Merge master into feature/v2-to-v3-migration - #8733
Open
aws-toolkit-automation wants to merge 357 commits into
Open
aws-toolkit-automation wants to merge 357 commits into
aws-toolkit-automation wants to merge 357 commits into
Conversation
feat(smus): Adding SMUS RAIN milestone 1 changes to new staging branch
feat(ec2): add tag-based filtering to EC2 explorer node
Merge pull request from staging
fix(smus): Add check for sessionName field for space filtering in addition to principalId.
Merge staging into smus-rain-m1
…ne-1 Auto merge/feature/smus rain milestone 1
fix(smus): Fallback for user profiles and domain type telemetry
…/feature/smus-rain-milestone-1
…ne-1 Auto merge/feature/smus rain milestone 1
build(amazonq): merge release candidate version rc-20260415
Re-adds the pending console sign-in marker so IAM console login resumes to domain selection after the credential-cache window reload, without touching the shared credential provider.
feat(smus): Add console-based IAM profile login option
…n-name-exact-match fix(smus): Use exact match for DataZone session-name resolution
build(amazonq): merge release candidate version rc-20260805
…5.0 (#8851) Bumps @aws-sdk/credential-providers from ^3.936.0 to ^3.975.0 and @aws-sdk/client-eks from ^3.583.0 to ^3.975.0 to pick up the credential-provider-login cache fix that resolves stale SSO token issues. Also adds NormalModuleReplacementPlugin to the web webpack config to strip `node:` prefixes from imports (required by the newer SDK), and adds `util: false` and `http2: false` to resolve.fallback to prevent bundling Node-only modules in the web build. ## Problem The SDK credential provider cached `aws login` tokens in an in-memory module cache. After caching it here, the SDK would never check disk again. However, external console login, such as through the toolkit, overwrites what's on disk but not what's in the SDK's cache. This meant that if the SDK couldn't refresh it's in-memory token, and you subsequently did a console login, the SDK would be stuck trying to refresh the old credentials instead of using your fresh ones. ## Solution The SDK updated their provider to always read the token through disk. This PR includes the corresponding dependency updates. --- - Treat all work as PUBLIC. Private `feature/x` branches will not be squash-merged at release time. - Your code changes must meet the guidelines in [CONTRIBUTING.md](https://github.com/aws/aws-toolkit-vscode/blob/master/CONTRIBUTING.md#guidelines). - License: I confirm that my contribution is made under the terms of the Apache 2.0 license.
## Problem SMUS projects can use custom blueprints in the tooling slot. These blueprints have arbitrary names so the current resolution path for `ListEnvironmentBlueprints(name="Tooling")` → match blueprint → `ListEnvironments(blueprintId)` returns no results and tooling environment lookup silently fails. Additionally, custom blueprints may not provision a SageMaker domain at all, causing unhandled `Error` throws that crash the spaces tree. ## Solution Resolve the tooling environment via the IAM connection's `environmentId` rather than blueprint name lookup. The IAM connection (`project.iam` for IdC domains, `default.iam` for IAM domains) always references the tooling environment regardless of the underlying blueprint name. Call `GetEnvironment` with that ID to retrieve the full environment details. Secondary changes: - Tolerate missing `sageMakerDomainId` in provisioned resources by catching `NoSageMakerDomain` / `RegionNotFound` error codes and rendering a no spaces found tree node instead of crashing the tree - Replace bare `Error` throws to `ToolkitError` with structured codes (`NoSageMakerDomain`, `RegionNotFound`) for clean programmatic catch handling - Simplify `isExpressDomain`: presence of `default.iam` is authoritative for IAM domains, removing the extra `ListEnvironmentBlueprints(name="ToolingLite")` + `getEnvironmentDetails` verification - Add `notSet` fallback in space telemetry when `awsAccountRegion` is undefined (previously threw inside the telemetry span) ## Testing **Unit tests** (added/updated in `datazoneClient.test.ts`, `smusUtils.test.ts`, `sageMakerUnifiedStudioSpacesParentNode.test.ts`): - Tooling environment resolves via a custom blueprint (no managed `Tooling`/`ToolingLite` name) through the `default.iam` connection - Returns `undefined` when no IAM connection exists, and when the IAM connection has no `environmentId` - `getEnvironment` failure surfaces as a `ToolkitError` (`ToolingEnvironmentError`) - Missing `sageMakerDomainId` (`NoSageMakerDomain`) and missing region (`RegionNotFound`) both render the standard `[No Spaces found]` node instead of throwing - `isExpressDomain` returns `true` for a migrated domain (both `default.iam` + `project.iam`) and `false` when only `project.iam` exists (IdC domain) **Manual testing:** Verified end-to-end, including space connection, against both an IAM domain and an IdC domain (managed-blueprint prod domains) - login, project listing, tree expansion (Data Explorer + Compute), spaces listing, and connecting to a space all succeed with no regression. - validated end-to-end space connection against a gamma domain with a full-capabilities custom tooling project - validated that a custom tooling project with no provisioned SageMaker domain shows a no spaces found tree node ## Custom tooling project with full capabilities https://github.com/user-attachments/assets/86e82052-31d8-479a-98e0-82022ae3e42e ## Custom tooling project with no provisioned SageMaker domain <img width="521" height="189" alt="Screenshot 2026-08-14 at 2 43 00 PM" src="https://github.com/user-attachments/assets/b3ff1961-0ab0-45bf-a368-a6af3060120e" />
…lution getToolingEnvironmentForProject called GetEnvironment using the client's own credentials. On the SSO + IAM domain path those are scoped-down admin creds that lack datazone:GetEnvironment, so the call fails with AccessDenied and the Spaces tree fails to render. The call is also redundant: the only caller reads the environment id, and the downstream getEnvironmentDetails() fetches project credentials before calling GetEnvironment. Resolve the tooling environment id directly from the IAM connection and drop the extra call. Add a regression test asserting getEnvironment is not called.
…-permission fix(smus): Remove redundant GetEnvironment call from tooling env resolution
## Problem The repo has a stray `.changes/next-release/` directory at the root with 9 changelog entries in it. These files do nothing: the release tooling (`createRelease.ts`) only reads the per-package directories like `packages/toolkit/.changes/next-release/`, so entries at the root are never included in any release's CHANGELOG. They end up there by accident when someone runs `npm run newChange` from the repo root instead of `npm run newChange -w packages/toolkit`. The script writes to `.changes/next-release/` relative to the current directory, so running it from the root silently drops the entry in the wrong place. All 9 entries describe changes that already shipped — their changelog notes just never made it into the release notes. ## Solution Delete the root-level `.changes/next-release/` directory. This is the same cleanup that was done in #4893. Note for contributors: always use the workspace flag when creating changelog entries, e.g. `npm run newChange -w packages/toolkit`. --- - Treat all work as PUBLIC. Private `feature/x` branches will not be squash-merged at release time. - Your code changes must meet the guidelines in [CONTRIBUTING.md](https://github.com/aws/aws-toolkit-vscode/blob/master/CONTRIBUTING.md#guidelines). - License: I confirm that my contribution is made under the terms of the Apache 2.0 license.
## Problem When multiple user profiles exist for the same IAM role ARN (e.g., one DEACTIVATED and one ACTIVATED), only return the profile with ACTIVATED status. This situation happens when the role was deleted and created again. Previously the code would return whichever matched the session name first, which could be a deactivated profile. ## Test - the spaces are shown correctly for the IAM role session <img width="678" height="591" alt="Screenshot 2026-08-18 at 11 27 25 AM" src="https://github.com/user-attachments/assets/2f7c88ef-1554-4bf9-9d47-4697558cfd24" />
## Problem When a SMUS deeplink SSH/SSM tunnel drops, the one-time session bundle is dead and the toolkit has no credentials to call `StartSession` itself. Unlike SageMaker AI connections which already support browser-based session refresh, SMUS deeplink connections cannot recover. The user must manually reconnect from the portal. ## Solution Enable auto-refresh for SMUS deeplink connections by reusing the browser as the session-minting authority, mirroring the pattern already shipped for SageMaker AI. On tunnel drop, the detached server opens the SMUS portal with reconnect params. The portal calls `StartSession` using the browser's existing DataZone auth context and delivers a fresh bundle back to a localhost callback. Key changes: - New `reconnect_base_url` parameter from the initial deeplink connection for SMUS - Thread `reconnect_base_url` from the deeplink URI through to `persistSSMConnection`, so SMUS connections get a `refreshUrl` in their persisted mapping - Add DevSettings gate (default off) so these changes in the Toolkit will not affect customers yet. This PR is dependent on changes to the SMUS portal. - Branch reconnect URL construction in `getSessionAsync.ts`: SMUS sends `reconnect_callback_port` only (Maxdome WAF blocks full localhost URLs in query strings); SM-AI keeps `reconnect_callback_url` ## Verification - Unit tests for metadata threading, `isSMUS` branching, refresh URL construction, session store reads, and URI handler param parsing - Manually confirmed SM-AI deeplink + refresh flow unaffected - Manually confirmed SMUS deeplink + refresh flow works --- - Treat all work as PUBLIC. Private `feature/x` branches will not be squash-merged at release time. - Your code changes must meet the guidelines in [CONTRIBUTING.md](https://github.com/aws/aws-toolkit-vscode/blob/master/CONTRIBUTING.md#guidelines). - License: I confirm that my contribution is made under the terms of the Apache 2.0 license.
#8857) This merges the released changes for rc-20260819 into main. MCM-157242080 --------- Co-authored-by: aws-toolkit-automation <>
…nding fix(sagemaker): resolve IdC user profiles via SSO binding
…edirect feat(sagemaker): detect IdC domains and redirect to Studio UI for remote connect
build(amazonq): merge release candidate version rc-20260826
The StackOutputsWebviewProvider rendered CloudFormation API-returned values directly into webview HTML via template-literal interpolation with no sanitization. A malicious stack output value (e.g. an <svg onload=...> payload) would execute as script when a user viewed the stack's outputs, escalating to RCE and AWS credential theft in browser-based VS Code environments such as SageMaker Code Editor. Changes to stackOutputsWebviewProvider.ts: - HTML-encode every API-returned value before interpolation using the existing encodeHTML() utility: OutputKey, OutputValue, Description, ExportName, the stackName header, and error messages (renderError). - Add a restrictive Content-Security-Policy meta tag (default-src 'none'; style-src 'unsafe-inline') to both the outputs view and the error view as defense-in-depth, blocking all script execution even if an encoding gap is reintroduced. - The AWS Console link href was already safe (arnToConsoleTabUrl wraps the ARN with encodeURIComponent), so it is left unchanged. Changes to stackOutputsWebviewProvider.test.ts: - Add regression tests asserting malicious OutputKey/OutputValue/Description/ ExportName, stackName, and error messages are entity-encoded and never emitted as raw markup, plus a test asserting the restrictive CSP is present. Fixes GHSA-8hmf-jv79-54f4
fix(cloudformation): prevent XSS in stack outputs webview
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automatic merge failed
Command line hint
To perform the merge from the command line, you could do something like the following (where "origin" is the name of the remote in your local git repo):