Skip to content

feat(toolkit-lib): make base credentials configurable #388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 19, 2025

Conversation

rix0rrr
Copy link
Contributor

@rix0rrr rix0rrr commented Apr 18, 2025

Previously, the Toolkit would always use AWS CLI-compatible base credentials. This is now configurable:

const toolkit = new Toolkit({
  sdkConfig: {
    baseCredentials: BaseCredentials.custom(...),
  },
});

Design

The BaseCredentials (abstract) class is responsible for producing the following 2 bits of information:

  • A credential provider
  • A default region

These will be used to initialize an SdkProvider, which will then proceed to use that information:

  • To inform the CDK app about the desired target environment
  • After synthesis and during lookup:
    • use those credentials directly; or
    • use those credentials to assume roles; or
    • use available plugins to obtain credentials

requestHandler (the proxy agent plus some SDK settings) used to be produced by the SdkProvider itself, but it is now produced by the Toolkit and part of the "services" that get passed in. That way, it is both available to the AwsCliCompatible base credentials to initialize the STS client, as well as to the SdkProvider class that now also gets instantiated by the Toolkit.

image

Supporting changes

  • Many of the supporting positional arguments to SdkProvider have been grouped into SdkProviderServices.
  • Change how we mock the SDK in a number of tests (instead of mocking the SDK Provider, mock the SDK)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@rix0rrr rix0rrr requested a review from a team April 18, 2025 09:25
@github-actions github-actions bot added the p2 label Apr 18, 2025
@aws-cdk-automation aws-cdk-automation requested a review from a team April 18, 2025 09:26
@rix0rrr rix0rrr self-assigned this Apr 18, 2025
@rix0rrr rix0rrr force-pushed the huijbers/base-creds branch from 2402c67 to 35a471f Compare April 18, 2025 11:34
@codecov-commenter
Copy link

codecov-commenter commented Apr 18, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.76%. Comparing base (59526e8) to head (0af7e9b).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #388      +/-   ##
==========================================
- Coverage   80.03%   79.76%   -0.28%     
==========================================
  Files          66       66              
  Lines        6878     6879       +1     
  Branches      792      784       -8     
==========================================
- Hits         5505     5487      -18     
- Misses       1353     1371      +18     
- Partials       20       21       +1     
Flag Coverage Δ
suite.unit 79.76% <100.00%> (-0.28%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Previously, the Toolkit would always use AWS CLI-compatible base
credentials. This is now configurable:

```ts
const toolkit = new Toolkit({
  sdkConfig: {
    baseCredentials: BaseCredentials.custom(...),
  },
});
```

## Design

The `BaseCredentials` (abstract) class is responsible for producing
the following 2 bits of information:

- A credential provider
- A default region

These will be used to initialize an `SdkProvider`, which will then
proceed to use that information:

- To inform the CDK app about the desired target environment
- After synthesis and during lookup:
  - use those credentials directly; or
  - use those credentials to assume roles; or
  - use available plugins to obtain credentials
@aws-cdk-automation aws-cdk-automation added this pull request to the merge queue Apr 19, 2025
Merged via the queue into main with commit 7c3c94e Apr 19, 2025
20 checks passed
@aws-cdk-automation aws-cdk-automation deleted the huijbers/base-creds branch April 19, 2025 23:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants