-
Notifications
You must be signed in to change notification settings - Fork 910
Add Environment Token support #6130
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: rvaknin/auth-schem-preference-config
Are you sure you want to change the base?
Add Environment Token support #6130
Conversation
… (support for bedrock)
codegen/src/main/java/software/amazon/awssdk/codegen/poet/builder/BaseClientBuilderClass.java
Show resolved
Hide resolved
...s-core/src/main/java/software/amazon/awssdk/awscore/internal/AwsExecutionContextBuilder.java
Outdated
Show resolved
Hide resolved
…ernal/AwsExecutionContextBuilder.java Co-authored-by: David Ho <70000000+davidh44@users.noreply.github.com>
...a/software/amazon/awssdk/services/environmenttokenprovider/EnvironmentTokenProviderTest.java
Show resolved
Hide resolved
public void beforeExecution(Context.BeforeExecution context, ExecutionAttributes executionAttributes) { | ||
SelectedAuthScheme<?> selectedAuthScheme = executionAttributes | ||
.getAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME); | ||
if (selectedAuthScheme != null && selectedAuthScheme.authSchemeOption().schemeId().equals(BearerAuthScheme.SCHEME_ID) | ||
&& selectedAuthScheme.identity().isDone()) { | ||
if (selectedAuthScheme.identity().getNow(null) instanceof TokenIdentity) { | ||
TokenIdentity configuredToken = (TokenIdentity) selectedAuthScheme.identity().getNow(null); | ||
if (configuredToken.token().equals(tokenFromEnv)) { | ||
executionAttributes.getAttribute(SdkInternalExecutionAttribute.BUSINESS_METRICS).addMetric( | ||
BusinessMetricFeatureId.BEARER_SERVICE_ENV_VARS.value()); | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a way to not use execution interceptor to capture user agent? We've had issues (executions out of order issue) in the past with doing things in execution interceptor and are moving away from that model for internal implementations
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Summarizing offline discussion:
The ordering problem is a good callout. The new <service>EnvironmentTokenMetricsInterceptor
must run after the service specific, code generated auth scheme interceptor (<Service>AuthSchemeInterceptor
). The alternatives I see are:
[non-Interceptor] - Adding logic in a stage in the request pipeline - specifically to ApplyUserAgentStage.
We need to evaluate, per request, whether the configured env token was used (since a request configuration can override it). So, we would need a client configuration thats added to the execution attributes the value of the ENV sourced token. The ApplyUserAgentStage would then check for the presence of this execution context value and if set, would then check the resolved auth is bearer and the resolved identity matches, and if so, set the metric.
Thats logic thats specific to this customization that would then be in core and that check would be done for every service since the pipeline stage is in core and not code generated. I'm not sure how we feel about that tradeoff. I'd generally lean towards trying to keep some of this service specific customization out of the core pipeline.
[Addressing with changes to generated interceptors]
We could address this in a few ways:
- Move the logic in
<service>EnvironmentTokenMetricsInterceptor
frombeforeExecution
tobeforeMarshalling
. This ensures its in a different step and eliminates ordering concerns. - Modifying code generation of the
<Service>AuthSchemeInterceptor
to include this logic when the customization is enabled. This eliminates any issue with ordering, but isn't an ideal separation of concerns.
For nowI've updated this PR with #1 from above and moved the logic from beforeExecution
to beforeMarshalling
but I can prototype out the changes required to update the ApplyUserAgentStage though if you think the tradeoffs of having that customization logic in core make sense.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Update - I've now updated the PR with alternative 2 mentioned above - I've moved the metrics logic into the generated auth scheme interceptor which will ensure we won't have ordering issues.
[DO NOT MERGE] Currently diffed against WIP authscheme preference branch. This will need to be rebased against master once PR #6083 has been merged.
Motivation and Context
Adds support for configuring bearer auth using a token sourced from the environment.
Modifications
Testing
Types of changes
Checklist
mvn install
succeedsscripts/new-change
script and following the instructions. Commit the new file created by the script in.changes/next-release
with your changes.License