Skip to content

Commit 374440d

Browse files
wty-Bryantwty-Bryant
authored
Merge pull request #2490 from aws/feat-aid-endpoints
Support aws account id in endpoint2.0 routing
2 parents aa796dc + 3133994 commit 374440d

File tree

1,593 files changed

+21682
-5800
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,593 files changed

+21682
-5800
lines changed

‎.changelog/783a73b97a9843d991c055e06537c43c.json

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"id": "783a73b9-7a98-43d9-91c0-55e06537c43c",
3+
"type": "feature",
4+
"description": "Support accountID-based endpoint routing.",
5+
"modules": [
6+
"."
7+
]
8+
}

‎aws/accountid_endpoint_mode.go

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package aws
2+
3+
// AccountIDEndpointMode controls how a resolved AWS account ID is handled for endpoint routing.
4+
type AccountIDEndpointMode string
5+
6+
const (
7+
// AccountIDEndpointModeUnset indicates the AWS account ID will not be used for endpoint routing
8+
AccountIDEndpointModeUnset AccountIDEndpointMode = ""
9+
10+
// AccountIDEndpointModePreferred indicates the AWS account ID will be used for endpoint routing if present
11+
AccountIDEndpointModePreferred = "preferred"
12+
13+
// AccountIDEndpointModeRequired indicates an error will be returned if the AWS account ID is not resolved from identity
14+
AccountIDEndpointModeRequired = "required"
15+
16+
// AccountIDEndpointModeDisabled indicates the AWS account ID will be ignored during endpoint routing
17+
AccountIDEndpointModeDisabled = "disabled"
18+
)

‎aws/config.go

+3
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,9 @@ type Config struct {
162162
// This variable is sourced from environment variable AWS_REQUEST_MIN_COMPRESSION_SIZE_BYTES or
163163
// the shared config profile attribute request_min_compression_size_bytes
164164
RequestMinCompressSizeBytes int64
165+
166+
// Controls how a resolved AWS account ID is handled for endpoint routing.
167+
AccountIDEndpointMode AccountIDEndpointMode
165168
}
166169

167170
// NewConfig returns a new Config pointer that can be chained with builder

‎aws/credentials.go

+3
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,9 @@ type Credentials struct {
9090
// The time the credentials will expire at. Should be ignored if CanExpire
9191
// is false.
9292
Expires time.Time
93+
94+
// The ID of the account for the credentials.
95+
AccountID string
9396
}
9497

9598
// Expired returns if the credentials have expired.

‎codegen/smithy-aws-go-codegen/src/main/java/software/amazon/smithy/aws/go/codegen/AddAwsConfigFields.java

+7
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,8 @@ public class AddAwsConfigFields implements GoIntegration {
8181

8282
private static final String REQUEST_MIN_COMPRESSION_SIZE_BYTES = "RequestMinCompressSizeBytes";
8383

84+
private static final String SDK_ACCOUNTID_ENDPOINT_MODE = "AccountIDEndpointMode";
85+
8486
private static final List<AwsConfigField> AWS_CONFIG_FIELDS = ListUtils.of(
8587
AwsConfigField.builder()
8688
.name(REGION_CONFIG_NAME)
@@ -235,6 +237,11 @@ public class AddAwsConfigFields implements GoIntegration {
235237
.documentation("The inclusive min request body size to be compressed.")
236238
.servicePredicate(RequestCompression::isRequestCompressionService)
237239
.generatedOnClient(false)
240+
.build(),
241+
AwsConfigField.builder()
242+
.name(SDK_ACCOUNTID_ENDPOINT_MODE)
243+
.type(SdkGoTypes.Aws.AccountIDEndpointMode)
244+
.documentation("Indicates how aws account ID is applied in endpoint2.0 routing")
238245
.build()
239246
);
240247

‎codegen/smithy-aws-go-codegen/src/main/java/software/amazon/smithy/aws/go/codegen/SdkGoTypes.java

+5
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,11 @@ public static final class Aws {
3333

3434
public static final Symbol IsCredentialsProvider = AwsGoDependency.AWS_CORE.valueSymbol("IsCredentialsProvider");
3535
public static final Symbol AnonymousCredentials = AwsGoDependency.AWS_CORE.pointableSymbol("AnonymousCredentials");
36+
public static final Symbol AccountIDEndpointMode = AwsGoDependency.AWS_CORE.valueSymbol("AccountIDEndpointMode");
37+
public static final Symbol AccountIDEndpointModeUnset = AwsGoDependency.AWS_CORE.valueSymbol("AccountIDEndpointModeUnset");
38+
public static final Symbol AccountIDEndpointModePreferred = AwsGoDependency.AWS_CORE.valueSymbol("AccountIDEndpointModePreferred");
39+
public static final Symbol AccountIDEndpointModeRequired = AwsGoDependency.AWS_CORE.valueSymbol("AccountIDEndpointModeRequired");
40+
public static final Symbol AccountIDEndpointModeDisabled = AwsGoDependency.AWS_CORE.valueSymbol("AccountIDEndpointModeDisabled");
3641

3742

3843
public static final class Middleware {

‎codegen/smithy-aws-go-codegen/src/main/java/software/amazon/smithy/aws/go/codegen/customization/AccountIDEndpointRouting.java

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
package software.amazon.smithy.aws.go.codegen.customization;
2+
3+
import software.amazon.smithy.aws.go.codegen.SdkGoTypes;
4+
import software.amazon.smithy.codegen.core.SymbolProvider;
5+
import software.amazon.smithy.go.codegen.GoDelegator;
6+
import software.amazon.smithy.go.codegen.GoSettings;
7+
import software.amazon.smithy.go.codegen.GoStdlibTypes;
8+
import software.amazon.smithy.go.codegen.GoWriter;
9+
import software.amazon.smithy.go.codegen.integration.GoIntegration;
10+
import software.amazon.smithy.go.codegen.SmithyGoTypes;
11+
import software.amazon.smithy.model.Model;
12+
import software.amazon.smithy.rulesengine.traits.EndpointRuleSetTrait;
13+
import software.amazon.smithy.utils.MapUtils;
14+
15+
import static software.amazon.smithy.go.codegen.GoWriter.goTemplate;
16+
17+
public class AccountIDEndpointRouting implements GoIntegration {
18+
@Override
19+
public void renderPreEndpointResolutionHook(GoSettings settings, GoWriter writer, Model model) {
20+
writer.write("""
21+
if err := checkAccountID(getIdentity(ctx), m.options.AccountIDEndpointMode); err != nil {
22+
return out, metadata, $T("invalid accountID set: %w", err)
23+
}
24+
""",
25+
GoStdlibTypes.Fmt.Errorf);
26+
}
27+
28+
@Override
29+
public void writeAdditionalFiles(
30+
GoSettings settings,
31+
Model model,
32+
SymbolProvider symbolProvider,
33+
GoDelegator goDelegator
34+
) {
35+
if (!settings.getService(model).hasTrait(EndpointRuleSetTrait.class)) {
36+
return;
37+
}
38+
goDelegator.useShapeWriter(settings.getService(model), goTemplate("""
39+
func checkAccountID(identity $auth:T, mode $accountIDEndpointMode:T) error {
40+
switch mode {
41+
case $aidModeUnset:T:
42+
case $aidModePreferred:T:
43+
case $aidModeDisabled:T:
44+
case $aidModeRequired:T:
45+
if ca, ok := identity.(*$credentialsAdapter:T); !ok {
46+
return $errorf:T("accountID is required but not set")
47+
} else if ca.Credentials.AccountID == "" {
48+
return $errorf:T("accountID is required but not set")
49+
}
50+
// default check in case invalid mode is configured through request config
51+
default:
52+
return $errorf:T("invalid accountID endpoint mode %s, must be preferred/required/disabled", mode)
53+
}
54+
55+
return nil
56+
}
57+
""",
58+
MapUtils.of(
59+
"auth", SmithyGoTypes.Auth.Identity,
60+
"accountIDEndpointMode", SdkGoTypes.Aws.AccountIDEndpointMode,
61+
"credentialsAdapter", SdkGoTypes.Internal.Auth.Smithy.CredentialsAdapter,
62+
"aidModePreferred", SdkGoTypes.Aws.AccountIDEndpointModePreferred,
63+
"aidModeRequired", SdkGoTypes.Aws.AccountIDEndpointModeRequired,
64+
"aidModeUnset", SdkGoTypes.Aws.AccountIDEndpointModeUnset,
65+
"aidModeDisabled", SdkGoTypes.Aws.AccountIDEndpointModeDisabled,
66+
"errorf", GoStdlibTypes.Fmt.Errorf
67+
)
68+
));
69+
}
70+
}

‎codegen/smithy-aws-go-codegen/src/main/java/software/amazon/smithy/aws/go/codegen/customization/AwsAuthResolution.java

+5-4
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import software.amazon.smithy.aws.traits.auth.SigV4Trait;
2020
import software.amazon.smithy.codegen.core.SymbolProvider;
2121
import software.amazon.smithy.go.codegen.GoDelegator;
22+
import software.amazon.smithy.go.codegen.GoStdlibTypes;
2223
import software.amazon.smithy.go.codegen.GoSettings;
2324
import software.amazon.smithy.go.codegen.GoWriter;
2425
import software.amazon.smithy.go.codegen.SymbolUtils;
@@ -94,17 +95,17 @@ private boolean isSigV4Service(Model model, ServiceShape service) {
9495

9596
private GoWriter.Writable writeRegionResolver() {
9697
return goTemplate("""
97-
func bindAuthParamsRegion(params $P, _ interface{}, options Options) {
98+
func bindAuthParamsRegion( _ interface{}, params $P, _ interface{}, options Options) {
9899
params.Region = options.Region
99100
}
100101
""", AuthParametersGenerator.STRUCT_SYMBOL);
101102
}
102103

103104
private GoWriter.Writable writeEndpointParamResolver() {
104105
return goTemplate("""
105-
func bindAuthEndpointParams(params $P, input interface{}, options Options) {
106-
params.endpointParams = bindEndpointParams(input, options)
106+
func bindAuthEndpointParams(ctx $P, params $P, input interface{}, options Options) {
107+
params.endpointParams = bindEndpointParams(ctx, input, options)
107108
}
108-
""", AuthParametersGenerator.STRUCT_SYMBOL);
109+
""", GoStdlibTypes.Context.Context, AuthParametersGenerator.STRUCT_SYMBOL);
109110
}
110111
}

‎codegen/smithy-aws-go-codegen/src/main/java/software/amazon/smithy/aws/go/codegen/customization/AwsEndpointBuiltins.java

+31
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,13 @@
55
import software.amazon.smithy.go.codegen.GoDelegator;
66
import software.amazon.smithy.go.codegen.GoSettings;
77
import software.amazon.smithy.go.codegen.GoWriter;
8+
import software.amazon.smithy.go.codegen.SmithyGoTypes;
89
import software.amazon.smithy.go.codegen.integration.GoIntegration;
910
import software.amazon.smithy.go.codegen.integration.RuntimeClientPlugin;
1011
import software.amazon.smithy.model.Model;
12+
import software.amazon.smithy.rulesengine.traits.EndpointRuleSetTrait;
1113
import software.amazon.smithy.utils.ListUtils;
14+
import software.amazon.smithy.utils.MapUtils;
1215

1316
import java.util.List;
1417

@@ -36,6 +39,8 @@ public class AwsEndpointBuiltins implements GoIntegration {
3639
goTemplate("$T(options.UseARNRegion)", SdkGoTypes.Aws.Bool);
3740
private static final GoWriter.Writable BindAwsS3DisableMultiRegionAccessPoints =
3841
goTemplate("$T(options.DisableMultiRegionAccessPoints)", SdkGoTypes.Aws.Bool);
42+
private static final GoWriter.Writable BindAccountID =
43+
goTemplate("resolveAccountID(getIdentity(ctx), options.AccountIDEndpointMode)");
3944

4045
@Override
4146
public List<RuntimeClientPlugin> getClientPlugins() {
@@ -49,12 +54,38 @@ public List<RuntimeClientPlugin> getClientPlugins() {
4954
.addEndpointBuiltinBinding("AWS::S3::UseArnRegion", BindAwsS3UseArnRegion)
5055
.addEndpointBuiltinBinding("AWS::S3::DisableMultiRegionAccessPoints", BindAwsS3DisableMultiRegionAccessPoints)
5156
.addEndpointBuiltinBinding("AWS::S3Control::UseArnRegion", BindAwsS3UseArnRegion)
57+
.addEndpointBuiltinBinding("AWS::Auth::AccountId", BindAccountID)
5258
.build());
5359
}
5460

5561
@Override
5662
public void writeAdditionalFiles(GoSettings settings, Model model, SymbolProvider symbolProvider, GoDelegator goDelegator) {
5763
goDelegator.useFileWriter("endpoints.go", settings.getModuleName(), builtinBindingSource());
64+
if (!settings.getService(model).hasTrait(EndpointRuleSetTrait.class)) {
65+
return;
66+
}
67+
goDelegator.useShapeWriter(settings.getService(model), goTemplate("""
68+
func resolveAccountID(identity $auth:T, mode $accountIDEndpointMode:T) *string {
69+
if mode == $aidModeDisabled:T {
70+
return nil
71+
}
72+
73+
if ca, ok := identity.(*$credentialsAdapter:T); ok && ca.Credentials.AccountID != "" {
74+
return $string:T(ca.Credentials.AccountID)
75+
}
76+
77+
return nil
78+
}
79+
""",
80+
MapUtils.of(
81+
"auth", SmithyGoTypes.Auth.Identity,
82+
"accountIDEndpointMode", SdkGoTypes.Aws.AccountIDEndpointMode,
83+
"aidModeUnset", SdkGoTypes.Aws.AccountIDEndpointModeUnset,
84+
"aidModeDisabled", SdkGoTypes.Aws.AccountIDEndpointModeDisabled,
85+
"credentialsAdapter", SdkGoTypes.Internal.Auth.Smithy.CredentialsAdapter,
86+
"string", SdkGoTypes.Aws.String
87+
)
88+
));
5889
}
5990

6091
private GoWriter.Writable builtinBindingSource() {

‎codegen/smithy-aws-go-codegen/src/main/resources/META-INF/services/software.amazon.smithy.go.codegen.integration.GoIntegration

+2-1
Original file line numberDiff line numberDiff line change
@@ -76,4 +76,5 @@ software.amazon.smithy.aws.go.codegen.customization.CloudFrontKVSSigV4a
7676
software.amazon.smithy.aws.go.codegen.customization.BackfillProtocolTestServiceTrait
7777
software.amazon.smithy.go.codegen.integration.MiddlewareStackSnapshotTests
7878
software.amazon.smithy.aws.go.codegen.customization.s3.S3ExpiresShapeCustomization
79-
software.amazon.smithy.aws.go.codegen.ClockSkewGenerator
79+
software.amazon.smithy.aws.go.codegen.ClockSkewGenerator
80+
software.amazon.smithy.aws.go.codegen.customization.AccountIDEndpointRouting

‎config/config.go

+3
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,9 @@ var defaultAWSConfigResolvers = []awsConfigResolver{
8080

8181
// Sets the RequestMinCompressSizeBytes if present in env var or shared config profile
8282
resolveRequestMinCompressSizeBytes,
83+
84+
// Sets the AccountIDEndpointMode if present in env var or shared config profile
85+
resolveAccountIDEndpointMode,
8386
}
8487

8588
// A Config represents a generic configuration value or set of values. This type

‎config/env_config.go

+37
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,9 @@ const (
8080
awsRequestMinCompressionSizeBytes = "AWS_REQUEST_MIN_COMPRESSION_SIZE_BYTES"
8181

8282
awsS3DisableExpressSessionAuthEnv = "AWS_S3_DISABLE_EXPRESS_SESSION_AUTH"
83+
84+
awsAccountIDEnv = "AWS_ACCOUNT_ID"
85+
awsAccountIDEndpointModeEnv = "AWS_ACCOUNT_ID_ENDPOINT_MODE"
8386
)
8487

8588
var (
@@ -290,6 +293,9 @@ type EnvConfig struct {
290293
// will only bypass the modified endpoint routing and signing behaviors
291294
// associated with the feature.
292295
S3DisableExpressAuth *bool
296+
297+
// Indicates whether account ID will be required/ignored in endpoint2.0 routing
298+
AccountIDEndpointMode aws.AccountIDEndpointMode
293299
}
294300

295301
// loadEnvConfig reads configuration values from the OS's environment variables.
@@ -309,6 +315,7 @@ func NewEnvConfig() (EnvConfig, error) {
309315
setStringFromEnvVal(&creds.AccessKeyID, credAccessEnvKeys)
310316
setStringFromEnvVal(&creds.SecretAccessKey, credSecretEnvKeys)
311317
if creds.HasKeys() {
318+
creds.AccountID = os.Getenv(awsAccountIDEnv)
312319
creds.SessionToken = os.Getenv(awsSessionTokenEnvVar)
313320
cfg.Credentials = creds
314321
}
@@ -389,6 +396,10 @@ func NewEnvConfig() (EnvConfig, error) {
389396
return cfg, err
390397
}
391398

399+
if err := setAIDEndPointModeFromEnvVal(&cfg.AccountIDEndpointMode, []string{awsAccountIDEndpointModeEnv}); err != nil {
400+
return cfg, err
401+
}
402+
392403
return cfg, nil
393404
}
394405

@@ -417,6 +428,10 @@ func (c EnvConfig) getRequestMinCompressSizeBytes(context.Context) (int64, bool,
417428
return *c.RequestMinCompressSizeBytes, true, nil
418429
}
419430

431+
func (c EnvConfig) getAccountIDEndpointMode(context.Context) (aws.AccountIDEndpointMode, bool, error) {
432+
return c.AccountIDEndpointMode, len(c.AccountIDEndpointMode) > 0, nil
433+
}
434+
420435
// GetRetryMaxAttempts returns the value of AWS_MAX_ATTEMPTS if was specified,
421436
// and not 0.
422437
func (c EnvConfig) GetRetryMaxAttempts(ctx context.Context) (int, bool, error) {
@@ -491,6 +506,28 @@ func setEC2IMDSEndpointMode(mode *imds.EndpointModeState, keys []string) error {
491506
return nil
492507
}
493508

509+
func setAIDEndPointModeFromEnvVal(m *aws.AccountIDEndpointMode, keys []string) error {
510+
for _, k := range keys {
511+
value := os.Getenv(k)
512+
if len(value) == 0 {
513+
continue
514+
}
515+
516+
switch value {
517+
case "preferred":
518+
*m = aws.AccountIDEndpointModePreferred
519+
case "required":
520+
*m = aws.AccountIDEndpointModeRequired
521+
case "disabled":
522+
*m = aws.AccountIDEndpointModeDisabled
523+
default:
524+
return fmt.Errorf("invalid value for environment variable, %s=%s, must be preferred/required/disabled", k, value)
525+
}
526+
break
527+
}
528+
return nil
529+
}
530+
494531
// GetRegion returns the AWS Region if set in the environment. Returns an empty
495532
// string if not set.
496533
func (c EnvConfig) getRegion(ctx context.Context) (string, bool, error) {

‎config/env_config_test.go

+27
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,17 @@ func TestNewEnvConfig_Creds(t *testing.T) {
8080
Source: CredentialsSourceName,
8181
},
8282
},
83+
{
84+
Env: map[string]string{
85+
"AWS_ACCESS_KEY_ID": "AKID",
86+
"AWS_SECRET_ACCESS_KEY": "SECRET",
87+
"AWS_ACCOUNT_ID": "012345678901",
88+
},
89+
Val: aws.Credentials{
90+
AccessKeyID: "AKID", SecretAccessKey: "SECRET", AccountID: "012345678901",
91+
Source: CredentialsSourceName,
92+
},
93+
},
8394
}
8495

8596
for i, c := range cases {
@@ -496,6 +507,22 @@ func TestNewEnvConfig(t *testing.T) {
496507
},
497508
WantErr: true,
498509
},
510+
46: {
511+
Env: map[string]string{
512+
"AWS_ACCOUNT_ID_ENDPOINT_MODE": "required",
513+
},
514+
Config: EnvConfig{
515+
AccountIDEndpointMode: aws.AccountIDEndpointModeRequired,
516+
},
517+
WantErr: false,
518+
},
519+
47: {
520+
Env: map[string]string{
521+
"AWS_ACCOUNT_ID_ENDPOINT_MODE": "blabla",
522+
},
523+
Config: EnvConfig{},
524+
WantErr: true,
525+
},
499526
}
500527

501528
for i, c := range cases {

0 commit comments

Comments
 (0)