Ensure SDK credential cache type safety (#2122)

references = ["smithy-rs#2213"]

meta = { "breaking" = false, "tada" = false, "bug" = true, "target" = "server"}

author = "david-perez"

[[aws-sdk-rust]]

message = """Integrate Endpoints 2.0 into the Rust SDK. Endpoints 2.0 enables features like S3 virtual addressing & S3

object lambda. As part of this change, there are several breaking changes although efforts have been made to deprecate

where possible to smooth the upgrade path.

1. `aws_smithy_http::endpoint::Endpoint` and the `endpoint_resolver` methods have been deprecated. In general, these usages

   should be replaced with usages of `endpoint_url` instead. `endpoint_url` accepts a string so an `aws_smithy_http::Endpoint`

   does not need to be constructed. This structure and methods will be removed in a future release.

2. The `endpoint_resolver` method on `<service>::config::Builder` now accepts a service specific endpoint resolver instead

   of an implementation of `ResolveAwsEndpoint`. Most users will be able to replace these usages with a usage of `endpoint_url`.

3. `ResolveAwsEndpoint` has been deprecated and will be removed in a future version of the SDK.

4. The SDK does not support "pseudo regions" anymore. Specifically, regions like `iam-fips` will no longer resolve to a FIPS endpoint.

"""

references = ["smithy-rs#1784", "smithy-rs#2074"]

meta = { "breaking" = true, "tada" = true, "bug" = false }

author = "rcoh"

[[aws-sdk-rust]]

message = """Add additional configuration parameters to `aws_sdk_s3::Config`.

The launch of endpoints 2.0 includes more configuration options for S3. The default behavior for endpoint resolution has

been changed. Before, all requests hit the path-style endpoint. Going forward, all requests that can be routed to the

virtually hosted bucket will be routed there automatically.

- `force_path_style`: Requests will now default to the virtually-hosted endpoint `<bucketname>.s3.<region>.amazonaws.com`

- `use_arn_region`: Enables this client to use an ARN’s region when constructing an endpoint instead of the client’s configured region.

- `accelerate`: Enables this client to use S3 Transfer Acceleration endpoints.

Note: the AWS SDK for Rust does not currently support Multi Region Access Points (MRAP).

"""

references = ["smithy-rs#1784", "smithy-rs#2074"]

meta = { "breaking" = true, "tada" = true, "bug" = false }

author = "rcoh"

[[smithy-rs]]

message = "In 0.52, `@length`-constrained collection shapes whose members are not constrained made the server code generator crash. This has been fixed."

references = ["smithy-rs#2103"]

meta = { "breaking" = false, "tada" = false, "bug" = true, "target" = "server" }

author = "david-perez"

[[smithy-rs]]

message = "The Rust client codegen plugin is now called `rust-client-codegen` instead of `rust-codegen`. Be sure to update your `smithy-build.json` files to refer to the correct plugin name."

references = ["smithy-rs#2099"]

meta = { "breaking" = true, "tada" = false, "bug" = false, "target" = "client" }

author = "jdisanti"

[[smithy-rs]]

message = "Client codegen plugins need to define a service named `software.amazon.smithy.rust.codegen.client.smithy.customize.ClientCodegenDecorator` (this is the new file name for the plugin definition in `resources/META-INF/services`)."

references = ["smithy-rs#2099"]

meta = { "breaking" = true, "tada" = false, "bug" = false, "target" = "client" }

author = "jdisanti"

[[smithy-rs]]

message = "Server codegen plugins need to define a service named `software.amazon.smithy.rust.codegen.server.smithy.customize.ServerCodegenDecorator` (this is the new file name for the plugin definition in `resources/META-INF/services`)."

references = ["smithy-rs#2099"]

meta = { "breaking" = true, "tada" = false, "bug" = false, "target" = "server" }

author = "jdisanti"

[[aws-sdk-rust]]

message = """

Move types for AWS SDK credentials to a separate crate.

A new AWS runtime crate called `aws-credential-types` has been introduced. Types for AWS SDK credentials have been moved to that crate from `aws-config` and `aws-types`. The new crate is placed at the top of the dependency graph among AWS runtime crates with the aim of the downstream crates having access to the types defined in it.

"""

references = ["smithy-rs#2108"]

meta = { "breaking" = true, "tada" = false, "bug" = false }

author = "ysaito1001"

[[smithy-rs]]

message = "Servers support the `@default` trait: models can specify default values. Default values will be automatically supplied when not manually set."

references = ["smithy-rs#1879"]

meta = { "breaking" = false, "tada" = false, "bug" = false, "target" = "server" }

author = "82marbag"

[[smithy-rs]]

message = "The constraint `@length` on non-streaming blob shapes is supported."

references = ["smithy-rs#2131"]

meta = { "breaking" = false, "tada" = false, "bug" = false, "target" = "server" }

author = "82marbag"

[[aws-sdk-rust]]

references = ["smithy-rs#2152"]

meta = { "breaking" = false, "tada" = false, "bug" = false }

author = "rcoh"

message = """Add support for overriding profile name and profile file location across all providers. Prior to this change, each provider needed to be updated individually.

### Before

```rust

use aws_config::profile::{ProfileFileCredentialsProvider, ProfileFileRegionProvider};

use aws_config::profile::profile_file::{ProfileFiles, ProfileFileKind};

let profile_files = ProfileFiles::builder()

    .with_file(ProfileFileKind::Credentials, "some/path/to/credentials-file")

    .build();

let credentials_provider = ProfileFileCredentialsProvider::builder()

    .profile_files(profile_files.clone())

    .build();

let region_provider = ProfileFileRegionProvider::builder()

    .profile_files(profile_files)

    .build();

let sdk_config = aws_config::from_env()

    .credentials_provider(credentials_provider)

    .region(region_provider)

    .load()

    .await;

```

### After

```rust

use aws_config::profile::{ProfileFileCredentialsProvider, ProfileFileRegionProvider};

use aws_config::profile::profile_file::{ProfileFiles, ProfileFileKind};

let profile_files = ProfileFiles::builder()

    .with_file(ProfileFileKind::Credentials, "some/path/to/credentials-file")

    .build();

let sdk_config = aws_config::from_env()

    .profile_files(profile_files)

    .load()

    .await;

/// ```

"""

[[smithy-rs]]

message = "Fix bug where string default values were not supported for endpoint parameters"

references = ["smithy-rs#2150"]

meta = { "breaking" = false, "tada" = false, "bug" = true, "target" = "client" }

author = "rcoh"

[[aws-sdk-rust]]

references = ["smithy-rs#2162"]

meta = { "breaking" = true, "tada" = false, "bug" = false }

message = "`aws_config::profile::retry_config` && `aws_config::environment::retry_config` have been removed. Use `aws_config::default_provider::retry_config` instead."

author = "rcoh"

[[smithy-rs]]

references = ["smithy-rs#2170", "aws-sdk-rust#706"]

meta = { "breaking" = false, "tada" = false, "bug" = true }

message = "Remove the webpki-roots feature from `hyper-rustls`"

author = "rcoh"

[[aws-sdk-rust]]

references = ["smithy-rs#2168"]

meta = { "breaking" = false, "tada" = true, "bug" = false }

message = """Add support for resolving FIPS and dual-stack endpoints.

FIPS and dual-stack endpoints can each be configured in multiple ways:

1. Automatically from the environment and AWS profile

2. Across all clients loaded from the same `SdkConfig` via `from_env().use_dual_stack(true).load().await`

3. At a client level when constructing the configuration for an individual client.

Note: Not all services support FIPS and dual-stack.

"""

author = "rcoh"

[[aws-sdk-rust]]

message = """

Improve SDK credentials caching through type safety. `LazyCachingCredentialsProvider` has been renamed to `LazyCredentialsCache` and is no longer treated as a credentials provider. Furthermore, you do not create a `LazyCredentialsCache` directly, and instead you interact with `CredentialsCache`. This introduces the following breaking changes.

If you previously used `LazyCachingCredentialsProvider`, you can replace it with `CredentialsCache`.

<details>

<summary>Example</summary>

Before:

```rust

use aws_config::meta::credentials::lazy_caching::LazyCachingCredentialsProvider;

use aws_types::provider::ProvideCredentials;

fn make_provider() -> impl ProvideCredentials {

    // --snip--

}

let credentials_provider =

    LazyCachingCredentialsProvider::builder()

        .load(make_provider())

        .build();

let sdk_config = aws_config::from_env()

    .credentials_provider(credentials_provider)

    .load()

    .await;

let client = aws_sdk_s3::Client::new(&sdk_config);

```

After:

```rust

use aws_credential_types::cache::CredentialsCache;

use aws_types::provider::ProvideCredentials;

use std::sync::Arc;

fn make_provider() -> impl ProvideCredentials {

    // --snip--

}

// Wrapping a result of `make_provider` in `LazyCredentialsCache` is done automatically.

let sdk_config = aws_config::from_env()

    .credentials_cache(CredentialsCache::lazy()) // This line can be omitted because it is on by default.

    .credentials_provider(Arc::new(make_provider()))

    .load()

    .await;

let client = aws_sdk_s3::Client::new(&sdk_config);

```

If you previously configured a `LazyCachingCredentialsProvider`, you can use the builder for `LazyCredentialsCache` instead.

Before:

```rust

use aws_config::meta::credentials::lazy_caching::LazyCachingCredentialsProvider;

use aws_types::provider::ProvideCredentials;

use std::time::Duration;

fn make_provider() -> impl ProvideCredentials {

    // --snip--

}

let credentials_provider =

    LazyCachingCredentialsProvider::builder()

        .load(make_provider())

        .load_timeout(Duration::from_secs(60)) // Configures timeout.

        .build();

let sdk_config = aws_config::from_env()

    .credentials_provider(credentials_provider)

    .load()

    .await;

let client = aws_sdk_s3::Client::new(&sdk_config);

```

After:

```rust

use aws_credential_types::cache::CredentialsCache;

use aws_types::provider::ProvideCredentials;

use std::sync::Arc;

use std::time::Duration;

fn make_provider() -> impl ProvideCredentials {

    // --snip--

}

let sdk_config = aws_config::from_env()

    .credentials_cache(

        CredentialsCache::lazy_builder()

            .load_timeout(Duration::from_secs(60)) // Configures timeout.

            .into_credentials_cache(),

    )

    .credentials_provider(Arc::new(make_provider()))

    .load()

    .await;

let client = aws_sdk_s3::Client::new(&sdk_config);

```

The examples above only demonstrate how to use `credentials_cache` and `credentials_provider` methods on `aws_config::ConfigLoader` but the same code update can be applied when you interact with `aws_types::sdk_config::Builder` or the builder for a service-specific config, e.g. `aws_sdk_s3::config::Builder`.

</details>

If you previously configured a `DefaultCredentialsChain` by calling `load_timeout`, `buffer_time`, or `default_credential_expiration` on its builder, you need to call the same set of methods on the builder for `LazyCredentialsCache` instead.

<details>

<summary>Example</summary>

Before:

```rust

use aws_config::default_provider::credentials::DefaultCredentialsChain;

use std::time::Duration;

let credentials_provider = DefaultCredentialsChain::builder()

    .buffer_time(Duration::from_secs(30))

    .default_credential_expiration(Duration::from_secs(20 * 60))

    .build()

    .await;

let sdk_config = aws_config::from_env()

    .credentials_provider(credentials_provider)

    .load()

    .await;

let client = aws_sdk_s3::Client::new(&sdk_config);

```

After:

```rust

use aws_config::default_provider::credentials::default_provider;

use aws_credential_types::cache::CredentialsCache;

use std::sync::Arc;

use std::time::Duration;

// Previously used methods no longer exist on the builder for `DefaultCredentialsChain`.

let credentials_provider = default_provider().await;

let sdk_config = aws_config::from_env()

    .credentials_cache(

        CredentialsCache::lazy_builder()

            .buffer_time(Duration::from_secs(30))

            .default_credential_expiration(Duration::from_secs(20 * 60))

            .into_credentials_cache(),

    )

    .credentials_provider(Arc::new(credentials_provider))

    .load()

    .await;

let client = aws_sdk_s3::Client::new(&sdk_config);

```

</details>

"""

references = ["smithy-rs#2122"]

meta = { "breaking" = true, "tada" = false, "bug" = false }

author = "ysaito1001"

[[aws-sdk-rust]]

message = """

The introduction of `CredentialsCache` comes with an accompanying type `SharedCredentialsCache`. This replaces `SharedCredentialsProvider` and as a result, `aws_http::auth:set_provider` has been updated to `aws_http::auth::set_credentials_cache`.

Before:

```rust

use aws_credential_types::Credentials;

use aws_credential_types::provider::SharedCredentialsProvider;

use aws_http::auth::set_provider;

use aws_smithy_http::body::SdkBody;

use aws_smithy_http::operation;

let mut req = operation::Request::new(http::Request::new(SdkBody::from("some body")));

let credentials = Credentials::new("example", "example", None, None, "my_provider_name");

set_provider(

    &mut req.properties_mut(),

    SharedCredentialsProvider::new(credentials),

);

```

After:

```rust

use aws_credential_types::Credentials;

use aws_credential_types::cache::{CredentialsCache, SharedCredentialsCache};

use aws_http::auth::set_credentials_cache;

use aws_smithy_http::body::SdkBody;

use aws_smithy_http::operation;

use std::sync::Arc;

let mut req = operation::Request::new(http::Request::new(SdkBody::from("some body")));

let credentials = Credentials::new("example", "example", None, None, "my_provider_name");

let credentials_cache = CredentialsCache::lazy_builder()

    .into_credentials_cache()

    .create_cache(Arc::new(credentials));

set_credentials_cache(

    &mut req.properties_mut(),

    SharedCredentialsCache::new(credentials_cache),

);

```

"""

references = ["smithy-rs#2122"]

meta = { "breaking" = true, "tada" = false, "bug" = false }

author = "ysaito1001"

# require manual version bumping every time an automated version bump

# to the exposed SDK crates happens.

allowed_external_types = [

   "aws_credential_types::cache::CredentialsCache",

   "aws_credential_types::provider::ProvideCredentials",

   "aws_credential_types::provider::Result",

   "aws_credential_types::provider::SharedCredentialsProvider",

   "aws_sdk_sts::model::PolicyDescriptorType",

   "aws_smithy_async::rt::sleep::AsyncSleep",

   "aws_smithy_client::bounds::SmithyConnector",

 */

use std::borrow::Cow;

use std::time::Duration;

use aws_credential_types::lazy_caching::{self, LazyCachingCredentialsProvider};

use aws_credential_types::provider::{self, future, ProvideCredentials};

use tracing::Instrument;

///     .build();

/// ```

#[derive(Debug)]

pub struct DefaultCredentialsChain(LazyCachingCredentialsProvider);

pub struct DefaultCredentialsChain {

    provider_chain: CredentialsProviderChain,

}

impl DefaultCredentialsChain {

    /// Builder for `DefaultCredentialsChain`

    }

    async fn credentials(&self) -> provider::Result {

        self.0

        self.provider_chain

            .provide_credentials()

            .instrument(tracing::debug_span!("provide_credentials", provider = %"default_chain"))

            .await

    web_identity_builder: crate::web_identity_token::Builder,

    imds_builder: crate::imds::credentials::Builder,

    ecs_builder: crate::ecs::Builder,

    credential_cache: lazy_caching::Builder,

    region_override: Option<Box<dyn ProvideRegion>>,

    region_chain: crate::default_provider::region::Builder,

    conf: Option<ProviderConfig>,

        self

    }

    /// Timeout for the entire credential loading chain.

    ///

    /// Defaults to 5 seconds.

    pub fn load_timeout(mut self, timeout: Duration) -> Self {

        self.set_load_timeout(Some(timeout));

        self

    }

    /// Timeout for the entire credential loading chain.

    ///

    /// Defaults to 5 seconds.

    pub fn set_load_timeout(&mut self, timeout: Option<Duration>) -> &mut Self {

        self.credential_cache.set_load_timeout(timeout);

        self

    }

    /// Amount of time before the actual credential expiration time

    /// where credentials are considered expired.

    ///

    /// For example, if credentials are expiring in 15 minutes, and the buffer time is 10 seconds,

    /// then any requests made after 14 minutes and 50 seconds will load new credentials.

    ///

    /// Defaults to 10 seconds.

    pub fn buffer_time(mut self, buffer_time: Duration) -> Self {

        self.set_buffer_time(Some(buffer_time));

        self

    }

    /// Amount of time before the actual credential expiration time

    /// where credentials are considered expired.

    ///

    /// For example, if credentials are expiring in 15 minutes, and the buffer time is 10 seconds,

    /// then any requests made after 14 minutes and 50 seconds will load new credentials.

    ///

    /// Defaults to 10 seconds.

    pub fn set_buffer_time(&mut self, buffer_time: Option<Duration>) -> &mut Self {

        self.credential_cache.set_buffer_time(buffer_time);

        self

    }

    /// Default expiration time to set on credentials if they don't have an expiration time.

    ///

    /// This is only used if the given [`ProvideCredentials`] returns

    /// [`Credentials`](aws_credential_types::Credentials) that don't have their `expiry` set.

    /// This must be at least 15 minutes.

    ///

    /// Defaults to 15 minutes.

    pub fn default_credential_expiration(mut self, duration: Duration) -> Self {

        self.set_default_credential_expiration(Some(duration));

        self

    }

    /// Default expiration time to set on credentials if they don't have an expiration time.

    ///

    /// This is only used if the given [`ProvideCredentials`] returns

    /// [`Credentials`](aws_credential_types::Credentials) that don't have their `expiry` set.

    /// This must be at least 15 minutes.

    ///

    /// Defaults to 15 minutes.

    pub fn set_default_credential_expiration(&mut self, duration: Option<Duration>) -> &mut Self {

        self.credential_cache

            .set_default_credential_expiration(duration);

        self

    }

    /// Add an additional credential source for the ProfileProvider

    ///

    /// Assume role profiles may specify named credential sources:

            .or_else("WebIdentityToken", web_identity_token_provider)

            .or_else("EcsContainer", ecs_provider)

            .or_else("Ec2InstanceMetadata", imds_provider);

        let cached_provider = self

            .credential_cache

            .configure(conf.sleep(), conf.time_source())

            .load(provider_chain);

        DefaultCredentialsChain(cached_provider.build())

        DefaultCredentialsChain { provider_chain }

    }

}

mod loader {

    use std::sync::Arc;

    use aws_credential_types::provider::{ProvideCredentials, SharedCredentialsProvider};

    use aws_credential_types::cache::CredentialsCache;

    use aws_credential_types::provider::ProvideCredentials;

    use aws_smithy_async::rt::sleep::{default_async_sleep, AsyncSleep};

    use aws_smithy_client::http_connector::{ConnectorSettings, HttpConnector};

    use aws_smithy_types::retry::RetryConfig;

    #[derive(Default, Debug)]

    pub struct ConfigLoader {

        app_name: Option<AppName>,

        credentials_provider: Option<SharedCredentialsProvider>,

        credentials_cache: Option<CredentialsCache>,

        credentials_provider: Option<Arc<dyn ProvideCredentials>>,

        endpoint_resolver: Option<Arc<dyn ResolveAwsEndpoint>>,

        endpoint_url: Option<String>,

        region: Option<Box<dyn ProvideRegion>>,

            self

        }

        /// Override the credentials cache used to build [`SdkConfig`](aws_types::SdkConfig).

        ///

        /// # Examples

        ///

        /// Override the credentials cache but load the default value for region:

        /// ```no_run

        /// # use aws_credential_types::cache::CredentialsCache;

        /// # async fn create_config() {

        /// let config = aws_config::from_env()

        ///     .credentials_cache(CredentialsCache::lazy())

        ///     .load()

        ///     .await;

        /// # }

        /// ```

        pub fn credentials_cache(mut self, credentials_cache: CredentialsCache) -> Self {

            self.credentials_cache = Some(credentials_cache);

            self

        }

        /// Override the credentials provider used to build [`SdkConfig`](aws_types::SdkConfig).

        ///

        /// # Examples

        /// Override the credentials provider but load the default value for region:

        /// ```no_run

        /// # use aws_credential_types::Credentials;

        /// # use std::sync::Arc;

        /// # fn create_my_credential_provider() -> Credentials {

        /// #     Credentials::new("example", "example", None, None, "example")

        /// # }

        /// # async fn create_config() {

        /// let config = aws_config::from_env()

        ///     .credentials_provider(create_my_credential_provider())

        ///     .credentials_provider(Arc::new(create_my_credential_provider()))

        ///     .load()

        ///     .await;

        /// # }

        /// ```

        pub fn credentials_provider(

            mut self,

            credentials_provider: impl ProvideCredentials + 'static,

            credentials_provider: Arc<dyn ProvideCredentials>,

        ) -> Self {

            self.credentials_provider = Some(SharedCredentialsProvider::new(credentials_provider));

            self.credentials_provider = Some(credentials_provider);

            self

        }

                    .await

            };

            let sleep_impl = if self.sleep.is_none() {

            let sleep_impl = if self.sleep.is_some() {

                self.sleep

            } else {

                if default_async_sleep().is_none() {

                    tracing::warn!(

                        "An implementation of AsyncSleep was requested by calling default_async_sleep \

                    );

                }

                default_async_sleep()

            } else {

                self.sleep

            };

            let timeout_config = if let Some(timeout_config) = self.timeout_config {

                    .await

            };

            let http_connector = if let Some(http_connector) = self.http_connector {

                http_connector

            } else {

            let http_connector = self.http_connector.unwrap_or_else(|| {

                HttpConnector::Prebuilt(default_connector(

                    &ConnectorSettings::from_timeout_config(&timeout_config),

                    sleep_impl.clone(),

                ))

            };

            });

            let credentials_cache = self.credentials_cache.unwrap_or_else(|| {

                let mut builder = CredentialsCache::lazy_builder().time_source(conf.time_source());

                builder.set_sleep(conf.sleep());

                builder.into_credentials_cache()

            });

            let use_fips = if let Some(use_fips) = self.use_fips {

                Some(use_fips)

            } else {

                let mut builder = credentials::DefaultCredentialsChain::builder().configure(conf);

                builder.set_region(region.clone());

                SharedCredentialsProvider::new(builder.build().await)

                Arc::new(builder.build().await)

            };

            let endpoint_resolver = self.endpoint_resolver;

                .region(region)

                .retry_config(retry_config)

                .timeout_config(timeout_config)

                .credentials_cache(credentials_cache)

                .credentials_provider(credentials_provider)

                .http_connector(http_connector);

/// ```

///

/// _Note: Profile providers to not implement any caching. They will reload and reparse the profile

/// from the file system when called. See [lazy_caching](aws_credential_types::lazy_caching::LazyCachingCredentialsProvider) for

/// from the file system when called. See [CredentialsCache](aws_credential_types::cache::CredentialsCache) for

/// more information about caching._

///

/// This provider supports several different credentials formats: