feat(runtimes): add handlers for IAM and STS credentials management #599

liramon1 · 2025-07-07T16:11:07Z

Problem

While the identity management LSP can manage SSO tokens, it lacks the types and handlers needed to manage IAM credentials. This forces IDE extensions to manage IAM credentials themselves, which adds complexity to them.

Solution

This is part of #572

To facilitate IAM credential management, this PR adds the getIamCredential handler to give IDE extensions a way to retrieve a profile's IAM credentials according to the profile's stored configurations. Each IAM-related configuration is associated with at least one of the new profile types: IamCredentialsProfile, IamSourceProfileProfile, IamCredentialSourceProfile, or IamCredentialProcessProfile. These profiles follow the specification from the AWS CLI and will be used in future language-servers PRs to retrieve IAM credentials in their respective ways.

This also adds the invalidateStsCredential and sendStsCredentialChanged handlers to manage the STS credential lifecycle after an IDE extension calls getIamCredential with a role ARN and parent credentials source inside the requested profile. This will trigger an assume role flow and output an temporary STS credential which the identity LSP will manage.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

nkomonen-amazon · 2025-07-10T15:11:58Z

runtimes/protocol/identity-management.ts

    settings?: {
        region?: string
        sso_session?: string
+        aws_access_key_id?: string


Does it make sense to separate Profile in to a "superset" type which consists of separate types SsoProfile and CredentialProfile?

Probably not if profiles can be any combination of profile types. Making these fields optional would allow the combined profile type to be decided at runtime and checked using the profile service's current duck typer.

It might still make sense to separate the settings types while keeping them optional for better readability. Right now it's hard to determine which settings are for which type of profile

I'd recommend reaching out to connorstw@ here as he is working on a related project the generate client code from an API definition for Flare. As that would be the primary consumer of this information, there may be better ways to capture it than information-only interfaces.

ctlai95 · 2025-07-10T21:55:32Z

runtimes/protocol/identity-management.ts


 // getSsoToken
-export type SsoTokenId = string // Opaque identifier
+export type CredentialId = string // Opaque identifier


This is an exported type, could this cause issues with existing clients?

Possibly, but I don't see it used in language-servers nor the VS Code, Jetbrains, and Visual Studio toolkits. To be on the safe side, we could separate it into two different IDs. Thoughts?

If not needed publicly, may be worth removing export

The intent here was to make sure code was using the declared type and not just hard-coding string all over the place. Basically all code should just be treating this as an object and not try to introspect it or use it any other way.

Then should the SSO tokens and IAM credentials use a single ID type?

They are distinct types (even though they are both currently just aliases of string) and should be kept separate.

ctlai95 · 2025-07-10T22:00:52Z

runtimes/runtimes/standalone.ts

+
+                        // Encrypt the IAM credential before sending to client
+                        if (result && !(result instanceof Error) && encryptionKey) {
+                            result.credentials = {


Can we move this logic out to a util function?

floralph · 2025-07-15T00:31:13Z

runtimes/protocol/identity-management.ts

    E_CANNOT_OVERWRITE_SSO_SESSION: 'E_CANNOT_OVERWRITE_SSO_SESSION',
    E_CANNOT_READ_SHARED_CONFIG: 'E_CANNOT_READ_SHARED_CONFIG',
    E_CANNOT_READ_SSO_CACHE: 'E_CANNOT_READ_SSO_CACHE',
+    E_CANNOT_READ_STS_CACHE: 'E_CANNOT_READ_STS_CACHE',


You should be reading and writing credentials into the shared config file ~/.aws/credentials. You should use E_CANNOT_READ_SHARED_CONFIG (and the WRITE variation) for these errors. STS is just a service to retrieve and only one way of getting IAM credentials. The naming convention here should be "IAM" instead of "STS".

According to the AWS CLI docs, credentials obtained from AssumeRole (which Flare will call if the profile contains a role_arn and some credential source) are cached in ~/.aws/cli/cache, while all other IAM credentials live in ~/.aws/credentials. Should we still only consider ~/.aws/credentials?

Good catch, I'll send you an SEP offline that goes into more detail and should be considered canon.

In that case, I think the naming convention can stay as "STS". Technically, the SEP uses the term "temporary credentials", but "STS" is more concise and distinct (and can't be confused with SSO tokens which are also temporary). The cache only stores credentials obtained from STS AssumeRole and not any other IAM credential, so an "STS" prefix fits.

floralph · 2025-07-15T00:58:21Z

runtimes/protocol/identity-management.ts

+export type ProfileKind =
+    | 'Unknown'
+    | 'SsoTokenProfile'
+    | 'IamUserProfile'


See aws/language-servers#1845 for comments on several of the names here.

floralph · 2025-07-15T01:03:17Z

runtimes/protocol/identity-management.ts

    settings?: {
        region?: string
        sso_session?: string
+        aws_access_key_id?: string


I'd recommend reaching out to connorstw@ here as he is working on a related project the generate client code from an API definition for Flare. As that would be the primary consumer of this information, there may be better ways to capture it than information-only interfaces.

floralph · 2025-07-15T01:44:33Z

runtimes/protocol/identity-management.ts

+export type IamCredentialId = string // Opaque identifier
+
+export interface GetIamCredentialOptions {
+    generateOnInvalidStsCredential?: boolean


minor nit: rename to callStsOnInvalidIamCredential

floralph · 2025-07-15T01:46:24Z

runtimes/protocol/identity-management.ts

+
+export interface GetIamCredentialResult {
+    id: IamCredentialId
+    credentials: IamCredentials


Was encrypting these in-flight considered or discussed with AppSec similar to SSO tokens?

The credentials are encrypted in-flight using this code, but I have not discussed this with AppSec.

Yep, trying to recall the reasoning for the additional encryption for SSO tokens, but this is fine for now.

floralph · 2025-07-15T01:48:37Z

runtimes/protocol/identity-management.ts

+    code: string
+}
+
+export const getMfaCodeRequestType = new ProtocolRequestType<


How does this work?

In this PR, the identityService will request an MFA code from the language client if getIamCredential needs to call AssumeRole and the parent credentials' permission to assume roles is locked behind MFA. This assumes the language clients will implement a handler for getMfaCode.

Thanks, I'll review in more detail in that PR when it is posted.

floralph · 2025-07-15T01:51:58Z

runtimes/protocol/identity-management.ts

+    // Intentionally left blank
+}
+
+export const invalidateStsCredentialRequestType = new ProtocolRequestType<


What is the plan for implementing this (i.e. what API(s) will you call)?

In this PR, invalidateStsCredential will delete the credential from the cache folder using fs unlink.

Thanks, I'll review in more detail in that PR when it is posted.

floralph · 2025-07-15T01:54:11Z

runtimes/protocol/identity-management.ts

+    stsCredentialId: IamCredentialId
+}
+
+export const stsCredentialChangedRequestType = new ProtocolNotificationType<StsCredentialChangedParams, void>(


What is the implementation plan for this?

In this PR, stsCredentialChanged will be used similarly to ssoTokenChanged. It will fire a notification whenever an IAM credential obtained from AssumedRole is refreshed.

Thanks, I'll review in more detail in that PR when it is posted.

feat(runtimes): add support for IAM and STS credentials management

22f77b0

liramon1 requested a review from a team as a code owner July 7, 2025 16:11

liramon1 changed the title ~~feat(runtimes): add support for IAM and STS credentials management~~ feat(runtimes): add handlers for IAM and STS credentials management Jul 7, 2025

chore: undo unnecessary changes

d9c4753

liramon1 mentioned this pull request Jul 7, 2025

feat: add support for IAM profiles and credentials management #572

Closed

fix: re-add IamCredentials change

db626ab

This was referenced Jul 8, 2025

feat(identity): add support for IAM profile management aws/language-servers#1845

Merged

feat(identity): add STS credential management aws/language-servers#1846

Merged

chore: revert EmptyProfile change

306c2b0

nkomonen-amazon reviewed Jul 10, 2025

View reviewed changes

liramon1 added 3 commits July 10, 2025 14:10

refactor: split IamCredentialProfile into multiple profiles

fbfb2d6

chore: revert comment

56fc78a

feat: add mfaCode to getIamCredentialParams

939241b

ctlai95 reviewed Jul 10, 2025

View reviewed changes

liramon1 added 3 commits July 10, 2025 18:11

refactor: prefix IAM-related profiles with 'Iam'

52b509b

refactor: move encryption into separate function and split credential id

d38dbb7

feat: add external_id field to profile

8adfdee

ctlai95 approved these changes Jul 11, 2025

View reviewed changes

nkomonen-amazon approved these changes Jul 11, 2025

View reviewed changes

liramon1 added 3 commits July 14, 2025 10:54

feat: optionalize permission validation in GetIamCredentialOptions

bb6d6a2

refactor: move MFA code retrieval into separate request

7dc451c

fix: add parameters to mfa request

38961c9

floralph reviewed Jul 15, 2025

View reviewed changes

fix: naming changes

7948b97

floralph approved these changes Jul 16, 2025

View reviewed changes

liramon1 merged commit 6276983 into aws:main Jul 17, 2025
4 checks passed

github-actions bot mentioned this pull request Jul 17, 2025

chore(release): release packages from branch main #622

Merged

feat(runtimes): add handlers for IAM and STS credentials management #599

feat(runtimes): add handlers for IAM and STS credentials management #599

Uh oh!

Conversation

liramon1 commented Jul 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

License

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

liramon1 commented Jul 7, 2025 •

edited

Loading

liramon1 Jul 15, 2025 •

edited

Loading

liramon1 Jul 16, 2025 •

edited

Loading

liramon1 Jul 15, 2025 •

edited

Loading