From 9457319d265d12852691e8bae250b7ff157a6870 Mon Sep 17 00:00:00 2001 From: KaemonIsland Date: Mon, 7 Oct 2024 16:57:21 -0400 Subject: [PATCH 1/6] Add region param to the getDefaultCredentialsChain Signed-off-by: KaemonIsland --- .../src/DefaultAwsCredentialsManager.ts | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts index 12e1e2dffd..2b7ae3e1e5 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts @@ -77,8 +77,15 @@ function getProfileCredentials( }); } -function getDefaultCredentialsChain(): AwsCredentialIdentityProvider { - return fromNodeProviderChain(); +/** + * Include the region if present, otherwise use the default region + * + * @see https://www.npmjs.com/package/@aws-sdk/credential-provider-node + */ +function getDefaultCredentialsChain( + region = 'us-east-1', +): AwsCredentialIdentityProvider { + return fromNodeProviderChain({ clientConfig: { region } }); } /** @@ -123,7 +130,7 @@ function getSdkCredentialProvider( return getProfileCredentials(config.profile!, config.region); } - return getDefaultCredentialsChain(); + return getDefaultCredentialsChain(config.region); } /** @@ -145,7 +152,7 @@ function getMainAccountSdkCredentialProvider( return getProfileCredentials(config.profile!, config.region); } - return getDefaultCredentialsChain(); + return getDefaultCredentialsChain(config.region); } /** From 9e3e04d231e3d6c5f97704889da600fcba160d2a Mon Sep 17 00:00:00 2001 From: KaemonIsland Date: Tue, 8 Oct 2024 12:50:55 -0400 Subject: [PATCH 2/6] Add unit tests Signed-off-by: KaemonIsland --- .../src/DefaultAwsCredentialsManager.test.ts | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts index 237428c3e9..ed61f45199 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts @@ -24,12 +24,20 @@ import { } from '@aws-sdk/client-sts'; import { Config, ConfigReader } from '@backstage/config'; import { promises } from 'fs'; +import { fromNodeProviderChain } from '@aws-sdk/credential-providers'; const env = process.env; let stsMock: AwsClientStub; let config: Config; jest.mock('fs', () => ({ promises: { readFile: jest.fn() } })); +jest.mock('@aws-sdk/credential-providers', () => { + const originalModule = jest.requireActual('@aws-sdk/credential-providers'); + return { + ...originalModule, + fromNodeProviderChain: jest.fn(), + }; +}); describe('DefaultAwsCredentialsManager', () => { beforeEach(() => { @@ -134,6 +142,16 @@ describe('DefaultAwsCredentialsManager', () => { '2022-01-10', ).toISOString(); + // Return creds from env + (fromNodeProviderChain as jest.Mock).mockReturnValue(() => + Promise.resolve({ + accessKeyId: process.env.AWS_ACCESS_KEY_ID, + secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, + sessionToken: process.env.AWS_SESSION_TOKEN, + expiration: new Date(process.env.AWS_CREDENTIAL_EXPIRATION), + }), + ); + const mockProfile = `[my-profile] aws_access_key_id=ACCESS_KEY_ID_9 aws_secret_access_key=SECRET_ACCESS_KEY_9 @@ -431,5 +449,49 @@ describe('DefaultAwsCredentialsManager', () => { provider.getCredentialProvider({ accountId: '123456789012' }), ).rejects.toThrow(/No credentials found/); }); + + it('passes the region to getDefaultCredentialsChain', async () => { + const region = 'us-west-2'; + const configWithRegion = new ConfigReader({ + aws: { + mainAccount: { + region, + }, + }, + }); + + const provider = + DefaultAwsCredentialsManager.fromConfig(configWithRegion); + const awsCredentialProvider = await provider.getCredentialProvider(); + + // Trigger the call to fromNodeProviderChain + await awsCredentialProvider.sdkCredentialProvider(); + + expect(fromNodeProviderChain).toHaveBeenCalledWith({ + clientConfig: { + region, + }, + }); + }); + + it('uses default region when none is specified', async () => { + const configWithoutRegion = new ConfigReader({ + aws: { + mainAccount: {}, + }, + }); + + const provider = + DefaultAwsCredentialsManager.fromConfig(configWithoutRegion); + const awsCredentialProvider = await provider.getCredentialProvider(); + + await awsCredentialProvider.sdkCredentialProvider(); + + expect(fromNodeProviderChain).toHaveBeenCalledWith({ + clientConfig: { + region: 'us-east-1', + }, + }); + }); }); }); From 52ae92d52532da504e043572a7c21d6faf754a18 Mon Sep 17 00:00:00 2001 From: KaemonIsland Date: Tue, 8 Oct 2024 13:18:26 -0400 Subject: [PATCH 3/6] Add changeset Signed-off-by: KaemonIsland --- .changeset/friendly-hats-push.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/friendly-hats-push.md diff --git a/.changeset/friendly-hats-push.md b/.changeset/friendly-hats-push.md new file mode 100644 index 0000000000..e730fcbf8c --- /dev/null +++ b/.changeset/friendly-hats-push.md @@ -0,0 +1,5 @@ +--- +'@backstage/integration-aws-node': patch +--- + +The `getDefaultCredentialsChain` function now accepts and applies a `region` parameter, preventing it from defaulting to `us-east-1` when no region is specified. From aa21f6ef6c809544872220b906ed97380642c997 Mon Sep 17 00:00:00 2001 From: KaemonIsland Date: Tue, 8 Oct 2024 13:44:15 -0400 Subject: [PATCH 4/6] Update unit tests Signed-off-by: KaemonIsland --- .../src/DefaultAwsCredentialsManager.test.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts index ed61f45199..4f57cb2db1 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts @@ -135,12 +135,12 @@ describe('DefaultAwsCredentialsManager', () => { }, }); + const testDate = new Date('2022-01-10'); + process.env.AWS_ACCESS_KEY_ID = 'ACCESS_KEY_ID_10'; process.env.AWS_SECRET_ACCESS_KEY = 'SECRET_ACCESS_KEY_10'; process.env.AWS_SESSION_TOKEN = 'SESSION_TOKEN_10'; - process.env.AWS_CREDENTIAL_EXPIRATION = new Date( - '2022-01-10', - ).toISOString(); + process.env.AWS_CREDENTIAL_EXPIRATION = testDate.toISOString(); // Return creds from env (fromNodeProviderChain as jest.Mock).mockReturnValue(() => @@ -148,7 +148,7 @@ describe('DefaultAwsCredentialsManager', () => { accessKeyId: process.env.AWS_ACCESS_KEY_ID, secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, sessionToken: process.env.AWS_SESSION_TOKEN, - expiration: new Date(process.env.AWS_CREDENTIAL_EXPIRATION), + expiration: testDate, }), ); From 45221d9ea3e566f19da69832da0d0de25a31c515 Mon Sep 17 00:00:00 2001 From: KaemonIsland Date: Mon, 14 Oct 2024 15:21:08 -0400 Subject: [PATCH 5/6] Update unit tests for correct mocking Signed-off-by: KaemonIsland --- .../src/DefaultAwsCredentialsManager.test.ts | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts index 4f57cb2db1..d81f717a58 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.test.ts @@ -143,13 +143,8 @@ describe('DefaultAwsCredentialsManager', () => { process.env.AWS_CREDENTIAL_EXPIRATION = testDate.toISOString(); // Return creds from env - (fromNodeProviderChain as jest.Mock).mockReturnValue(() => - Promise.resolve({ - accessKeyId: process.env.AWS_ACCESS_KEY_ID, - secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, - sessionToken: process.env.AWS_SESSION_TOKEN, - expiration: testDate, - }), + (fromNodeProviderChain as jest.Mock).mockImplementation( + jest.requireActual('@aws-sdk/credential-providers').fromNodeProviderChain, ); const mockProfile = `[my-profile] From c19f109d9e79801df258aa2c49c418fe0ffaf771 Mon Sep 17 00:00:00 2001 From: KaemonIsland Date: Thu, 17 Oct 2024 10:52:49 -0400 Subject: [PATCH 6/6] Update comment Signed-off-by: KaemonIsland --- .../integration-aws-node/src/DefaultAwsCredentialsManager.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts index 2b7ae3e1e5..3048fdfe40 100644 --- a/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts +++ b/packages/integration-aws-node/src/DefaultAwsCredentialsManager.ts @@ -78,7 +78,7 @@ function getProfileCredentials( } /** - * Include the region if present, otherwise use the default region + * Include the region if present, otherwise use the default region. * * @see https://www.npmjs.com/package/@aws-sdk/credential-provider-node */