Credentials.h

Go to the documentation of this file.

#pragma once

#include <aws/crt/Exports.h>
#include <aws/crt/Types.h>
#include <aws/crt/http/HttpConnection.h>
#include <aws/crt/io/TlsOptions.h>

#include <chrono>
#include <functional>

struct aws_credentials;
struct aws_credentials_provider;

namespace Aws
{
    namespace Crt
    {
        namespace Io
        {
            class ClientBootstrap;
        }

        namespace Http
        {
            class HttpClientConnectionProxyOptions;
        }

        namespace Auth
        {
            class AWS_CRT_CPP_API Credentials
            {
              public:
                Credentials(const aws_credentials *credentials) noexcept;
                Credentials(
                    ByteCursor access_key_id,
                    ByteCursor secret_access_key,
                    ByteCursor session_token,
                    uint64_t expiration_timepoint_in_seconds,
                    Allocator *allocator = ApiAllocator()) noexcept;

                Credentials(Allocator *allocator = ApiAllocator()) noexcept;

                ~Credentials();

                Credentials(const Credentials &) = delete;
                Credentials(Credentials &&) = delete;
                Credentials &operator=(const Credentials &) = delete;
                Credentials &operator=(Credentials &&) = delete;

                ByteCursor GetAccessKeyId() const noexcept;

                ByteCursor GetSecretAccessKey() const noexcept;

                ByteCursor GetSessionToken() const noexcept;

                uint64_t GetExpirationTimepointInSeconds() const noexcept;

                ByteCursor GetAccountId() const noexcept;

                explicit operator bool() const noexcept;

                const aws_credentials *GetUnderlyingHandle() const noexcept { return m_credentials; }

              private:
                const aws_credentials *m_credentials;
            };

            using OnCredentialsResolved = std::function<void(std::shared_ptr<Credentials>, int errorCode)>;

            using GetCredentialsHandler = std::function<std::shared_ptr<Credentials>()>;

            class AWS_CRT_CPP_API ICredentialsProvider : public std::enable_shared_from_this<ICredentialsProvider>
            {
              public:
                virtual ~ICredentialsProvider() = default;

                virtual bool GetCredentials(const OnCredentialsResolved &onCredentialsResolved) const = 0;

                virtual aws_credentials_provider *GetUnderlyingHandle() const noexcept = 0;

                virtual bool IsValid() const noexcept = 0;
            };

            struct AWS_CRT_CPP_API CredentialsProviderStaticConfig
            {
                CredentialsProviderStaticConfig()
                {
                    AWS_ZERO_STRUCT(AccessKeyId);
                    AWS_ZERO_STRUCT(SecretAccessKey);
                    AWS_ZERO_STRUCT(SessionToken);
                }

                ByteCursor AccessKeyId;

                ByteCursor SecretAccessKey;

                ByteCursor SessionToken;
            };

            struct AWS_CRT_CPP_API CredentialsProviderProfileConfig
            {
                CredentialsProviderProfileConfig() : Bootstrap(nullptr), TlsContext(nullptr)
                {
                    AWS_ZERO_STRUCT(ProfileNameOverride);
                    AWS_ZERO_STRUCT(ConfigFileNameOverride);
                    AWS_ZERO_STRUCT(CredentialsFileNameOverride);
                }

                ByteCursor ProfileNameOverride;

                ByteCursor ConfigFileNameOverride;

                ByteCursor CredentialsFileNameOverride;

                Io::ClientBootstrap *Bootstrap;

                Io::TlsContext *TlsContext;

                Optional<Http::ProxyEnvVarOptions> ProxyEnvVarOptions;
            };

            struct AWS_CRT_CPP_API CredentialsProviderImdsConfig
            {
                CredentialsProviderImdsConfig() : Bootstrap(nullptr) {}

                Io::ClientBootstrap *Bootstrap;
            };

            struct AWS_CRT_CPP_API CredentialsProviderChainConfig
            {
                CredentialsProviderChainConfig() : Providers() {}

                Vector<std::shared_ptr<ICredentialsProvider>> Providers;
            };

            struct AWS_CRT_CPP_API CredentialsProviderCachedConfig
            {
                CredentialsProviderCachedConfig() : Provider(), CachedCredentialTTL() {}

                std::shared_ptr<ICredentialsProvider> Provider;

                std::chrono::milliseconds CachedCredentialTTL;
            };

            struct AWS_CRT_CPP_API CredentialsProviderChainDefaultConfig
            {
                CredentialsProviderChainDefaultConfig() : Bootstrap(nullptr), TlsContext(nullptr) {}

                Io::ClientBootstrap *Bootstrap;

                Io::TlsContext *TlsContext;
            };

            struct AWS_CRT_CPP_API CredentialsProviderX509Config
            {
                CredentialsProviderX509Config()
                    : Bootstrap(nullptr), TlsOptions(), ThingName(), RoleAlias(), Endpoint(), ProxyOptions()
                {
                }

                Io::ClientBootstrap *Bootstrap;

                /* TLS connection options that have been initialized with your x509 certificate and private key */
                Io::TlsConnectionOptions TlsOptions;

                /* IoT thing name you registered with AWS IOT for your device, it will be used in http request header */
                String ThingName;

                /* Iot role alias you created with AWS IoT for your IAM role, it will be used in http request path */
                String RoleAlias;

                String Endpoint;

                Optional<Http::HttpClientConnectionProxyOptions> ProxyOptions;
            };

            struct AWS_CRT_CPP_API CredentialsProviderDelegateConfig
            {
                /* handler to provider credentials */
                GetCredentialsHandler Handler;
            };

            struct AWS_CRT_CPP_API CognitoLoginPair
            {

                String IdentityProviderName;

                String IdentityProviderToken;
            };

            struct AWS_CRT_CPP_API CredentialsProviderCognitoConfig
            {
                CredentialsProviderCognitoConfig();

                String Endpoint;

                String Identity;

                Optional<Vector<CognitoLoginPair>> Logins;

                Optional<String> CustomRoleArn;

                Io::ClientBootstrap *Bootstrap;

                Io::TlsContext TlsCtx;

                Optional<Http::HttpClientConnectionProxyOptions> ProxyOptions;
            };

            struct AWS_CRT_CPP_API CredentialsProviderSTSConfig
            {
                CredentialsProviderSTSConfig();

                std::shared_ptr<ICredentialsProvider> Provider;

                String RoleArn;

                String SessionName;

                uint16_t DurationSeconds;

                Io::ClientBootstrap *Bootstrap;

                Io::TlsContext TlsCtx;

                Optional<Http::HttpClientConnectionProxyOptions> ProxyOptions;
            };

            struct AWS_CRT_CPP_API CredentialsProviderSTSWebIdentityConfig
            {
                CredentialsProviderSTSWebIdentityConfig();

                String RoleArn;

                String SessionName;

                String Region;

                String TokenFilePath;

                Io::ClientBootstrap *Bootstrap;

                Io::TlsConnectionOptions TlsConnectionOptions;

                Optional<Http::ProxyEnvVarOptions> ProxyEnvVarOptions;
            };

            struct AWS_CRT_CPP_API CredentialsProviderLoginConfig
            {
                CredentialsProviderLoginConfig();

                String LoginSession;

                String LoginCacheOverride;

                String LoginRegion;

                Io::ClientBootstrap *Bootstrap;

                Io::TlsConnectionOptions TlsConnectionOptions;
            };

            class AWS_CRT_CPP_API CredentialsProvider : public ICredentialsProvider
            {
              public:
                CredentialsProvider(aws_credentials_provider *provider, Allocator *allocator = ApiAllocator()) noexcept;

                virtual ~CredentialsProvider();

                CredentialsProvider(const CredentialsProvider &) = delete;
                CredentialsProvider(CredentialsProvider &&) = delete;
                CredentialsProvider &operator=(const CredentialsProvider &) = delete;
                CredentialsProvider &operator=(CredentialsProvider &&) = delete;

                virtual bool GetCredentials(const OnCredentialsResolved &onCredentialsResolved) const override;

                virtual aws_credentials_provider *GetUnderlyingHandle() const noexcept override { return m_provider; }

                virtual bool IsValid() const noexcept override { return m_provider != nullptr; }

                /*
                 * Factory methods for all of the basic credentials provider types
                 */

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderStatic(
                    const CredentialsProviderStaticConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderAnonymous(
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderEnvironment(
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderProfile(
                    const CredentialsProviderProfileConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderImds(
                    const CredentialsProviderImdsConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderChain(
                    const CredentialsProviderChainConfig &config,
                    Allocator *allocator = ApiAllocator());

                /*
                 * Creates a provider that puts a simple time-based cache in front of its queries
                 * to a subordinate provider.
                 */
                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderCached(
                    const CredentialsProviderCachedConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderChainDefault(
                    const CredentialsProviderChainDefaultConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderX509(
                    const CredentialsProviderX509Config &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderDelegate(
                    const CredentialsProviderDelegateConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderCognito(
                    const CredentialsProviderCognitoConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderSTS(
                    const CredentialsProviderSTSConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderSTSWebIdentity(
                    const CredentialsProviderSTSWebIdentityConfig &config,
                    Allocator *allocator = ApiAllocator());

                static std::shared_ptr<ICredentialsProvider> CreateCredentialsProviderLogin(
                    const CredentialsProviderLoginConfig &config,
                    Allocator *allocator = ApiAllocator());

              private:
                static void s_onCredentialsResolved(aws_credentials *credentials, int error_code, void *user_data);

                Allocator *m_allocator;
                aws_credentials_provider *m_provider;
            };
        } // namespace Auth
    } // namespace Crt
} // namespace Aws