mirror of
https://github.com/apache/doris.git
synced 2026-11-04 16:03:23 +00:00
Owen Leung
d34f06b5da
### What problem does this PR solve? Issue Number: close #66554 **Problem Summary** Fixes the issue above by forwarding `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` alongside the inline token. Given a file path, the provider will re-read it before every fetch, so credentials survive token rotation. ECS, which sets only the inline variable `AWS_CONTAINER_AUTHORIZATION_TOKEN`, is unaffected. **Why the aws-sdp-cpp bump** The `GeneralHTTPCredentialsProvider` does not exist before 1.11.221. The only container provider available at the currently pinned version is `TaskRoleCredentialsProvider`, which takes the token as a string and has no notion of a token file. 1.11.221 is the first version whose `GeneralHTTPCredentialsProvider` re-reads the token file.
78 lines
3.4 KiB
C++
78 lines
3.4 KiB
C++
// Licensed to the Apache Software Foundation (ASF) under one
|
|
// or more contributor license agreements. See the NOTICE file
|
|
// distributed with this work for additional information
|
|
// regarding copyright ownership. The ASF licenses this file
|
|
// to you under the Apache License, Version 2.0 (the
|
|
// "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
#include "custom_aws_credentials_provider_chain.h"
|
|
|
|
#include <aws/core/auth/AWSCredentialsProviderChain.h>
|
|
#include <aws/core/auth/SSOCredentialsProvider.h>
|
|
#include <aws/core/auth/STSCredentialsProvider.h>
|
|
#include <aws/core/platform/Environment.h>
|
|
#include <aws/core/utils/StringUtils.h>
|
|
#include <aws/core/utils/logging/LogMacros.h>
|
|
#include <aws/core/utils/memory/AWSMemory.h>
|
|
|
|
#include "aws_common.h"
|
|
|
|
namespace doris {
|
|
|
|
using namespace Aws::Auth;
|
|
using namespace Aws::Utils::Threading;
|
|
|
|
static const char AWS_EC2_METADATA_DISABLED[] = "AWS_EC2_METADATA_DISABLED";
|
|
static const char DefaultCredentialsProviderChainTag[] = "DefaultAWSCredentialsProviderChain";
|
|
|
|
CustomAwsCredentialsProviderChain::CustomAwsCredentialsProviderChain()
|
|
: AWSCredentialsProviderChain() {
|
|
AddProvider(Aws::MakeShared<STSAssumeRoleWebIdentityCredentialsProvider>(
|
|
DefaultCredentialsProviderChainTag));
|
|
|
|
const auto ec2MetadataDisabled = Aws::Environment::GetEnv(AWS_EC2_METADATA_DISABLED);
|
|
AWS_LOGSTREAM_DEBUG(DefaultCredentialsProviderChainTag,
|
|
"The environment variable value " << AWS_EC2_METADATA_DISABLED << " is "
|
|
<< ec2MetadataDisabled);
|
|
|
|
// One provider serves both container platforms: create_container_credentials_provider() reads
|
|
// all four AWS_CONTAINER_* variables, applies the provider's own relative-then-absolute
|
|
// precedence, and logs which variable supplied the endpoint.
|
|
if (container_credentials_available()) {
|
|
AddProvider(create_container_credentials_provider());
|
|
}
|
|
|
|
AddProvider(Aws::MakeShared<InstanceProfileCredentialsProvider>(
|
|
DefaultCredentialsProviderChainTag));
|
|
AWS_LOGSTREAM_INFO(DefaultCredentialsProviderChainTag,
|
|
"Added EC2 metadata service credentials provider to the provider chain.");
|
|
|
|
AddProvider(
|
|
Aws::MakeShared<EnvironmentAWSCredentialsProvider>(DefaultCredentialsProviderChainTag));
|
|
AddProvider(Aws::MakeShared<ProfileConfigFileAWSCredentialsProvider>(
|
|
DefaultCredentialsProviderChainTag));
|
|
AddProvider(Aws::MakeShared<ProcessCredentialsProvider>(DefaultCredentialsProviderChainTag));
|
|
|
|
AddProvider(Aws::MakeShared<SSOCredentialsProvider>(DefaultCredentialsProviderChainTag));
|
|
|
|
AddProvider(
|
|
Aws::MakeShared<AnonymousAWSCredentialsProvider>(DefaultCredentialsProviderChainTag));
|
|
}
|
|
|
|
CustomAwsCredentialsProviderChain::CustomAwsCredentialsProviderChain(
|
|
const CustomAwsCredentialsProviderChain& chain) {
|
|
for (const auto& provider : chain.GetProviders()) {
|
|
AddProvider(provider);
|
|
}
|
|
}
|
|
} |