Skip to content

refactor: sync types with IAM authentication changes #626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 20 commits into from
Jul 29, 2025
Merged

refactor: sync types with IAM authentication changes #626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
22f77b0
feat(runtimes): add support for IAM and STS credentials management
liramon1 Jul 7, 2025
d9c4753
chore: undo unnecessary changes
liramon1 Jul 7, 2025
db626ab
fix: re-add IamCredentials change
liramon1 Jul 7, 2025
306c2b0
chore: revert EmptyProfile change
liramon1 Jul 9, 2025
fbfb2d6
refactor: split IamCredentialProfile into multiple profiles
liramon1 Jul 10, 2025
56fc78a
chore: revert comment
liramon1 Jul 10, 2025
939241b
feat: add mfaCode to getIamCredentialParams
liramon1 Jul 10, 2025
52b509b
refactor: prefix IAM-related profiles with 'Iam'
liramon1 Jul 10, 2025
d38dbb7
refactor: move encryption into separate function and split credential id
liramon1 Jul 11, 2025
8adfdee
feat: add external_id field to profile
liramon1 Jul 11, 2025
bb6d6a2
feat: optionalize permission validation in GetIamCredentialOptions
liramon1 Jul 14, 2025
7dc451c
refactor: move MFA code retrieval into separate request
liramon1 Jul 14, 2025
38961c9
fix: add parameters to mfa request
liramon1 Jul 14, 2025
7948b97
fix: naming changes
liramon1 Jul 15, 2025
93e856d
fix: incorporate PR feedback
liramon1 Jul 17, 2025
9d1ad6b
fix: change IamCredential fields
liramon1 Jul 18, 2025
12a134e
Merge remote-tracking branch 'aws/main' into iam-revision
liramon1 Jul 18, 2025
ec9c7c4
fix: add error message for failed caller identity
liramon1 Jul 22, 2025
3444e0a
fix: add mfaSerial to MfaCode output
liramon1 Jul 25, 2025
0561836
feat: add credential override
liramon1 Jul 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 36 additions & 5 deletions runtimes/protocol/identity-management.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,35 @@ export const AwsErrorCodes = {
E_SSO_TOKEN_EXPIRED: 'E_SSO_TOKEN_EXPIRED',
E_STS_CREDENTIAL_EXPIRED: 'E_STS_CREDENTIAL_EXPIRED',
E_SSO_TOKEN_SOURCE_NOT_SUPPORTED: 'E_SSO_TOKEN_SOURCE_NOT_SUPPORTED',
E_CALLER_IDENTITY_NOT_FOUND: 'E_CALLER_IDENTITY_NOT_FOUND',
E_MFA_REQUIRED: 'E_MFA_REQUIRED',
E_PERMISSION_DENIED: 'E_PERMISSION_DENIED',
E_TIMEOUT: 'E_TIMEOUT',
E_UNKNOWN: 'E_UNKNOWN',
E_CANCELLED: 'E_CANCELLED',
} as const

// Permissions
export const PermissionSets = {
Q: [
'q:StartConversation',
'q:SendMessage',
'q:GetConversation',
'q:ListConversations',
'q:UpdateConversation',
'q:DeleteConversation',
'q:PassRequest',
'q:StartTroubleshootingAnalysis',
'q:StartTroubleshootingResolutionExplanation',
'q:GetTroubleshootingResults',
'q:UpdateTroubleshootingCommandResult',
'q:GetIdentityMetaData',
'q:GenerateCodeFromCommands',
'q:UsePlugin',
'codewhisperer:GenerateRecommendations',
],
}

export interface AwsResponseErrorData {
awsErrorCode: string
}
Expand Down Expand Up @@ -253,22 +276,29 @@ export type IamCredentialId = string // Opaque identifier

export interface GetIamCredentialOptions {
callStsOnInvalidIamCredential?: boolean
validatePermissions?: boolean
permissionSet?: string[]
credentialOverride?: IamCredentials
}

export const getIamCredentialOptionsDefaults = {
callStsOnInvalidIamCredential: true,
validatePermissions: true,
permissionSet: PermissionSets.Q,
credentialOverride: undefined,
} satisfies GetIamCredentialOptions

export interface GetIamCredentialParams {
profileName: string
options?: GetIamCredentialOptions
}

export interface GetIamCredentialResult {
export interface IamCredential {
id: IamCredentialId
kinds: ProfileKind[]
credentials: IamCredentials
}

export interface GetIamCredentialResult {
credential: IamCredential
updateCredentialsParams: UpdateCredentialsParams
}

Expand All @@ -282,12 +312,13 @@ export const getIamCredentialRequestType = new ProtocolRequestType<

// getMfaCode
export interface GetMfaCodeParams {
mfaSerial: string
profileName: string
mfaSerial?: string
}

export interface GetMfaCodeResult {
code: string
mfaSerial: string
}

export const getMfaCodeRequestType = new ProtocolRequestType<
Expand Down Expand Up @@ -318,7 +349,7 @@ export const invalidateSsoTokenRequestType = new ProtocolRequestType<

// invalidateStsCredential
export interface InvalidateStsCredentialParams {
profileName: string
iamCredentialId: IamCredentialId
}

export interface InvalidateStsCredentialResult {
Expand Down
10 changes: 5 additions & 5 deletions runtimes/runtimes/auth/standalone/encryption.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,11 +124,11 @@ export async function encryptIamResultWithKey(
request: GetIamCredentialResult,
key: string
): Promise<GetIamCredentialResult> {
request.credentials = {
accessKeyId: await encryptObjectWithKey(request.credentials.accessKeyId, key),
secretAccessKey: await encryptObjectWithKey(request.credentials.secretAccessKey, key),
...(request.credentials.sessionToken
? { sessionToken: await encryptObjectWithKey(request.credentials.sessionToken, key) }
request.credential.credentials = {
accessKeyId: await encryptObjectWithKey(request.credential.credentials.accessKeyId, key),
secretAccessKey: await encryptObjectWithKey(request.credential.credentials.secretAccessKey, key),
...(request.credential.credentials.sessionToken
? { sessionToken: await encryptObjectWithKey(request.credential.credentials.sessionToken, key) }
: {}),
}
if (!request.updateCredentialsParams.encrypted) {
Expand Down