getFederationToken", - description = "The temporary secret access key.", javaType = "String") + description = "The temporary secret access key.", javaType = "String", + deprecationNote = "The producer no longer sets this header. Take the secret access key from the body," + + " such as ${body.credentials().secretAccessKey()}.") + @Deprecated String SECRET_KEY_ID = "CamelAwsStsSecretKey"; + /** + * @deprecated the producer no longer sets this header. Take the session token from the body, such as + * {@code ${body.credentials().sessionToken()}}. + */ @Metadata(label = "assumeRole getSessionToken getFederationToken", - description = "The temporary session token.", javaType = "String") + description = "The temporary session token.", javaType = "String", + deprecationNote = "The producer no longer sets this header. Take the session token from the body, such" + + " as ${body.credentials().sessionToken()}.") + @Deprecated String SESSION_TOKEN = "CamelAwsStsSessionToken"; @Metadata(label = "assumeRole getSessionToken getFederationToken", description = "The expiration date and time of the credentials.", javaType = "java.time.Instant") diff --git a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java index b795028b1e6e..78faf42b4eb9 100644 --- a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java +++ b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java @@ -137,9 +137,8 @@ public class STS2Producer extends DefaultProducer { Message message = getMessageForResponse(exchange); message.setBody(result); if (ObjectHelper.isNotEmpty(result.credentials())) { + // the secret access key and the session token are only in the body, not in headers message.setHeader(STS2Constants.ACCESS_KEY_ID, result.credentials().accessKeyId()); - message.setHeader(STS2Constants.SECRET_KEY_ID, result.credentials().secretAccessKey()); - message.setHeader(STS2Constants.SESSION_TOKEN, result.credentials().sessionToken()); message.setHeader(STS2Constants.EXPIRATION, result.credentials().expiration()); } if (ObjectHelper.isNotEmpty(result.assumedRoleUser())) { @@ -177,9 +176,8 @@ public class STS2Producer extends DefaultProducer { Message message = getMessageForResponse(exchange); message.setBody(result); if (ObjectHelper.isNotEmpty(result.credentials())) { + // the secret access key and the session token are only in the body, not in headers message.setHeader(STS2Constants.ACCESS_KEY_ID, result.credentials().accessKeyId()); - message.setHeader(STS2Constants.SECRET_KEY_ID, result.credentials().secretAccessKey()); - message.setHeader(STS2Constants.SESSION_TOKEN, result.credentials().sessionToken()); message.setHeader(STS2Constants.EXPIRATION, result.credentials().expiration()); } } @@ -220,9 +218,8 @@ public class STS2Producer extends DefaultProducer { Message message = getMessageForResponse(exchange); message.setBody(result); if (ObjectHelper.isNotEmpty(result.credentials())) { + // the secret access key and the session token are only in the body, not in headers message.setHeader(STS2Constants.ACCESS_KEY_ID, result.credentials().accessKeyId()); - message.setHeader(STS2Constants.SECRET_KEY_ID, result.credentials().secretAccessKey()); - message.setHeader(STS2Constants.SESSION_TOKEN, result.credentials().sessionToken()); message.setHeader(STS2Constants.EXPIRATION, result.credentials().expiration()); } } diff --git a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java index 2ac6d4247cbf..832f25717772 100644 --- a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java +++ b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java @@ -16,6 +16,8 @@ */ package org.apache.camel.component.aws2.sts; +import java.time.Instant; + import software.amazon.awssdk.services.sts.StsClient; import software.amazon.awssdk.services.sts.StsServiceClientConfiguration; import software.amazon.awssdk.services.sts.model.AssumeRoleRequest; @@ -29,18 +31,24 @@ import software.amazon.awssdk.services.sts.model.GetSessionTokenResponse; public class AmazonSTSClientMock implements StsClient { + static final Instant EXPIRATION = Instant.parse("2026-01-01T00:00:00Z"); + public AmazonSTSClientMock() { } @Override public AssumeRoleResponse assumeRole(AssumeRoleRequest assumeRoleRequest) { - return AssumeRoleResponse.builder().assumedRoleUser(AssumedRoleUser.builder().arn("arn").build()).build(); + return AssumeRoleResponse.builder().assumedRoleUser(AssumedRoleUser.builder().arn("arn").build()) + .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test") + .expiration(EXPIRATION).build()) + .build(); } @Override public GetSessionTokenResponse getSessionToken(GetSessionTokenRequest getSessionTokenRequest) { return GetSessionTokenResponse.builder() - .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test").build()) + .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test") + .expiration(EXPIRATION).build()) .build(); } @@ -52,7 +60,8 @@ public class AmazonSTSClientMock implements StsClient { @Override public GetFederationTokenResponse getFederationToken(GetFederationTokenRequest getFederationTokenRequest) { return GetFederationTokenResponse.builder() - .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test").build()) + .credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test") + .expiration(EXPIRATION).build()) .build(); } diff --git a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java index edd458bd86c8..88eb7de7ae4d 100644 --- a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java +++ b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java @@ -28,6 +28,7 @@ import software.amazon.awssdk.services.sts.model.AssumeRoleResponse; import software.amazon.awssdk.services.sts.model.GetFederationTokenResponse; import software.amazon.awssdk.services.sts.model.GetSessionTokenResponse; +import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.junit.jupiter.api.Assertions.assertEquals; @@ -121,6 +122,60 @@ public class STS2ProducerTest extends CamelTestSupport { .hasRootCauseMessage("getFederationToken operation requires GetFederationTokenRequest in POJO mode"); } + @Test + void assumeRoleDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() { + Exchange exchange = template.request("direct:assumeRole", e -> { + e.getIn().setHeader(STS2Constants.ROLE_ARN, "arn"); + e.getIn().setHeader(STS2Constants.ROLE_SESSION_NAME, "sessionarn"); + }); + + assertCredentialHeaders(exchange); + assertThat(exchange.getMessage().getHeader(STS2Constants.ASSUMED_ROLE_ARN)).isEqualTo("arn"); + AssumeRoleResponse body = exchange.getMessage().getBody(AssumeRoleResponse.class); + assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy"); + assertThat(body.credentials().sessionToken()).isEqualTo("test"); + } + + @Test + void getSessionTokenDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() { + Exchange exchange = template.request("direct:getSessionToken", e -> { + }); + + assertCredentialHeaders(exchange); + GetSessionTokenResponse body = exchange.getMessage().getBody(GetSessionTokenResponse.class); + assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy"); + assertThat(body.credentials().sessionToken()).isEqualTo("test"); + } + + @Test + void getFederationTokenDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() { + Exchange exchange = template.request("direct:getFederationToken", + e -> e.getIn().setHeader(STS2Constants.FEDERATED_NAME, "federation-account")); + + assertCredentialHeaders(exchange); + GetFederationTokenResponse body = exchange.getMessage().getBody(GetFederationTokenResponse.class); + assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy"); + assertThat(body.credentials().sessionToken()).isEqualTo("test"); + } + + @Test + void theSecretKeyAndSessionTokenCanBeTakenFromTheBody() { + Exchange exchange = template.request("direct:assumeRoleCredentialsFromBody", e -> { + e.getIn().setHeader(STS2Constants.ROLE_ARN, "arn"); + e.getIn().setHeader(STS2Constants.ROLE_SESSION_NAME, "sessionarn"); + }); + + assertThat(exchange.getMessage().getBody(String.class)).isEqualTo("yyy test"); + } + + private static void assertCredentialHeaders(Exchange exchange) { + assertThat(exchange.getException()).isNull(); + assertThat(exchange.getMessage().getHeaders()) + .containsEntry(STS2Constants.ACCESS_KEY_ID, "xxx") + .containsEntry(STS2Constants.EXPIRATION, AmazonSTSClientMock.EXPIRATION) + .doesNotContainKeys("CamelAwsStsSecretKey", "CamelAwsStsSessionToken"); + } + @Override protected RouteBuilder createRouteBuilder() { return new RouteBuilder() { @@ -138,6 +193,9 @@ public class STS2ProducerTest extends CamelTestSupport { .to("aws2-sts://test?stsClient=#amazonStsClient&operation=getSessionToken&pojoRequest=true"); from("direct:getFederationTokenPojo") .to("aws2-sts://test?stsClient=#amazonStsClient&operation=getFederationToken&pojoRequest=true"); + from("direct:assumeRoleCredentialsFromBody") + .to("aws2-sts://test?stsClient=#amazonStsClient&operation=assumeRole") + .setBody(simple("${body.credentials().secretAccessKey()} ${body.credentials().sessionToken()}")); } }; } diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc index fabd1efa9091..b7fd3bddfc23 100644 --- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc +++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc @@ -1943,6 +1943,16 @@ If you relied on the previous silent no-op, ensure the body is the correct request type when `pojoRequest=true`, or drive the operation through headers with `pojoRequest=false`. +=== camel-aws2-sts - the secret access key and the session token are no longer copied into headers + +The `assumeRole`, `getSessionToken` and `getFederationToken` operations of `aws2-sts` no longer set the +`CamelAwsStsSecretKey` and `CamelAwsStsSessionToken` headers. The body is the response of the AWS SDK, such as an +`AssumeRoleResponse`, and its `credentials()` hold them: use `${body.credentials().secretAccessKey()}` and +`${body.credentials().sessionToken()}` instead of the headers. The `CamelAwsStsAccessKeyId`, `CamelAwsStsExpiration` and +`CamelAwsStsAssumedRoleArn` headers are still set. + +The `STS2Constants.SECRET_KEY_ID` and `STS2Constants.SESSION_TOKEN` constants are deprecated. + === camel-google-storage - downloads are confined to the configured directory When the consumer is configured with `downloadFileName` pointing at a directory, the diff --git a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java index c36966db185d..46f8225da822 100644 --- a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java +++ b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java @@ -621,7 +621,9 @@ public interface STS2EndpointBuilderFactory { return "CamelAwsStsAccessKeyId"; } /** - * The temporary secret access key. + * The temporary secret access key. Deprecation note: The producer no + * longer sets this header. Take the secret access key from the body, + * such as ${body.credentials().secretAccessKey()}. * * The option is a: {@code String} type. * @@ -629,11 +631,14 @@ public interface STS2EndpointBuilderFactory { * * @return the name of the header {@code AwsStsSecretKey}. */ + @Deprecated public String awsStsSecretKey() { return "CamelAwsStsSecretKey"; } /** - * The temporary session token. + * The temporary session token. Deprecation note: The producer no longer + * sets this header. Take the session token from the body, such as + * ${body.credentials().sessionToken()}. * * The option is a: {@code String} type. * @@ -641,6 +646,7 @@ public interface STS2EndpointBuilderFactory { * * @return the name of the header {@code AwsStsSessionToken}. */ + @Deprecated public String awsStsSessionToken() { return "CamelAwsStsSessionToken"; }
