[
https://issues.apache.org/jira/browse/CAMEL-26042?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139166#comment-18139166
]
Claus Ibsen commented on CAMEL-26042:
-------------------------------------
PR: https://github.com/apache/camel/pull/29281
The producer no longer sets CamelAwsStsSecretKey and CamelAwsStsSessionToken;
the values stay in the body, such as ${body.credentials().secretAccessKey()}.
CamelAwsStsAccessKeyId, CamelAwsStsExpiration and CamelAwsStsAssumedRoleArn are
still set. The two constants are deprecated (kept so code still compiles).
Component doc and 4.24 upgrade guide updated.
_Claude Code on behalf of Claus Ibsen (davsclaus)_
> camel-aws2-sts - do not copy the temporary secret key and session token into
> message headers
> --------------------------------------------------------------------------------------------
>
> Key: CAMEL-26042
> URL: https://issues.apache.org/jira/browse/CAMEL-26042
> Project: Camel
> Issue Type: Improvement
> Components: camel-aws2
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.24.0
>
>
> Since CAMEL-22805 the aws2-sts producer copies the temporary credentials that
> assumeRole, getSessionToken and getFederationToken give into message headers,
> as plain text: {{CamelAwsStsAccessKeyId}}, {{CamelAwsStsSecretKey}},
> {{CamelAwsStsSessionToken}} and {{CamelAwsStsExpiration}} ({{STS2Producer}},
> main 55dde649d405, lines 140-143, 180-183 and 223-226).
> The body already holds them: it is the response of the AWS SDK, such as an
> {{AssumeRoleResponse}}, with the credentials in {{credentials()}}, and its
> toString() leaves the secret access key out. Message headers are shown and
> passed on in more places than the body, such as the log EIP with showHeaders,
> tracing, the developer console, and producers that send the headers of the
> message on to the system they call.
> *Proposal*:
> * do not set {{CamelAwsStsSecretKey}} and {{CamelAwsStsSessionToken}}; a
> route takes them from the body, such as
> {{${body.credentials().secretAccessKey()}}};
> * keep {{CamelAwsStsAccessKeyId}}, {{CamelAwsStsExpiration}} and
> {{CamelAwsStsAssumedRoleArn}}, which are not secret;
> * say it in the docs and in the upgrade guide.
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
