Add modular AWS credential resolution by mtdowling · Pull Request #1172 · smithy-lang/smithy-java

mtdowling · 2026-05-07T22:43:04Z

Add modular credential chain with pluggable provider discovery

Adds a modular AWS credential provider chain that separates credential detection from resolution, enabling independent artifact composition.

New modules:

aws-config: SEP-conformant INI parser, AwsProfileFile, AwsProfile, AwsConfigCredentialSource sealed types. Standalone module with no chain dependency.
aws-credential-chain: CredentialChain, ChainIdentityProvider SPI, ChainSetup, StandardProvider enum with expanded profile-source slots, OrderingConstraint (Standard/Before/After), SharedConfigProvider, StaticKeysHandler, SessionKeysHandler, CredentialProcessHandler.
aws-credentials-imds: IMDSv2 credential provider with static stability, extended/legacy API fallback, config-based disable.

Changes to existing modules:

auth-api: Add CachingIdentityResolver with async background refresh, static stability, injectable Clock/ScheduledExecutorService. Add invalidate() default method to IdentityResolver.
aws-client-core: Add AwsCredentialChainPlugin, auth-failure interceptor, EnvironmentCredentialProvider and
SystemPropertiesCredentialProvider (both terminal — stop chain assembly when credentials are present).
settings.gradle.kts: Include new modules.

Architecture:

One interface (ChainIdentityProvider), one SPI, void create() method.
Providers are sorted by ordering() then called in order with a shared mutable ChainSetup. They call setup.addResolver() to register, or setup.addTerminalResolver() to register and stop assembly.
StandardProvider enum encodes the full chain precedence including per-profile-source slots, matching the Credentials Provider Chain Search Precedence SEP exactly.
SharedConfigProvider parses config files and sets profile on setup; downstream profile providers read from setup.profile().
Terminal resolvers short-circuit assembly (env vars set → config never parsed, IMDS never created).
Actionable errors name the missing module when a source is detected but no provider claims its slot.
CachingIdentityResolver provides background refresh; invalidate() propagates through the chain to clear caches on auth failures.

TODO: STS, SSO, ECS, Login providers.

Example usage:

// build.gradle.kts
dependencies {
    implementation("software.amazon.smithy.java:aws-client-core:1.1.0")
    implementation("software.amazon.smithy.java:aws-credential-chain:1.1.0")
    implementation("software.amazon.smithy.java:aws-credentials-imds:1.1.0")
}

var client = CoffeeShopClient.builder()
        .addPlugin(new AwsCredentialChainPlugin())
        .build();

Credentials resolve automatically in order:

JVM system properties (aws.accessKeyId) — terminal
Environment variables (AWS_ACCESS_KEY_ID) — terminal
Config file static/session keys — terminal
Config file credential_process
EC2 IMDS (if aws-credentials-imds is added)

On Lambda, only aws-client-core is needed (env vars are terminal, nothing else is constructed):

dependencies {
    implementation("software.amazon.smithy.java:aws-client-core:1.1.0")
    implementation("software.amazon.smithy.java:aws-credential-chain:1.1.0")
}

Adds support for loading AWS credentials from shared config/credentials files and assembling them into a pluggable credential provider chain. New modules: - aws-config: SEP-conformant INI parser, profile data model, AwsConfigCredentialSource sealed types, handler SPI with ServiceLoader discovery, and built-in handlers for static keys, session keys, and credential_process. - aws-credential-chain: Credential provider chain with builtin slots, Before/After relative ordering, SPI-based provider discovery, cheap environment detection, and actionable error messages when implementation modules are missing. Changes to existing modules: - auth-api: Add CachingIdentityResolver with async background refresh, static stability support, injectable Clock and ScheduledExecutorService. Add invalidate() default method to IdentityResolver interface. Will be used by STS, SSO, etc. - aws-client-core: Add AwsCredentialChainPlugin ClientPlugin, register EnvironmentCredentialProvider and SystemPropertiesCredentialProvider as chain sources via SPI. Both now read AWS_ACCOUNT_ID / aws.accountId per the account ID SEP. - settings.gradle.kts: Include new modules. Architecture overview: - Data model (aws-config) is separated from resolution policy (chain). - Credential sources are detected cheaply from profile properties without needing implementation modules (STS, SSO, IMDS). - Handlers are discovered via ServiceLoader; missing handlers produce errors naming the dependency to add. - Chain ordering uses a fixed enum for builtins and simple Before/After insertion for third-party providers. - CachingIdentityResolver provides background refresh with a shared ScheduledExecutorService passed via ProviderContext. - invalidate() propagates through the chain to force credential refresh on auth failures. TODO items: add SSO, STS, IMDS, ECS, etc.

Allowing custom provider relative positioning around only builtins simplifies the design, removes the possibility of cycles, and removes the need for a topo sort. Also removing aliases.

Automatically add credential chain runtime plugin if AWS auth is used.

Reduces chain to a single, flat chain of fixed slots, including config based credentials.

sugmanue · 2026-05-18T23:59:47Z

+        StringBuilder missing = new StringBuilder();
+        for (var i = 0; i < errors.size(); i += 2) {
+            if (i > 0) {
+                errors.add("; ");


Suggested change

errors.add("; ");

missing.append("; ");

sugmanue · 2026-05-19T00:16:53Z

+ * Fuzz test for the AWS config file parser. Ensures no input can cause unexpected exceptions,
+ * OOM, or infinite loops. The only acceptable exception is {@link ConfigFileParseException}.


Nits

Suggested change

* Fuzz test for the AWS config file parser. Ensures no input can cause unexpected exceptions,

* OOM, or infinite loops. The only acceptable exception is {@link ConfigFileParseException}.

* Fuzz test for the AWS config file parser. Helps detect when an input causes unexpected exceptions,

* OOM, or infinite loops. The only acceptable exception is {@link ConfigFileParseException}.

sugmanue · 2026-05-19T00:39:58Z

+            String session = p.get("sso_session");
+            String account = p.get("sso_account_id");
+            String role = p.get("sso_role_name");
+            if (session == null || session.isEmpty()


Nit, a isNullOrEmpty helper will help reading this code.

sugmanue · 2026-05-19T00:45:54Z

+            String homeDrive = envGetter.apply("HOMEDRIVE");
+            String homePath = envGetter.apply("HOMEPATH");
+            if (homeDrive != null && !homeDrive.isEmpty() && homePath != null && !homePath.isEmpty()) {
+                return Paths.get(homeDrive + homePath);


I have no idea how windows work but this feels better.

Suggested change

return Paths.get(homeDrive + homePath);

return Paths.get(homeDrive).resolve(homePath);

sugmanue · 2026-05-19T00:57:55Z

+    }
+
+    private static java.util.Set<String> profileNameSet(AwsProfileFile file) {
+        java.util.Set<String> names = new java.util.LinkedHashSet<>();


Nit, replace FQN with import.

sugmanue · 2026-05-19T01:01:25Z

+    }
+
+    private static List<String> buildCommand(String commandLine) {
+        if (System.getProperty("os.name", "").toLowerCase(Locale.ROOT).contains("windows")) {


Nit, consider adding a helper to detect windows.

sugmanue · 2026-05-19T01:06:30Z

+ * <pre>{@code
+ * var chain = CredentialChain.create();
+ * var result = chain.resolveIdentity(Context.empty());
+ * }</pre>


Suggested change

* <pre>{@code

* var chain = CredentialChain.create();

* var result = chain.resolveIdentity(Context.empty());

* }</pre>

* {@snippet lang="java" :

* var chain = CredentialChain.create();

* var result = chain.resolveIdentity(Context.empty());

* }

sugmanue · 2026-05-19T01:10:45Z

+
+Services modeled with `@aws.auth#sigv4` or `@aws.auth#sigv4a` automatically get
+`AwsCredentialChainPlugin` added as a default plugin during code generation.
+No manual wiring needed - just add the provider modules you need to your


sugmanue · 2026-05-19T01:16:00Z

+    static final ShapeId STS_SERVICE = ShapeId.from("com.amazonaws.sts#AWSSecurityTokenServiceV20110615");
+
+    private static final String STS_VERSION = "2011-06-15";
+    private static final String DEFAULT_ENDPOINT = "https://sts.amazonaws.com";


Don't we need to support regional endpoints declared in env or profile? See here

sugmanue · 2026-05-19T01:19:40Z

+ * <pre>{@code
+ * MyClient.builder()
+ *     .addPlugin(new AwsCredentialChainPlugin())
+ *     .build();
+ * }</pre>


Suggested change

* <pre>{@code

* MyClient.builder()

* .addPlugin(new AwsCredentialChainPlugin())

* .build();

* }</pre>

* {@snippet lang="java" :

* MyClient.builder()

* .addPlugin(new AwsCredentialChainPlugin())

* .build();

* }

mtdowling force-pushed the aws-auth branch from f43de03 to b0e6192 Compare May 8, 2026 14:52

mtdowling added 8 commits May 11, 2026 15:59

Ensure config credentials are cached

b03d712

Add support for IMDS

ad97df2

Allow only relative positioning with builtins

a4e1e28

Allowing custom provider relative positioning around only builtins simplifies the design, removes the possibility of cycles, and removes the need for a topo sort. Also removing aliases.

Add support for feature IDs to chain

7c23247

Invalidate identity resolver on stale error

bf154de

Add credential chain codegen plugin

9a4acf8

Automatically add credential chain runtime plugin if AWS auth is used.

Add READMEs for new credential packages

3fae9c4

mtdowling force-pushed the aws-auth branch from c7e4fbe to 3fae9c4 Compare May 11, 2026 20:59

mtdowling marked this pull request as draft May 12, 2026 14:59

Make chain and handlers generic over identity type

96d40cc

mtdowling marked this pull request as ready for review May 12, 2026 19:54

mtdowling added 2 commits May 12, 2026 16:39

Rename Builtin to StandardProvider

a6b0acc

Move config into chain to simplify

4ce3708

Reduces chain to a single, flat chain of fixed slots, including config based credentials.

mtdowling force-pushed the aws-auth branch from 5444200 to 4ce3708 Compare May 13, 2026 22:16

mtdowling added 2 commits May 14, 2026 11:47

Add mutable ChainSetup

ad20b04

Add tests; rename create to setup; cleanup

81ec35e

sugmanue reviewed May 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add modular AWS credential resolution#1172

Add modular AWS credential resolution#1172
mtdowling wants to merge 13 commits into
mainfrom
aws-auth

mtdowling commented May 7, 2026 •

edited

Loading

Uh oh!

sugmanue May 18, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

sugmanue May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		* Fuzz test for the AWS config file parser. Ensures no input can cause unexpected exceptions,
		* OOM, or infinite loops. The only acceptable exception is {@link ConfigFileParseException}.

	return Paths.get(homeDrive + homePath);
	return Paths.get(homeDrive).resolve(homePath);

Conversation

mtdowling commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mtdowling commented May 7, 2026 •

edited

Loading