File: //opt/cppython/lib/python3.8/site-packages/botocore/__pycache__/credentials.cpython-38.pyc
U
KD�g-X � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl
m Z d dl m
Z
d dlmZ d dlmZmZ d dlZd dlZd dlmZ d dlmZmZ d d lmZ d d
lm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ d d l%m&Z& d d l'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ e�0e1�Z2e d
ddddgdd�Z3dZ4dZ5dUdd�Z6G dd� d�Z7dd� Z8d d � Z9d d � Z:dVd!d"�Z;d#d$� Z<d%d&� Z=d'd(� Z>G d)d*� d*�Z?G d+d,� d,e?�Z@G d-d.� d.e@�ZAG d/d0� d0�ZBG d1d2� d2eB�ZCG d3d4� d4eC�ZDG d5d6� d6eC�ZEG d7d8� d8�ZFG d9d:� d:eF�ZGG d;d<� d<eF�ZHG d=d>� d>eF�ZIG d?d@� d@eF�ZJG dAdB� dBeF�ZKG dCdD� dDeF�ZLG dEdF� dFeF�ZMG dGdH� dHeF�ZNG dIdJ� dJeF�ZOG dKdL� dL�ZPG dMdN� dNeF�ZQG dOdP� dP�ZRG dQdR� dReB�ZSG dSdT� dTeF�ZTdS )W� N)�
namedtuple)�deepcopy)�sha1��parse)�tzlocal�tzutc)�UNSIGNED)�compat_shell_split�
total_seconds)�Config) �ConfigNotFound�CredentialRetrievalError�InfiniteLoopConfigError�InvalidConfigError�MetadataRetrievalError�PartialCredentialsError� RefreshWithMFAUnsupportedError�UnauthorizedSSOTokenError�UnknownCredentialError)�SSOTokenProvider)� ArnParser�ContainerMetadataFetcher�FileWebIdentityTokenLoader�InstanceMetadataFetcher�
JSONFileCache�SSOTokenLoader�parse_key_val_file�resolve_imds_endpoint_mode�ReadOnlyCredentials�
access_key�
secret_key�token�
account_id�N)�defaultsiX � c s � � d�p d}� � d�}� � d�}� �� �d�dk }� � d�t� �t� � d�d�}|dkr^i }t� }t� } tt||� � � |d �d
�}
t
� ||d �} t � fd d
�t � |�||t
|| |
g�| d�} || g}
| j||d�}t� t� | |
g}|
| | }|�r
|�|� t�d� t|d�}|S )z�Create a default credential resolver.
This creates a pre-configured credential resolver
that includes the default lookup chain for
credentials.
�profile�defaultZmetadata_service_timeoutZ metadata_service_num_attemptsN� ec2_metadata_service_endpoint�ec2_metadata_v1_disabled)r) Z"ec2_metadata_service_endpoint_modeZ ec2_credential_refresh_windowr* )�timeout� num_attempts�
user_agent�config)�iam_role_fetcher)�cache� region_namec s � j S r$ )� full_config� ��sessionr3 �A/opt/cppython/lib/python3.8/site-packages/botocore/credentials.py�<lambda>p � z,create_credential_resolver.<locals>.<lambda>)� load_config�client_creatorr0 � profile_name�credential_sourcer�profile_provider_builder�r; �disable_env_varszWSkipping environment variable credential check because profile name was explicitly set.�� providers)�get_config_variableZinstance_variables�getr �!_DEFAULT_ADVISORY_REFRESH_TIMEOUT� EnvProvider�ContainerProvider�InstanceMetadataProviderr r- �ProfileProviderBuilder�AssumeRoleProvider�_get_client_creator� CanonicalNameCredentialSourcerrA �OriginalEC2Provider� BotoProvider�remove�logger�debug�CredentialResolver)r5 r0 r1 r; Zmetadata_timeoutr, r? Z imds_configZ env_providerZcontainer_providerZinstance_metadata_providerr= �assume_role_providerZ pre_profile�profile_providersZ post_profilerA �resolverr3 r4 r6 �create_credential_resolverD s|
����
�� �
�� ���
�
rU c @ sL e Zd ZdZddd�Zddd�Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dS )rH a� This class handles the creation of profile based providers.
NOTE: This class is only intended for internal use.
This class handles the creation and ordering of the various credential
providers that primarly source their configuration from the shared config.
This is needed to enable sharing between the default credential chain and
the source profile chain created by the assume role provider.
Nc C s || _ || _|| _|| _d S r$ )�_session�_cache� _region_name�_sso_token_cache)�selfr5 r0 r1 Zsso_token_cacher3 r3 r6 �__init__� s z ProfileProviderBuilder.__init__Fc C s. | � ||�| �|�| �|�| �|�| �|�gS r$ )� _create_web_identity_provider�_create_sso_provider�"_create_shared_credential_provider�_create_process_provider�_create_config_provider�rZ r; r? r3 r3 r6 rA � s ��z ProfileProviderBuilder.providersc s t |� fdd�d�S )Nc s � j jS r$ �rV r2 r3 �rZ r3 r6 r7 � r8 zAProfileProviderBuilder._create_process_provider.<locals>.<lambda>)r; r9 )�ProcessProvider�rZ r; r3 rc r6 r_ � s
�z/ProfileProviderBuilder._create_process_providerc C s | j �d�}t||d�S )NZcredentials_file)r; �creds_filename)rV rB �SharedCredentialProvider)rZ r; Zcredential_filer3 r3 r6 r^ � s
�z9ProfileProviderBuilder._create_shared_credential_providerc C s | j �d�}t||d�S )N� config_file)r; �config_filename)rV rB �ConfigProvider)rZ r; rh r3 r3 r6 r` � s
�z.ProfileProviderBuilder._create_config_providerc s& t � fdd�t� j� j�� j||d�S )Nc s � j jS r$ rb r3 rc r3 r6 r7 � r8 zFProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>)r9 r: r0 r; r? )�!AssumeRoleWithWebIdentityProviderrJ rV rX rW ra r3 rc r6 r\ � s
��z4ProfileProviderBuilder._create_web_identity_providerc s2 t � fdd�� jj|� j� jt� j� j|d�d�S )Nc s � j jS r$ rb r3 rc r3 r6 r7 � r8 z=ProfileProviderBuilder._create_sso_provider.<locals>.<lambda>)r0 r; )r9 r: r; r0 � token_cache�token_provider)� SSOProviderrV �
create_clientrW rY r re r3 rc r6 r] � s
��z+ProfileProviderBuilder._create_sso_provider)NNN)F) �__name__�
__module__� __qualname__�__doc__r[ rA r_ r^ r` r\ r] r3 r3 r3 r6 rH � s �
rH c C s t | �}|�� S r$ )rU �load_credentials)r5 rT r3 r3 r6 �get_credentials� s ru c C s t j �t� �S r$ )�datetime�nowr r3 r3 r3 r6 �
_local_now� s rx c C s t | tj�r| S t| �S r$ )�
isinstancerv r )�valuer3 r3 r6 �_parse_if_needed� s r{ Fc C s& t | tj�r"|r| �� S | �d�S | S )Nz%Y-%m-%dT%H:%M:%S%Z)ry rv � isoformat�strftime)rz �isor3 r3 r6 �_serialize_if_needed s
r c s � �fdd�}|S )Nc s" d� i}|j f |� �j| f|�S )Nr1 )�updatero )� service_name�kwargsZcreate_client_kwargs�r1 r5 r3 r6 r: s z+_get_client_creator.<locals>.client_creatorr3 )r5 r1 r: r3 r� r6 rJ s rJ c s � �fdd�}|S )Nc s6 � j f ��} | d }|d |d |d t|d �d�S )N� Credentials� AccessKeyId�SecretAccessKey� SessionToken�
Expiration)r r! r" � expiry_time)� assume_roler )�response� credentials��client�paramsr3 r6 �refresh s
�z-create_assume_role_refresher.<locals>.refreshr3 )r� r� r� r3 r� r6 � create_assume_role_refresher s r� c C s G dd� d�}|| �S )Nc @ s e Zd Zdd� Zdd� ZdS )z/create_mfa_serial_refresher.<locals>._Refresherc S s || _ d| _d S )NF)�_refresh�_has_been_called)rZ r� r3 r3 r6 r[ # s z8create_mfa_serial_refresher.<locals>._Refresher.__init__c S s | j r t� �d| _ | �� S �NT)r� r r� rc r3 r3 r6 �__call__' s z8create_mfa_serial_refresher.<locals>._Refresher.__call__N)rp rq rr r[ r� r3 r3 r3 r6 �
_Refresher" s r� r3 )Zactual_refreshr� r3 r3 r6 �create_mfa_serial_refresher! s r� c @ s2 e Zd ZdZd dd�Zdd� Zdd� Zd d
� ZdS ) r� a�
Holds the credentials needed to authenticate requests.
:param str access_key: The access key part of the credentials.
:param str secret_key: The secret key part of the credentials.
:param str token: The security token, valid only for session credentials.
:param str method: A string which identifies where the credentials
were found.
:param str account_id: (optional) An account ID associated with the credentials.
Nc C s6 || _ || _|| _|d kr d}|| _|| _| �� d S )N�explicit)r r! r" �methodr# �
_normalize)rZ r r! r" r� r# r3 r3 r6 r[ ? s zCredentials.__init__c C s$ t j�| j�| _t j�| j�| _d S r$ )�botocore�compat�ensure_unicoder r! rc r3 r3 r6 r� M s zCredentials._normalizec C s t | j| j| j| j�S r$ )r r r! r" r# rc r3 r3 r6 �get_frozen_credentialsW s �z"Credentials.get_frozen_credentialsc s � �fdd�}|S )Nc s t �� d �S r$ )�getattrr3 ��
property_namerZ r3 r6 � get_property] s z7Credentials.get_deferred_property.<locals>.get_propertyr3 )rZ r� r� r3 r� r6 �get_deferred_property\ s z!Credentials.get_deferred_property)NNN)rp rq rr rs r[ r� r� r� r3 r3 r3 r6 r� 3 s �
r� c @ s� e Zd ZdZeZeZedddfdd�Z dd� Z
e d%dd��Z e
d d
� �Zejd d
� �Ze
d d
� �Zejdd
� �Ze
dd� �Zejdd� �Ze
dd� �Zejdd� �Zdd� Zd&dd�Zdd� Zdd � Zd d � Zed d � �Zd!d"� Zd#d$� ZdS )'�RefreshableCredentialsa�
Holds the credentials needed to authenticate requests. In addition, it
knows how to refresh itself.
:param str access_key: The access key part of the credentials.
:param str secret_key: The secret key part of the credentials.
:param str token: The security token, valid only for session credentials.
:param datetime expiry_time: The expiration time of the credentials.
:param function refresh_using: Callback function to refresh the credentials.
:param str method: A string which identifies where the credentials
were found.
:param function time_fetcher: Callback function to retrieve current time.
Nc C sr || _ || _|| _|| _|
| _|| _|| _t�� | _ || _
t ||||
�| _ | �
� |d k r`|| _| d k rn| | _d S r$ )�_refresh_using� _access_key� _secret_key�_token� _account_id� _expiry_time�
_time_fetcher� threading�Lock�
_refresh_lockr� r �_frozen_credentialsr� �_advisory_refresh_timeout�_mandatory_refresh_timeout) rZ r r! r" r� �
refresh_usingr� � time_fetcher�advisory_timeout�mandatory_timeoutr# r3 r3 r6 r[ y s(
�z RefreshableCredentials.__init__c C s$ t j�| j�| _t j�| j�| _d S r$ )r� r� r� r� r� rc r3 r3 r6 r� � s z!RefreshableCredentials._normalizec C sb i }|d k r||d< |d k r$||d< | f |d |d |d | � |d �|||�d�d�|��}|S ) Nr� r� r r! r" r� r# )r r! r" r� r� r� r# )�_expiry_datetimerC )�cls�metadatar� r� r� r� r� �instancer3 r3 r6 �create_from_metadata� s" ��
z+RefreshableCredentials.create_from_metadatac C s | � � | jS �z�Warning: Using this property can lead to race conditions if you
access another property subsequently along the refresh boundary.
Please use get_frozen_credentials instead.
)r� r� rc r3 r3 r6 r � s z!RefreshableCredentials.access_keyc C s
|| _ d S r$ )r� �rZ rz r3 r3 r6 r � s c C s | � � | jS r� )r� r� rc r3 r3 r6 r! � s z!RefreshableCredentials.secret_keyc C s
|| _ d S r$ )r� r� r3 r3 r6 r! � s c C s | � � | jS r� )r� r� rc r3 r3 r6 r" � s z RefreshableCredentials.tokenc C s
|| _ d S r$ )r� r� r3 r3 r6 r" � s c C s | � � | jS r� )r� r� rc r3 r3 r6 r# � s z!RefreshableCredentials.account_idc C s
|| _ d S r$ )r� r� r3 r3 r6 r# � s c C s | j | �� }t|�S r$ )r� r� r )rZ �deltar3 r3 r6 �_seconds_remaining� s z)RefreshableCredentials._seconds_remainingc C s: | j dkrdS |dkr | j}| �� |kr,dS t�d� dS )a� Check if a refresh is needed.
A refresh is needed if the expiry time associated
with the temporary credentials is less than the
provided ``refresh_in``. If ``time_delta`` is not
provided, ``self.advisory_refresh_needed`` will be used.
For example, if your temporary credentials expire
in 10 minutes and the provided ``refresh_in`` is
``15 * 60``, then this function will return ``True``.
:type refresh_in: int
:param refresh_in: The number of seconds before the
credentials expire in which refresh attempts should
be made.
:return: True if refresh needed, False otherwise.
NFz!Credentials need to be refreshed.T)r� r� r� rO rP �rZ �
refresh_inr3 r3 r6 �refresh_needed� s
z%RefreshableCredentials.refresh_neededc C s | j dd�S )Nr )r� )r� rc r3 r3 r6 � _is_expired s z"RefreshableCredentials._is_expiredc C s� | � | j�sd S | j�d�r`z4| � | j�s2W �$d S | � | j�}| j|d� W �d S | j�� X nD| � | j�r�| j�, | � | j�s�W 5 Q R � d S | jdd� W 5 Q R X d S )NF)� is_mandatoryT)r� r� r� �acquire�releaser� �_protected_refresh)rZ Zis_mandatory_refreshr3 r3 r6 r� s" � z RefreshableCredentials._refreshc C s� z | � � }W n8 tk
rD |r$dnd}tjd|dd� |r>� Y d S X | �|� t| j| j| j| j �| _
| � � r�d}t�|� t |��d S )N� mandatoryZadvisoryzARefreshing temporary credentials failed during %s refresh period.T��exc_infozLCredentials were refreshed, but the refreshed credentials are still expired.)
r� � ExceptionrO �warning�_set_from_datar r� r� r� r� r� r� � RuntimeError)rZ r� r� Z period_name�msgr3 r3 r6 r� 3 s0 �
��
z)RefreshableCredentials._protected_refreshc C s t | �S r$ r )Ztime_strr3 r3 r6 r� Z s z'RefreshableCredentials._expiry_datetimec s� ddddg}� s|}n� fdd�|D �}|rHd}t | j|d�|� d ��� d | _� d | _� d | _t� d �| _� �d
�| _ t
� d | j� | � � d S ) Nr r! r" r� c s g | ]}|� kr|�qS r3 r3 )�.0�k��datar3 r6 �
<listcomp>c s z9RefreshableCredentials._set_from_data.<locals>.<listcomp>z7Credential refresh failed, response did not contain: %s�, ��provider� error_msgr# z(Retrieved credentials will expire at: %s)
r r� �joinr r! r" r r� rC r# rO rP r� )rZ r� Z
expected_keysZ missing_keys�messager3 r� r6 r� ^ s( �
�z%RefreshableCredentials._set_from_datac C s | � � | jS )a� Return immutable credentials.
The ``access_key``, ``secret_key``, and ``token`` properties
on this class will always check and refresh credentials if
needed before returning the particular credentials.
This has an edge case where you can get inconsistent
credentials. Imagine this:
# Current creds are "t1"
tmp.access_key ---> expired? no, so return t1.access_key
# ---- time is now expired, creds need refreshing to "t2" ----
tmp.secret_key ---> expired? yes, refresh and return t2.secret_key
This means we're using the access key from t1 with the secret key
from t2. To fix this issue, you can request a frozen credential object
which is guaranteed not to change.
The frozen credentials returned from this method should be used
immediately and then discarded. The typical usage pattern would
be::
creds = RefreshableCredentials(...)
some_code = SomeSignerObject()
# I'm about to sign the request.
# The frozen credentials are only used for the
# duration of generate_presigned_url and will be
# immediately thrown away.
request = some_code.sign_some_request(
with_credentials=creds.get_frozen_credentials())
print("Signed request:", request)
)r� r� rc r3 r3 r6 r� v s "z-RefreshableCredentials.get_frozen_credentials)NN)N) rp rq rr rs rD r� �"_DEFAULT_MANDATORY_REFRESH_TIMEOUTr� rx r[ r� � classmethodr� �propertyr �setterr! r" r# r� r� r� r� r� � staticmethodr� r� r� r3 r3 r3 r6 r� c sL
�
�
" '
r� c s. e Zd ZdZefdd�Zd� fdd� Z� ZS )� DeferredRefreshableCredentialszyRefreshable credentials that don't require initial credentials.
refresh_using will be called upon first access.
c C sD || _ d | _d | _d | _d | _d | _|| _t�� | _ || _
d | _ d S r$ ) r� r� r� r� r� r� r� r� r� r� r� r� )rZ r� r� r� r3 r3 r6 r[ � s
z'DeferredRefreshableCredentials.__init__Nc s | j d krdS t� �|�S r� )r� �superr� r� �� __class__r3 r6 r� � s
z-DeferredRefreshableCredentials.refresh_needed)N)rp rq rr rs rx r[ r� �
__classcell__r3 r3 r� r6 r� � s r� c @ sZ e Zd ZdZddd�Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dS )�CachedCredentialFetcherr& Nc C s4 |d kr i }|| _ | �� | _|d kr*| j}|| _d S r$ )rW �_create_cache_key�
_cache_key� DEFAULT_EXPIRY_WINDOW_SECONDS�_expiry_window_seconds)rZ r0 �expiry_window_secondsr3 r3 r6 r[ � s
z CachedCredentialFetcher.__init__c C s t d��d S )Nz_create_cache_key()��NotImplementedErrorrc r3 r3 r6 r� � s z)CachedCredentialFetcher._create_cache_keyc C s" |� dd�� tjd�}|� dd�S )N�:�_�/)�replace�os�sep)rZ �filenamer3 r3 r6 �_make_file_safe� s z'CachedCredentialFetcher._make_file_safec C s t d��d S )Nz_get_credentials()r� rc r3 r3 r6 �_get_credentials� s z(CachedCredentialFetcher._get_credentialsc C s | � � S r$ )�_get_cached_credentialsrc r3 r3 r6 �fetch_credentials� s z)CachedCredentialFetcher.fetch_credentialsc C sl | � � }|dkr$| �� }| �|� n
t�d� |d }t|d dd�}|d |d |d ||�d
�d �}|S ) z�Get up-to-date credentials.
This will check the cache for up-to-date credentials, calling assume
role if none are available.
Nz*Credentials for role retrieved from cache.r� r� T)r~ r� r� r� � AccountId�r r! r" r� r# )�_load_from_cacher� �_write_to_cacherO rP r rC )rZ r� �creds�
expirationr� r3 r3 r6 r� � s
�z/CachedCredentialFetcher._get_cached_credentialsc C s8 | j | jkr4t| j| j �}| �|�s*|S t�d� d S )Nz6Credentials were found in cache, but they are expired.)r� rW r r� rO rP )rZ r� r3 r3 r6 r� � s
�z(CachedCredentialFetcher._load_from_cachec C s t |�| j| j< d S r$ )r rW r� )rZ r� r3 r3 r6 r� � s z'CachedCredentialFetcher._write_to_cachec C s( t |d d �}t|t� �}|| jk S )z!Check if credentials are expired.r� r� )r{ r rx r� )rZ r� Zend_time�secondsr3 r3 r6 r� � s z#CachedCredentialFetcher._is_expired)NN)
rp rq rr r� r[ r� r� r� r� r� r� r� r� r3 r3 r3 r6 r� � s
r� c s6 e Zd Zd
� fdd� Zdd� Zdd� Zdd � Z� ZS ) � BaseAssumeRoleCredentialFetcherNc sf || _ || _|d kr i | _n
t|�| _| j| jd< | j�d�| _d| _| jsT| �� t� � ||� d S )NZRoleArn�RoleSessionNameF)
�_client_creatorZ _role_arn�_assume_kwargsr rC �_role_session_name�_using_default_session_name�_generate_assume_role_namer� r[ )rZ r: �role_arn�
extra_argsr0 r� r� r3 r6 r[ � s
z(BaseAssumeRoleCredentialFetcher.__init__c C s* dt t�� �� �| _| j| jd< d| _d S )Nzbotocore-session-r� T)�int�timer r r rc r3 r3 r6 r s z:BaseAssumeRoleCredentialFetcher._generate_assume_role_namec C sZ t | j�}| jr|d= d|kr0t�|d �|d< tj|dd�}t|�d���� }| � |�S )��Create a predictable cache key for the current configuration.
The cache key is intended to be compatible with file names.
r� �PolicyT)� sort_keys�utf-8)
r r r �json�loads�dumpsr �encode� hexdigestr� �rZ �argsZ
argument_hashr3 r3 r6 r� s
z1BaseAssumeRoleCredentialFetcher._create_cache_keyc C sR |� di �� d�}t�|�r>t� }|�|�d }||d d< nt�d|� �� d S )NZAssumedRoleUserZArn�accountr� r� z'Unable to extract account ID from Arn: )rC r Zis_arnZ parse_arnrO rP )rZ r� r Z
arn_parserr# r3 r3 r6 �_add_account_id_to_response0 s
z;BaseAssumeRoleCredentialFetcher._add_account_id_to_response)NNN)rp rq rr r[ r r� r r� r3 r3 r� r6 r� � s �r� c s6 e Zd Zd
� fdd� Zdd� Zdd� Zdd � Z� ZS ) �AssumeRoleCredentialFetcherNc s8 || _ || _| jdkr tj| _t� j|||||d� dS )a�
:type client_creator: callable
:param client_creator: A callable that creates a client taking
arguments like ``Session.create_client``.
:type source_credentials: Credentials
:param source_credentials: The credentials to use to create the
client for the call to AssumeRole.
:type role_arn: str
:param role_arn: The ARN of the role to be assumed.
:type extra_args: dict
:param extra_args: Any additional arguments to add to the assume
role request using the format of the botocore operation.
Possible keys include, but may not be limited to,
DurationSeconds, Policy, SerialNumber, ExternalId and
RoleSessionName.
:type mfa_prompter: callable
:param mfa_prompter: A callable that returns input provided by the
user (i.e raw_input, getpass.getpass, etc.).
:type cache: dict
:param cache: An object that supports ``__getitem__``,
``__setitem__``, and ``__contains__``. An example of this is
the ``JSONFileCache`` class in aws-cli.
:type expiry_window_seconds: int
:param expiry_window_seconds: The amount of time, in seconds,
N�r r0 r� )�_source_credentials�
_mfa_prompter�getpassr� r[ )rZ r: �source_credentialsr r � mfa_prompterr0 r� r� r3 r6 r[ ; s )
�z$AssumeRoleCredentialFetcher.__init__c C s* | � � }| �� }|jf |�}| �|� |S )�'Get credentials by calling assume role.)�_assume_role_kwargs�_create_clientr� r )rZ r� r� r� r3 r3 r6 r� q s
z,AssumeRoleCredentialFetcher._get_credentialsc C sX t | j�}|�d�}|dk r:d|� d�}| �|�}||d< |�d�}|dk rT||d< |S )�AGet the arguments for assume role based on current configuration.� SerialNumberNzEnter MFA code for z: Z TokenCode�DurationSeconds)r r rC r )rZ �assume_role_kwargs�
mfa_serial�promptZ
token_code�duration_secondsr3 r3 r6 r y s
z/AssumeRoleCredentialFetcher._assume_role_kwargsc C s" | j �� }| jd|j|j|jd�S )z2Create an STS client using the source credentials.�sts)�aws_access_key_id�aws_secret_access_key�aws_session_token)r r� r r r! r" )rZ Zfrozen_credentialsr3 r3 r6 r � s
�z*AssumeRoleCredentialFetcher._create_client)NNNN)rp rq rr r[ r� r r r� r3 r3 r� r6 r : s �6r c s. e Zd Zd� fdd� Zdd� Zdd� Z� ZS ) �*AssumeRoleWithWebIdentityCredentialFetcherNc s || _ t� j|||||d� dS )aG
:type client_creator: callable
:param client_creator: A callable that creates a client taking
arguments like ``Session.create_client``.
:type web_identity_token_loader: callable
:param web_identity_token_loader: A callable that takes no arguments
and returns a web identity token str.
:type role_arn: str
:param role_arn: The ARN of the role to be assumed.
:type extra_args: dict
:param extra_args: Any additional arguments to add to the assume
role request using the format of the botocore operation.
Possible keys include, but may not be limited to,
DurationSeconds, Policy, SerialNumber, ExternalId and
RoleSessionName.
:type cache: dict
:param cache: An object that supports ``__getitem__``,
``__setitem__``, and ``__contains__``. An example of this is
the ``JSONFileCache`` class in aws-cli.
:type expiry_window_seconds: int
:param expiry_window_seconds: The amount of time, in seconds,
r N)�_web_identity_token_loaderr� r[ )rZ r: �web_identity_token_loaderr r r0 r� r� r3 r6 r[ � s $�z3AssumeRoleWithWebIdentityCredentialFetcher.__init__c C s: | � � }ttd�}| jd|d�}|jf |�}| �|� |S )r )�signature_versionr' �r. )r r r r Z assume_role_with_web_identityr )rZ r� r. r� r� r3 r3 r6 r� � s
z;AssumeRoleWithWebIdentityCredentialFetcher._get_credentialsc C s t | j�}| �� }||d< |S )r ZWebIdentityToken)r r r, )rZ r# Zidentity_tokenr3 r3 r6 r � s
z>AssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargs)NNN)rp rq rr r[ r� r r� r3 r3 r� r6 r+ � s �. r+ c @ s. e Zd ZdZdZddd�Zdd� Zdd� ZdS ) �CredentialProviderNc C s
|| _ d S r$ r4 )rZ r5 r3 r3 r6 r[ � s zCredentialProvider.__init__c C s dS )a~
Loads the credentials from their source & sets them on the object.
Subclasses should implement this method (by reading from disk, the
environment, the network or wherever), returning ``True`` if they were
found & loaded.
If not found, this method should return ``False``, indictating that the
``CredentialResolver`` should fall back to the next available method.
The default implementation does nothing, assuming the user has set the
``access_key/secret_key/token`` themselves.
:returns: Whether credentials were found & set
:rtype: Credentials
Tr3 rc r3 r3 r6 �load� s zCredentialProvider.loadc G sH g }|D ]:}z|� || � W q tk
r@ t| j|d��Y qX q|S )N�r� Zcred_var)�append�KeyErrorr �METHOD)rZ �mappingZ key_names�foundZkey_namer3 r3 r6 �_extract_creds_from_mapping� s �z.CredentialProvider._extract_creds_from_mapping)N)rp rq rr r5 �CANONICAL_NAMEr[ r1 r8 r3 r3 r3 r6 r0 � s
r0 c @ sN e Zd ZdZejfdd�Zdd� Zdd� Ze dd � �Z
e d
d � �Z d d
� Z dS )rd zcustom-processc C s || _ || _d | _|| _d S r$ )�
_profile_name� _load_config�_loaded_config�_popen)rZ r; r9 �popenr3 r3 r6 r[ s zProcessProvider.__init__c sl �j � � d krd S ��� �}|�d�d k rDt�|� �fdd��j�S t|d |d |�d��j|�d�d�S ) Nr� c s
�� � �S r$ )�_retrieve_credentials_usingr3 ��credential_processrZ r3 r6 r7 r8 z&ProcessProvider.load.<locals>.<lambda>r r! r" r# )r r! r" r� r# )�_credential_processr? rC r� r� r5 r� )rZ Z
creds_dictr3 r@ r6 r1 s"
��zProcessProvider.loadc
C s� t |�}| j|tjtjd�}|�� \}}|jdkrFt| j|�d�d��t j
j � |�d��}|�
dd�}|dkr�t| jd|� d �d��z,|d
|d |�
d �|�
d
�| �|�d�W S tk
r� } zt| jd|� �d��W 5 d }~X Y nX d S )N)�stdout�stderrr r r� �Versionz<Version key not provided>� zUnsupported version 'z8' for credential process provider, supported versions: 1r� r� r� r� r� z"Missing required key in response: )r
r= �
subprocess�PIPE� communicate�
returncoder r5 �decoder� r� r
r rC �_get_account_idr4 ) rZ rA Z process_list�prC rD �parsed�version�er3 r3 r6 r? ' s> �
�
���z+ProcessProvider._retrieve_credentials_usingc C s | j �d�S )NrA )�profile_configrC rc r3 r3 r6 rB K s z#ProcessProvider._credential_processc C s0 | j d kr| �� | _ | j �di ��| ji �}|S �N�profiles)r< r; rC r: )rZ rQ r3 r3 r6 rQ O s
�z ProcessProvider.profile_configc C s |� d�}|p| j� d�S )Nr� �aws_account_id)rC rQ )rZ rN r# r3 r3 r6 rL X s
z ProcessProvider._get_account_idN)
rp rq rr r5 rG �Popenr[ r1 r? r� rB rQ rL r3 r3 r3 r6 rd s $
rd c @ s$ e Zd ZdZdZdd� Zdd� ZdS )rG ziam-roleZEc2InstanceMetadatac C s
|| _ d S r$ )�
_role_fetcher)rZ r/ r3 r3 r6 r[ a s z!InstanceMetadataProvider.__init__c C s> | j }|�� }|sd S t�d|d � tj|| j|jd�}|S )Nz#Found credentials from IAM Role: %s� role_name�r� r� )rV Z retrieve_iam_role_credentialsrO �infor� r� r5 )rZ �fetcherr� r� r3 r3 r6 r1 d s ��z InstanceMetadataProvider.loadN)rp rq rr r5 r9 r[ r1 r3 r3 r3 r6 rG ] s rG c @ sN e Zd ZdZdZdZdZddgZdZdZ dd
d �Z
d d
� Z dd� Z dd� Z
d S )rE �env� EnvironmentZAWS_ACCESS_KEY_IDZAWS_SECRET_ACCESS_KEYZAWS_SECURITY_TOKENZAWS_SESSION_TOKENZAWS_CREDENTIAL_EXPIRATIONZAWS_ACCOUNT_IDNc C s$ |dkrt j}|| _| �|�| _dS )a�
:param environ: The environment variables (defaults to
``os.environ`` if no value is provided).
:param mapping: An optional mapping of variable names to
environment variable names. Use this if you want to
change the mapping of access_key->AWS_ACCESS_KEY_ID, etc.
The dict can have up to 5 keys:
* ``access_key``
* ``secret_key``
* ``token``
* ``expiry_time``
* ``account_id``
N)r� �environ�_build_mapping�_mapping)rZ r] r6 r3 r3 r6 r[ � s zEnvProvider.__init__c C s� i }|d kr@| j |d< | j|d< | j|d< | j|d< | j|d< nv|�d| j �|d< |�d| j�|d< |�d| j�|d< t|d t�s�|d g|d< |�d| j�|d< |�d| j�|d< |S )Nr r! r" r� r# )�
ACCESS_KEY�
SECRET_KEY�TOKENS� EXPIRY_TIME�
ACCOUNT_IDrC ry �list)rZ r6 Z var_mappingr3 r3 r6 r^ � s6
� � � �zEnvProvider._build_mappingc C s� | j �| jd d�}|r�t�d� | �� }|dd�}|d }|dk rtt|�}t|d |d |d ||| j|d
d �S t |d |d |d | j|d
d �S dS dS )
zK
Search for credentials in explicit environment variables.
r � z+Found credentials in environment variables.F)�require_expiryr� Nr! r" r# )r� r� r# �r� r# )
r] rC r_ rO rY �_create_credentials_fetcherr r� r5 r� )rZ r rZ r� r� r3 r3 r6 r1 � s2
�
�zEnvProvider.loadc s( | j �| j�| j� d� ��fdd� }|S )NTc s� i }� � �d d�}|s(t��d d��||d< � � �d d�}|sTt��d d��||d< d |d< �d D ] }� � |d�}|rl||d< q�qld |d< � � �d d�}|r�||d< | r�|s�t��d d��d |d< � � �d d�}|r�||d< |S )Nr rf r2 r! r" r� r# )rC r )rg r� r r! Z
token_env_varr" r� r# �r] r6 r� r3 r6 r� � sF � � �zBEnvProvider._create_credentials_fetcher.<locals>.fetch_credentials)T)r_ r5 r] )rZ r� r3 rj r6 ri � s
(z'EnvProvider._create_credentials_fetcher)NN)rp rq rr r5 r9 r` ra rb rc rd r[ r^ r1 ri r3 r3 r3 r6 rE z s
#rE c @ s2 e Zd ZdZdZdZdZdZd dd�Zd d
� Z dS ) rL zec2-credentials-fileZ Ec2Config�AWS_CREDENTIAL_FILEZAWSAccessKeyIdZ AWSSecretKeyNc C s* |d krt j}|d krt}|| _|| _d S r$ )r� r] r �_environ�_parser)rZ r] �parserr3 r3 r6 r[ s z OriginalEC2Provider.__init__c C sh d| j kr`tj�| j d �}| �|�}| j|krdt�d� || j }|| j }t ||| j
d�S ndS dS )zN
Search for a credential file used by original EC2 CLI tools.
rk z)Found credentials in AWS_CREDENTIAL_FILE.�r� N) rl r� �path�
expanduserrm r` rO rY ra r� r5 )rZ � full_pathr� r r! r3 r3 r6 r1 s
�
zOriginalEC2Provider.load)NN)
rp rq rr r5 r9 Z
CRED_FILE_ENVr` ra r[ r1 r3 r3 r3 r6 rL s
rL c @ sJ e Zd ZdZdZdZdZddgZdZdd d
�Z d d � Z
d
d� Z dd� Z dS )rg zshared-credentials-fileZSharedCredentialsr( r) �aws_security_tokenr* rT Nc C s2 || _ |d krd}|| _|d kr(tjj}|| _d S )Nr( )�_creds_filenamer: r� � configloader�raw_config_parse� _ini_parser)rZ rf r; �
ini_parserr3 r3 r6 r[ 7 s z!SharedCredentialProvider.__init__c C s� z| � | j�}W n tk
r& Y d S X | j|kr�|| j }| j|kr�t�d| j� | �|| j| j�\}}| � |�}| �
|�}t |||| j |d�S d S )Nz0Found credentials in shared credentials file: %srh )
rw rt r
r: r` rO rY r8 ra �_get_session_tokenrL r� r5 )rZ Zavailable_credsr. r r! r" r# r3 r3 r6 r1 @ s2
� �
�z SharedCredentialProvider.loadc C s$ | j D ]}||kr|| S qd S r$ �rb )rZ r. Z token_envvarr3 r3 r6 ry Y s
z+SharedCredentialProvider._get_session_tokenc C s |� | j�S r$ �rC rd �rZ r. r3 r3 r6 rL ^ s z(SharedCredentialProvider._get_account_id)NN)
rp rq rr r5 r9 r` ra rb rd r[ r1 ry rL r3 r3 r3 r6 rg + s
rg c @ sN e Zd ZdZdZdZdZdZddgZdZ dd
d �Z
d d
� Z dd� Z dd� Z
d S )rj z0INI based config provider with profile sections.z config-fileZ SharedConfigr( r) rs r* rT Nc C s& || _ || _|dkr tjj}|| _dS )a
:param config_filename: The session configuration scoped to the current
profile. This is available via ``session.config``.
:param profile_name: The name of the current profile.
:param config_parser: A config parser callable.
N)�_config_filenamer: r� ru r9 �_config_parser)rZ ri r; Z
config_parserr3 r3 r6 r[ p s
zConfigProvider.__init__c C s� z| � | j�}W n tk
r& Y dS X | j|d kr�|d | j }| j|kr�t�d| j� | �|| j| j�\}}| � |�}| �
|�}t |||| j |d�S ndS dS )zr
If there is are credentials in the configuration associated with
the session, use those.
NrS z$Credentials found in config file: %srh )
r~ r} r
r: r` rO rY r8 ra ry rL r� r5 )rZ r2 rQ r r! r" r# r3 r3 r6 r1 s4
� �
�zConfigProvider.loadc C s$ | j D ]}||kr|| S qd S r$ rz )rZ rQ Z
token_namer3 r3 r6 ry � s
z!ConfigProvider._get_session_tokenc C s |� | j�S r$ r{ r| r3 r3 r6 rL � s z ConfigProvider._get_account_id)N)rp rq rr rs r5 r9 r` ra rb rd r[ r1 ry rL r3 r3 r3 r6 rj b s
rj c @ s: e Zd ZdZdZdZddgZdZdZd
d d
�Z d d � Z
dS )rM z boto-configZ Boto2ConfigZ BOTO_CONFIGz
/etc/boto.cfgz~/.botor( r) Nc C s. |d krt j}|d kr tjj}|| _|| _d S r$ )r� r] r� ru rv rl rw )rZ r] rx r3 r3 r6 r[ � s zBotoProvider.__init__c C s� | j | jkr | j| j g}n| j}|D ]|}z| �|�}W n tk
rP Y q&Y nX d|kr&|d }| j|kr&t�d|� | �|| j| j �\}}t
||| j d� S q&dS )z;
Look for credentials in boto config file.
r� z)Found credentials in boto config file: %sro N) �BOTO_CONFIG_ENVrl �DEFAULT_CONFIG_FILENAMESrw r
r` rO rY r8 ra r� r5 )rZ Zpotential_locationsr� r. r� r r! r3 r3 r6 r1 � s2
� � �zBotoProvider.load)NN) rp rq rr r5 r9 r r� r` ra r[ r1 r3 r3 r3 r6 rM � s
rM c @ s� e Zd ZdZdZdZdZdZejddfdd�Z dd � Z
d
d � Z d d
� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � ZdS ) rI � assume-roleNr �web_identity_token_filer& c C s> || _ || _|| _|| _|| _i | _|| _|| _| jg| _dS )a�
:type load_config: callable
:param load_config: A function that accepts no arguments, and
when called, will return the full configuration dictionary
for the session (``session.full_config``).
:type client_creator: callable
:param client_creator: A factory function that will create
a client when called. Has the same interface as
``botocore.session.Session.create_client``.
:type cache: dict
:param cache: An object that supports ``__getitem__``,
``__setitem__``, and ``__contains__``. An example
of this is the ``JSONFileCache`` class in the CLI.
:type profile_name: str
:param profile_name: The name of the profile.
:type prompter: callable
:param prompter: A callable that returns input provided
by the user (i.e raw_input, getpass.getpass, etc.).
:type credential_sourcer: CanonicalNameCredentialSourcer
:param credential_sourcer: A credential provider that takes a
configuration, which is used to provide the source credentials
for the STS call.
N) r0 r; r r: � _prompterr< �_credential_sourcer�_profile_provider_builder�_visited_profiles)rZ r9 r: r0 r; Zprompterr< r= r3 r3 r6 r[ � s +zAssumeRoleProvider.__init__c C s@ | � � | _| j�di �}|�| ji �}| �|�r<| �| j�S d S rR )r; r< rC r: � _has_assume_role_config_vars�_load_creds_via_assume_role)rZ rS r' r3 r3 r6 r1 ! s
zAssumeRoleProvider.loadc C s | j |ko| j|kS r$ )�ROLE_CONFIG_VAR�WEB_IDENTITY_TOKE_FILE_VAR�rZ r' r3 r3 r6 r� ( s
�z/AssumeRoleProvider._has_assume_role_config_varsc C s� | � |�}| �||�}i }|�d�}|d k r4||d< |�d�}|d k rN||d< |�d�}|d k rh||d< |�d�}|d k r�||d< t| j||d || j| jd
�} | j}
|d k r�t|
�}
t | j
|
t d �S ) N�role_session_namer� � external_idZ
ExternalIdr$ r! r& r" r )r: r r r r r0 )r� r� r� ) �_get_role_config�_resolve_source_credentialsrC r r r� r0 r� r� r� r5 rx ) rZ r; � role_configr r r� r� r$ r& rZ Z refresherr3 r3 r6 r� 3 sD
�
��z.AssumeRoleProvider._load_creds_via_assume_rolec C s | j �di �}|| }|�d�}|d }|�d�}|�d�}|�d�}|�d�} |�d�}
|||| ||d �} |
d
k r�zt|
�| d< W n tk
r� Y nX |d
k r�|d
k r�td |� d �d
��nB|d
kr�|d
kr�t| jdd��n"|d
k r�| �||� n | �||� | S )z?Retrieves and validates the role configuration for the profile.rS �source_profiler �credential_sourcer$ r� r� r& )r r� r$ r� r� r� N�
The profile "z5" contains both source_profile and credential_source.�r� z#source_profile or credential_sourcer2 ) r< rC r �
ValueErrorr r r5 �_validate_credential_source�_validate_source_profile) rZ r; rS r' r� r r� r$ r� r� r& r� r3 r3 r6 r� _ sD
�
�� z#AssumeRoleProvider._get_role_configc C sJ | j d kr"td|� d|� d�d��| j �|�sFtd|� d|� d�d��d S )NzThe credential_source "z" is specified in profile "z)", but no source provider was configured.r� zThe credential source "z" referenced in profile "z" is not valid.)r� r � is_supported)rZ Zparent_profiler� r3 r3 r6 r� � s
� �z.AssumeRoleProvider._validate_credential_sourcec C s t | �|�| �|�g�S r$ )�any�_has_static_credentialsr� r� r3 r3 r6 � _source_profile_has_credentials� s
��z2AssumeRoleProvider._source_profile_has_credentialsc C sv | j �di �}||kr.td|� d|� d�d��|| }|| jkrDd S ||krZt|| jd��| �|�srt|| jd��d S )NrS zThe source_profile "z " referenced in the profile "z" does not exist.r� )r� Zvisited_profiles)r< rC r r� r r� )rZ Zparent_profile_nameZsource_profile_namerS r� r3 r3 r6 r� � s$ �
�
�z+AssumeRoleProvider._validate_source_profilec s ddg}t � fdd�|D ��S )Nr) r( c 3 s | ]}|� kV qd S r$ r3 )r� Z
static_key�r' r3 r6 � <genexpr>� s z=AssumeRoleProvider._has_static_credentials.<locals>.<genexpr>)r� )rZ r' Z static_keysr3 r� r6 r� � s z*AssumeRoleProvider._has_static_credentialsc C s< |� d�}|d k r | �||�S |d }| j�|� | �|�S )Nr� r� )rC � _resolve_credentials_from_sourcer� r3 �!_resolve_credentials_from_profile)rZ r� r; r� r� r3 r3 r6 r� � s
� z.AssumeRoleProvider._resolve_source_credentialsc C s� | j �di �}|| }| �|�r0| js0| �|�S | �|�sD| �|�s�| jj|dd�}t|�}|�� }|d kr~d}t || d��|S | �
|�S )NrS Tr> z.The source profile "%s" must have credentials.r� ) r< rC r� r� �(_resolve_static_credentials_from_profiler� rA rQ rt r r� )rZ r; rS r' rS Z
profile_chainr� �
error_messager3 r3 r6 r� � s4 ��
�����z4AssumeRoleProvider._resolve_credentials_from_profilec
C sX z t |d |d |�d�d�W S tk
rR } zt| jt|�d��W 5 d }~X Y nX d S )Nr( r) r* )r r! r" r2 )r� rC r4 r r5 �str)rZ r' rP r3 r3 r6 r� � s � �z;AssumeRoleProvider._resolve_static_credentials_from_profilec C s* | j �|�}|d kr&t|d|� �d��|S )Nz@No credentials found in credential_source referenced in profile r� )r� r r )rZ r� r; r� r3 r3 r6 r� s ��z3AssumeRoleProvider._resolve_credentials_from_source)rp rq rr r5 r9 r� r� ZEXPIRY_WINDOW_SECONDSr r[ r1 r� r� r� r� r� r� r� r� r� r� r� r3 r3 r3 r6 rI � s* �
> ,1& ! rI c @ sR e Zd ZdZdZdddd�Zddd �Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dS )rk z assume-role-with-web-identityNZAWS_WEB_IDENTITY_TOKEN_FILEZAWS_ROLE_SESSION_NAMEZ AWS_ROLE_ARN)r� r� r Fc C s: || _ || _|| _|| _d | _|| _|d kr0t}|| _d S r$ )r0 r; r r: �_profile_config�_disable_env_varsr �_token_loader_cls)rZ r9 r: r; r0 r? Ztoken_loader_clsr3 r3 r6 r[ % s z*AssumeRoleWithWebIdentityProvider.__init__c C s | � � S r$ )� _assume_role_with_web_identityrc r3 r3 r6 r1 8 s z&AssumeRoleWithWebIdentityProvider.loadc C s: | j d kr.| �� }|�di �}|�| ji �| _ | j �|�S rR )r� r; rC r: )rZ �key�
loaded_configrS r3 r3 r6 �_get_profile_config; s
z5AssumeRoleWithWebIdentityProvider._get_profile_configc C s2 | j r
d S | j�|�}|r.|tjkr.tj| S d S r$ )r� �_CONFIG_TO_ENV_VARrC r� r] )rZ r� Zenv_keyr3 r3 r6 �_get_env_configB s
z1AssumeRoleWithWebIdentityProvider._get_env_configc C s | � |�}|d k r|S | �|�S r$ )r� r� )rZ r� Z env_valuer3 r3 r6 � _get_configJ s
z-AssumeRoleWithWebIdentityProvider._get_configc C s| | � d�}|sd S | �|�}| � d�}|s8d}t|d��i }| � d�}|d k rV||d< t| j|||| jd�}t| j|jd�S ) Nr� r z�The provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r� r� r� )r: r- r r r0 rX ) r� r� r r+ r r0 r� r5 r� )rZ Z
token_path� token_loaderr r� r r� rZ r3 r3 r6 r� P s0
�
�
�z@AssumeRoleWithWebIdentityProvider._assume_role_with_web_identity)NFN) rp rq rr r5 r9 r� r[ r1 r� r� r� r� r3 r3 r3 r6 rk s � �
rk c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
S )rK c C s
|| _ d S r$ ��
_providers�rZ rA r3 r3 r6 r[ v s z'CanonicalNameCredentialSourcer.__init__c C s |dd� | j D �kS )aL Validates a given source name.
:type source_name: str
:param source_name: The value of credential_source in the config
file. This is the canonical name of the credential provider.
:rtype: bool
:returns: True if the credential provider is supported,
False otherwise.
c S s g | ]
}|j �qS r3 )r9 �r� rM r3 r3 r6 r� � s z?CanonicalNameCredentialSourcer.is_supported.<locals>.<listcomp>r� )rZ � source_namer3 r3 r6 r� y s z+CanonicalNameCredentialSourcer.is_supportedc C s$ | � |�}t|t�r |�� S |�� S )a Loads source credentials based on the provided configuration.
:type source_name: str
:param source_name: The value of credential_source in the config
file. This is the canonical name of the credential provider.
:rtype: Credentials
)�
_get_providerry rQ rt r1 )rZ r� �sourcer3 r3 r6 r � s
z1CanonicalNameCredentialSourcer.source_credentialsc C sV | � |�}|�� dkr@| �d�}|dk r@|dkr4|S t||g�S |dkrRt|d��|S )a# Return a credential provider by its canonical name.
:type canonical_name: str
:param canonical_name: The canonical name of the provider.
:raises UnknownCredentialError: Raised if no
credential provider by the provided name
is found.
)Z sharedconfigZsharedcredentialsr� N��name)� _get_provider_by_canonical_name�lower�_get_provider_by_methodrQ r )rZ �canonical_namer� rR r3 r3 r6 r� � s
z,CanonicalNameCredentialSourcer._get_providerc C s2 | j D ]&}|j}|r|�� |�� kr| S qdS )z�Return a credential provider by its canonical name.
This function is strict, it does not attempt to address
compatibility issues.
N)r� r9 r� )rZ r� r� r� r3 r3 r6 r� � s
z>CanonicalNameCredentialSourcer._get_provider_by_canonical_namec C s" | j D ]}|j|kr| S qdS )z0Return a credential provider by its METHOD name.N)r� r5 )rZ r� r� r3 r3 r6 r� � s
z6CanonicalNameCredentialSourcer._get_provider_by_methodN) rp rq rr r[ r� r r� r� r� r3 r3 r3 r6 rK u s
& rK c @ s^ e Zd ZdZdZdZdZdZdZddd �Z d
d � Z
d d
� Z dd� Z dd� Z
dd� Zdd� ZdS )rF zcontainer-roleZ EcsContainerZ&AWS_CONTAINER_CREDENTIALS_RELATIVE_URIZ"AWS_CONTAINER_CREDENTIALS_FULL_URIZ!AWS_CONTAINER_AUTHORIZATION_TOKENZ&AWS_CONTAINER_AUTHORIZATION_TOKEN_FILENc C s, |d krt j}|d kr t� }|| _|| _d S r$ )r� r] r rl �_fetcher)rZ r] rZ r3 r3 r6 r[ � s zContainerProvider.__init__c C s$ | j | jks| j| jkr | �� S d S r$ )�ENV_VARrl � ENV_VAR_FULL�_retrieve_or_failrc r3 r3 r6 r1 � s zContainerProvider.loadc
C sl | � � r | j�| j| j �}n | j| j }| �|�}|� }t|d |d |d | jt |d �||�
d�d�S )Nr r! r" r� r# )r r! r" r� r� r� r# ) �_provided_relative_urir� �full_urlrl r� r� �_create_fetcherr� r5 r{ rC )rZ �full_urirZ r� r3 r3 r6 r� � s
�z#ContainerProvider._retrieve_or_failc C sp d }| j | jkr:| j| j }t|��}|�� }W 5 Q R X n| j| jkrR| j| j }|d k rl| �|� d|iS d S )N�
Authorization)�ENV_VAR_AUTH_TOKEN_FILErl �open�read�ENV_VAR_AUTH_TOKEN�_validate_auth_token)rZ �
auth_tokenZauth_token_file_pathZ
token_filer3 r3 r6 �_build_headers� s
z ContainerProvider._build_headersc C s d|ksd|krt d��d S )N�
�
z,Auth token value is not a legal header value)r� )rZ r� r3 r3 r6 r� s z&ContainerProvider._validate_auth_tokenc s � �fdd�}|S )Nc
s� z �� � } �jj� | d�}W nD tk
r` } z&tjd|dd� t�jt|�d��W 5 d }~X Y nX |d |d |d |d |� d
�d �S ) N)�headersz'Error retrieving container metadata: %sTr� r� r� r� �Tokenr� r� r� )
r� r� Zretrieve_full_urir rO rP r r5 r� rC )r� r� rP �r� rZ r3 r6 � fetch_creds s, �
� ��z6ContainerProvider._create_fetcher.<locals>.fetch_credsr3 )rZ r� r r� r� r3 r� r6 r� s z!ContainerProvider._create_fetcherc C s | j | jkS r$ )r� rl rc r3 r3 r6 r� s z(ContainerProvider._provided_relative_uri)NN)rp rq rr r5 r9 r� r� r� r� r[ r1 r� r� r� r� r� r3 r3 r3 r6 rF � s
rF c @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dS )rQ c C s
|| _ dS )zQ
:param providers: A list of ``CredentialProvider`` instances.
Nr@ r� r3 r3 r6 r[ ! s zCredentialResolver.__init__c C sL zdd� | j D ��|�}W n tk
r8 t|d��Y nX | j �||� dS )a=
Inserts a new instance of ``CredentialProvider`` into the chain that
will be tried before an existing one.
:param name: The short name of the credentials you'd like to insert the
new credentials before. (ex. ``env`` or ``config``). Existing names
& ordering can be discovered via ``self.available_methods``.
:type name: string
:param cred_instance: An instance of the new ``Credentials`` object
you'd like to add to the chain.
:type cred_instance: A subclass of ``Credentials``
c S s g | ]
}|j �qS r3 �r5 r� r3 r3 r6 r� 8 s z4CredentialResolver.insert_before.<locals>.<listcomp>r� N)rA �indexr� r �insert�rZ r� Zcredential_provider�offsetr3 r3 r6 �
insert_before) s
z CredentialResolver.insert_beforec C s | � |�}| j�|d |� dS )a9
Inserts a new type of ``Credentials`` instance into the chain that will
be tried after an existing one.
:param name: The short name of the credentials you'd like to insert the
new credentials after. (ex. ``env`` or ``config``). Existing names
& ordering can be discovered via ``self.available_methods``.
:type name: string
:param cred_instance: An instance of the new ``Credentials`` object
you'd like to add to the chain.
:type cred_instance: A subclass of ``Credentials``
rF N)�_get_provider_offsetrA r� r� r3 r3 r6 � insert_after= s
z CredentialResolver.insert_afterc C s6 dd� | j D �}||kr dS |�|�}| j �|� dS )z�
Removes a given ``Credentials`` instance from the chain.
:param name: The short name of the credentials instance to remove.
:type name: string
c S s g | ]
}|j �qS r3 r� r� r3 r3 r6 r� U s z-CredentialResolver.remove.<locals>.<listcomp>N)rA r� �pop)rZ r� Zavailable_methodsr� r3 r3 r6 rN N s
zCredentialResolver.removec C s | j | �|� S )z�Return a credential provider by name.
:type name: str
:param name: The name of the provider.
:raises UnknownCredentialError: Raised if no
credential provider by the provided name
is found.
)rA r� �rZ r� r3 r3 r6 � get_provider] s
z CredentialResolver.get_providerc C s< zdd� | j D ��|�W S tk
r6 t|d��Y nX d S )Nc S s g | ]
}|j �qS r3 r� r� r3 r3 r6 r� k s z;CredentialResolver._get_provider_offset.<locals>.<listcomp>r� )rA r� r� r r� r3 r3 r6 r� i s z'CredentialResolver._get_provider_offsetc C s6 | j D ]*}t�d|j� |�� }|dk r| S qdS )zw
Goes through the credentials chain, returning the first ``Credentials``
that could be loaded.
z Looking for credentials via: %sN)rA rO rP r5 r1 )rZ r� r� r3 r3 r6 rt o s
z#CredentialResolver.load_credentialsN)
rp rq rr r[ r� r� rN r� r� rt r3 r3 r3 r6 rQ s rQ c s: e Zd ZdZd � fdd� Zdd� Zdd� Zd d
� Z� ZS ) �SSOCredentialFetcherz%Y-%m-%dT%H:%M:%SZNc sB || _ || _|| _|| _|| _|| _| | _|
| _t� � ||� d S r$ )
r � _sso_region�
_role_namer� �
_start_url�
_token_loader�_token_provider�_sso_session_namer� r[ ) rZ � start_url�
sso_regionrW r# r: r� r0 r� rm �sso_session_namer� r3 r6 r[ � s
z SSOCredentialFetcher.__init__c C sV | j | jd�}| jr | j|d< n
| j|d< tj|ddd�}t|�d���� }| � |�S )r )�roleName� accountIdZ sessionNameZstartUrlT)�,r� )r �
separatorsr )
r� r� r� r� r
r r r r r� r r3 r3 r6 r� � s �
z&SSOCredentialFetcher._create_cache_keyc C s$ |d }t j �|t� �}|�| j�S )Ng @�@)rv �
fromtimestampr r} �_UTC_DATE_FORMAT)rZ Z timestamp_msZtimestamp_seconds� timestampr3 r3 r6 �_parse_timestamp� s z%SSOCredentialFetcher._parse_timestampc C s� t t| jd�}| jd|d�}| jr8| j�� }|�� j}n| �| j �d }| j
| j |d�}z|j f |�}W n |j
jk
r� t� �Y nX |d }d|d |d |d | �|d
�| j d �d �}|S )
z4Get credentials by calling SSO get role credentials.)r. r1 �ssor/ � accessToken)r� r� r� ZroleCredentialsZ accessKeyIdZsecretAccessKeyZ sessionTokenr� )r� r� r� r� r� )Z ProviderTyper� )r r r� r r� Z
load_tokenZget_frozen_tokenr" r� r� r� r� Zget_role_credentials�
exceptionsZUnauthorizedExceptionr r� )rZ r. r� Zinitial_token_datar" r� r� r� r3 r3 r6 r� � s6 �
� ��
z%SSOCredentialFetcher._get_credentials)NNNNN) rp rq rr r� r[ r� r� r� r� r3 r3 r� r6 r� � s �r� c @ s\ e Zd ZdZej�ej�dddd��ZdZ dZ
e e
Z ddd �Z d
d � Z
d d
� Zdd� ZdS )rn r� �~z.awsr0 )�
sso_role_name�sso_account_id)�
sso_start_urlr� Nc C sF |d krt | j�}|| _|| _|d kr*i }|| _|| _|| _|| _d S r$ )r �_SSO_TOKEN_CACHE_DIR� _token_cacher� r0 r; r r: )rZ r9 r: r; r0 rl rm r3 r3 r6 r[ � s
zSSOProvider.__init__c s� | � � }|�di �}| j}|�| ji �� |�di �}t� fdd�| jD ��rPd S | �� |�\}}i }g }| j| } | D ]$}
|
|kr�||
||
< qv|�|
� qv|r�d�|�} t d|� d| � �d��|S ) NrS � sso_sessionsc 3 s | ]}|� kV qd S r$ r3 )r� �c�rQ r3 r6 r�
s z/SSOProvider._load_sso_config.<locals>.<genexpr>r� r� zB" is configured to use SSO but is missing required configuration: r� )
r; rC r: �all� _PROFILE_REQUIRED_CONFIG_VARS� _resolve_sso_session_reference�_ALL_REQUIRED_CONFIG_VARSr3 r� r ) rZ r� rS r; r� Zresolved_configZ
extra_reqsr. Zmissing_config_varsZall_required_configs�
config_var�missingr3 r� r6 �_load_sso_config s4 � �
�z SSOProvider._load_sso_configc C s� |� d�}|d kr|dfS ||kr8d|� d�}t|d��|�� }|| }|�� D ]F\}}|� ||�|kr�d|� d|| � d|� d �}t|d��|||< qP|d
fS ) N� sso_sessionr3 z+The specified sso-session does not exist: "�"r� zThe value for z" is inconsistent between profile (z) and sso-session (z).)r )rC r �copy�items) rZ rQ r� r� r� r. r5 r� �valr3 r3 r6 r� ) s
�
z*SSOProvider._resolve_sso_session_referencec C sx | � � }|sd S |d |d |d |d | jt| jd�| jd�}d|kr^|d |d< | j|d < tf |�}t| j|j d
�S ) Nr� r� r� r� )r0 )r� r� rW r# r: r� r0 r r� rm rX )
r r r r� r0 r� r� r� r5 r� )rZ Z
sso_configZfetcher_kwargsZ sso_fetcherr3 r3 r6 r1 @ s&
�
�zSSOProvider.load)NNN)rp rq rr r5 r� rp rq r� r� r� Z_SSO_REQUIRED_CONFIG_VARSr� r[ r r� r1 r3 r3 r3 r6 rn � s �� �
$rn )NN)F)Urv r r
�loggingr� rG r� r � collectionsr r r �hashlibr Zdateutil.parserr Z dateutil.tzr r Zbotocore.compatr� Zbotocore.configloaderr r
r Zbotocore.configr Zbotocore.exceptionsr
r r r r r r r r Zbotocore.tokensr Zbotocore.utilsr r r r r r r r � getLoggerrp rO r r� rD rU rH ru rx r{ r rJ r� r� r� r� r� r� r� r r+ r0 rd rG rE rL rg rj rM rI rk rK rF rQ r� rn r3 r3 r3 r6 �<module> s� , (
�
`M
0 ;H>\
�E.T #7E- JYXSd[