Support Auth trait for Sigv4a (#2923)

Author: mullermp

build_tools/aws-sdk-code-generator/lib/aws-sdk-code-generator/service.rb

@@ -52,6 +52,7 @@ def initialize(options)
       @protocol_settings = metadata['protocolSettings'] || {}
       @api_version = metadata['apiVersion']
       @signature_version = metadata['signatureVersion']
+      @auth = api.fetch('metadata')['auth']
       @full_name = metadata['serviceFullName']
       @short_name = metadata['serviceAbbreviation'] || @full_name
 
@@ -159,6 +160,9 @@ def included_in_core?
     # @return [String] The signature version, e.g. "v4"
     attr_reader :signature_version
 
+    # @return [Array<String>] A list of supported auth types
+    attr_reader :auth
+
     # @return [String] The full product name for the service,
     #   e.g. "Amazon Simple Storage Service".
     attr_reader :full_name

build_tools/aws-sdk-code-generator/lib/aws-sdk-code-generator/views/client_api_module.rb

@@ -251,6 +251,7 @@ def operations
             end
             o.authorizer = operation['authorizer'] if operation.key?('authorizer')
             o.authtype = operation['authtype'] if operation.key?('authtype')
+            o.auth = operation['auth'] if operation.key?('auth')
             o.require_apikey = operation['requiresApiKey'] if operation.key?('requiresApiKey')
             o.pager = pager(operation_name)
             o.async = @service.protocol_settings['h2'] == 'eventstream' &&
@@ -598,6 +599,9 @@ def initialize
         # @return [String,nil]
         attr_accessor :authtype
 
+        # @return [Array<String>]
+        attr_accessor :auth
+
         # @return [Boolean]
         attr_accessor :endpoint_trait
 

build_tools/aws-sdk-code-generator/spec/fixtures/interfaces/bearer_auth/api.json renamed to build_tools/aws-sdk-code-generator/spec/fixtures/interfaces/legacy_sign_bearer_auth/api.json

@@ -5,15 +5,15 @@
 describe 'Client Interface:' do
   describe 'SignatureVersion: bearer' do
     before(:all) do
-      SpecHelper.generate_service(['BearerAuth'], multiple_files: false)
+      SpecHelper.generate_service(['LegacySignBearerAuth'], multiple_files: false)
     end
 
     let(:token) { 'token' }
 
     let(:token_provider) { Aws::StaticTokenProvider.new(token) }
 
     let(:client) do
-      BearerAuth::Client.new(
+      LegacySignBearerAuth::Client.new(
         region: 'us-west-2',
         stub_responses: true,
         token_provider: token_provider,
@@ -51,15 +51,15 @@
 
   describe 'SignatureVersion: v4' do
     before(:all) do
-      SpecHelper.generate_service(['V4WithBearer'], multiple_files: false)
+      SpecHelper.generate_service(['LegacySignV4WithBearer'], multiple_files: false)
     end
 
     let(:token) { 'token' }
 
     let(:token_provider) { Aws::StaticTokenProvider.new(token) }
 
     let(:client) do
-      V4WithBearer::Client.new(
+      LegacySignV4WithBearer::Client.new(
         region: 'us-west-2',
         stub_responses: true,
         token_provider: token_provider,

build_tools/aws-sdk-code-generator/spec/fixtures/interfaces/v4_with_bearer/api.json renamed to build_tools/aws-sdk-code-generator/spec/fixtures/interfaces/legacy_sign_v4_with_bearer/api.json

@@ -9,13 +9,7 @@
     end
 
     let(:client) do
-      TransferEncoding::Client.new(
-        region: 'us-west-2',
-        access_key_id: 'akid',
-        secret_access_key: 'secret',
-        stub_responses: true,
-        endpoint: 'https://svc.us-west-2.amazonaws.com'
-      )
+      TransferEncoding::Client.new(stub_responses: true)
     end
 
     it 'adds `Transfer-Encoding` header for `v4-unsigned-body` auth types' do
@@ -69,6 +63,5 @@
       resp = client.non_streaming(body: 'heyhey')
       expect(resp.context.http_request.headers['Content-Length']).to eq('19')
     end
-
   end
 end

build_tools/aws-sdk-code-generator/spec/interfaces/client/bearer_authorization_spec.rb

@@ -77,6 +77,9 @@ module {{module_name}}
         {{#authtype}}
         o['authtype'] = "{{.}}"
         {{/authtype}}
+        {{#auth}}
+        o['auth'] = {{&auth}}
+        {{/auth}}
         {{#endpoint_trait}}
         o.endpoint_pattern = {
           {{#endpoint_pattern}}

build_tools/aws-sdk-code-generator/spec/interfaces/client/transfer_encoding_spec.rb

@@ -231,7 +231,7 @@ def dynamodb_example_deep_transform(subsegment, keys)
     api('STS') do |api|
       operations = %w(AssumeRoleWithSAML AssumeRoleWithWebIdentity)
       operations.each do |operation|
-        api['operations'][operation]['authtype'] = 'none'
+        api['operations'][operation]['auth'] = ['smithy.api#noAuth']
       end
     end
   end

build_tools/aws-sdk-code-generator/templates/client_api_module.mustache

@@ -10,10 +10,10 @@ class ServiceEnumerator
     MANIFEST_PATH = File.expand_path('../../services.json', __FILE__)
 
     # Minimum `aws-sdk-core` version for new gem builds
-    MINIMUM_CORE_VERSION = "3.199.0"
+    MINIMUM_CORE_VERSION = "3.200.0"
 
     # Minimum `aws-sdk-core` version for new S3 gem builds
-    MINIMUM_CORE_VERSION_S3 = "3.199.0"
+    MINIMUM_CORE_VERSION_S3 = "3.200.0"
 
     EVENTSTREAM_PLUGIN = "Aws::Plugins::EventStreamConfiguration"
 
@@ -158,9 +158,16 @@ def gem_dependencies(api, dependencies)
       core_version_string = "', '>= #{min_core}"
       dependencies['aws-sdk-core'] = "~> #{version_file.split('.')[0]}#{core_version_string}"
 
+      api['metadata'].fetch('auth', []).each do |auth|
+        if %w[aws.auth#sigv4 aws.auth#sigv4a].include?(auth)
+          dependencies['aws-sigv4'] = '~> 1.5'
+        end
+      end
+
+      # deprecated auth but a reasonable fallback
       case api['metadata']['signatureVersion']
-      when 'v4' then dependencies['aws-sigv4'] = '~> 1.1'
-      when 'v2' then dependencies['aws-sigv2'] = '~> 1.0'
+      when 'v4' then dependencies['aws-sigv4'] ||= '~> 1.1'
+      when 'v2' then dependencies['aws-sigv2'] ||= '~> 1.0'
       end
       dependencies
     end

build_tools/customizations.rb

@@ -1,6 +1,10 @@
 Unreleased Changes
 ------------------
 
+* Feature - Support `auth` trait to enable SigV4a based services.
+
+* Feature - Support configuration for sigv4a signing regions using `ENV['AWS_SIGV4A_SIGNING_REGION_SET']`, `sigv4a_signing_region_set` shared config, or the `sigv4a_signing_region_set` client option.
+
 3.199.0 (2024-06-25)
 ------------------