Unverified Commit bd38d0dd authored by Rob Speller's avatar Rob Speller Committed by GitHub
Browse files

fix: treat blank env credentials as missing (#1272)

parent 7a5d1792

CHANGELOG.next.toml

+6 −0
Original line number Diff line number Diff line
@@ -34,3 +34,9 @@ message = "Update all SDK and runtime crates to [edition 2021](https://blog.rust 
references = ["aws-sdk-rust#490"]

meta = { "breaking" = true, "tada" = false, "bug" = false }

author = "Velfi"



[[aws-sdk-rust]]

message = "Treat blank environment variable credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) as missing instead of attempting to use them to sign requests."

references = ["aws-sdk-rust#1271"]

meta = { "breaking" = false, "tada" = false, "bug" = true }

author = "elrob"

aws/rust-runtime/aws-config/src/default_provider/credentials.rs

+1 −0
Original line number Diff line number Diff line
@@ -320,6 +320,7 @@ mod test { 
    make_test!(web_identity_token_profile);

    make_test!(profile_name);

    make_test!(profile_overrides_web_identity);

    make_test!(environment_variables_blank);

    make_test!(imds_token_fail);



    make_test!(imds_no_iam_role);

aws/rust-runtime/aws-config/src/environment/credentials.rs

+60 −1
Original line number Diff line number Diff line
@@ -23,11 +23,17 @@ pub struct EnvironmentVariableCredentialsProvider { 


impl EnvironmentVariableCredentialsProvider {

    fn credentials(&self) -> credentials::Result {

        let access_key = self.env.get("AWS_ACCESS_KEY_ID").map_err(to_cred_error)?;

        let access_key = self

            .env

            .get("AWS_ACCESS_KEY_ID")

            .and_then(err_if_blank)

            .map_err(to_cred_error)?;

        let secret_key = self

            .env

            .get("AWS_SECRET_ACCESS_KEY")

            .and_then(err_if_blank)

            .or_else(|_| self.env.get("SECRET_ACCESS_KEY"))

            .and_then(err_if_blank)

            .map_err(to_cred_error)?;

        let session_token = self

            .env
@@ -87,6 +93,14 @@ fn to_cred_error(err: VarError) -> CredentialsError { 
    }

}



fn err_if_blank(value: String) -> Result<String, VarError> {

    if value.trim().is_empty() {

        Err(VarError::NotPresent)

    } else {

        Ok(value)

    }

}



#[cfg(test)]

mod test {

    use aws_types::credentials::{CredentialsError, ProvideCredentials};
@@ -173,6 +187,25 @@ mod test { 
        assert_eq!(creds.secret_access_key(), "secret");

    }



    #[test]

    fn secret_key_fallback_empty() {

        let provider = make_provider(&[

            ("AWS_ACCESS_KEY_ID", "access"),

            ("AWS_SECRET_ACCESS_KEY", " "),

            ("SECRET_ACCESS_KEY", "secret"),

            ("AWS_SESSION_TOKEN", "token"),

        ]);



        let creds = provider

            .provide_credentials()

            .now_or_never()

            .unwrap()

            .expect("valid credentials");

        assert_eq!(creds.session_token().unwrap(), "token");

        assert_eq!(creds.access_key_id(), "access");

        assert_eq!(creds.secret_access_key(), "secret");

    }



    #[test]

    fn missing() {

        let provider = make_provider(&[]);
@@ -184,6 +217,32 @@ mod test { 
        assert!(matches!(err, CredentialsError::CredentialsNotLoaded { .. }));

    }



    #[test]

    fn empty_keys_env_vars() {

        for [access_key_value, secret_key_value] in &[

            &["", ""],

            &[" ", ""],

            &["access", ""],

            &["", " "],

            &[" ", " "],

            &["access", " "],

            &["", "secret"],

            &[" ", "secret"],

        ] {

            let provider = make_provider(&[

                ("AWS_ACCESS_KEY_ID", access_key_value),

                ("AWS_SECRET_ACCESS_KEY", secret_key_value),

            ]);



            let err = provider

                .provide_credentials()

                .now_or_never()

                .unwrap()

                .expect_err("no credentials defined");

            assert!(matches!(err, CredentialsError::CredentialsNotLoaded { .. }));

        }

    }



    #[test]

    fn real_environment() {

        let provider = EnvironmentVariableCredentialsProvider::new();

aws/rust-runtime/aws-config/test-data/default-provider-chain/environment_variables_blank/env.json

0 → 100644
+6 −0
Original line number Diff line number Diff line 
{

  "HOME": "/home",

  "AWS_ACCESS_KEY_ID": " ",

  "AWS_SECRET_ACCESS_KEY": " ",

  "AWS_PROFILE": "some_profile"

}

aws/rust-runtime/aws-config/test-data/default-provider-chain/environment_variables_blank/fs/home/.aws/config

0 → 100644
+9 −0
Original line number Diff line number Diff line 
[default]

region = us-east-1

aws_access_key_id = incorrect_key

aws_secret_access_key = incorrect_secret



[profile some_profile]

region = us-east-2

aws_access_key_id = correct_key

aws_secret_access_key = correct_secret