feat(identity): add support for IAM profile management #1845

liramon1 · 2025-07-08T13:43:18Z

Problem

The identity LSP does not support saving and loading IAM profiles. This forces IDE extensions to manage their own IAM profiles, which leads to code duplication and added complexity.

Solution

This is part of #1981.

This PR introduces 4 new IAM-related profile types that aim to be compliant with the AWS CLI: IamCredentialsProfile, IamSourceProfileProfile, IamCredentialSourceProfile, and IamCredentialProcessProfile. The identity LSP has been modified to save and load these new profile types, in addition to the SsoTokenProfile, from the shared config files. These changes lay the groundwork for retrieving IAM credentials in the next few PRs, since language clients can update profile fields to specify how to obtain IAM credentials.

Note: This PR currently fails the CI pipeline because it depends on changes from aws/language-server-runtimes#599.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

floralph · 2025-07-15T00:55:20Z

server/aws-lsp-identity/src/language-server/profiles/profileService.ts

+        optional: [ProfileFields.region],
+        disallowed: [ProfileFields.sso_account_id, ProfileFields.sso_role_name],
+    },
+    IamUserProfile: {


The terminology specified in the AWS CLI and SDK and Tools public docs is generally "short-term"/"temporary" credentials (when containing a aws_session_token) or "long-term" credentials (when not). Either way they're just "IAM credentials". The short-term credentials can only represent roles, not users. The long-term can represent both. I think storing both long-term and short-term in the same type with an optional aws_session_token is fine, but the name should probably be IamCredentialsProfile.

floralph · 2025-07-15T00:57:46Z

server/aws-lsp-identity/src/language-server/profiles/profileService.ts

+        ],
+        disallowed: [ProfileFields.credential_source],
+    },
+    IamRoleInstanceProfile: {


Since this type of profile can be used for containers as well and to be consistent with IamRoleSourceProfile naming, I would suggest renaming this to IamRoleCredentialSourceProfile (clearly indicating that the credential_source field is being used instead of the source_profile field.

I'd also suggest dropping the Role designation. While roles are more commonly used these days and users aren't supported with some types of profiles, profiles (aside from SSO token profiles) result in just IAM credentials, whether they were generated from a role or user is generally inconsequential.

floralph · 2025-07-15T01:09:24Z

server/aws-lsp-identity/src/language-server/profiles/profileService.ts

+        optional: [ProfileFields.external_id, ProfileFields.role_session_name, ProfileFields.region],
+        disallowed: [ProfileFields.source_profile],
+    },
+    IamProcessProfile: {


For conistent naming, use IamCredentialProcessProfile.

floralph · 2025-07-15T01:25:22Z

server/aws-lsp-identity/src/language-server/profiles/profileService.ts

        this.throwOnInvalidProfile(!params.profile, 'Profile required.')
        const profile = params.profile!

+        // Removing this check for profile deletion


What does this comment mean in this context? Is it supposed to be here?

Also, nothing to do with your PR, but seems like the original code here might've been written before the DuckTypers as this seems to be redundant with what it does. Consider adding a // TODO Can this be refactored and simplified using the existing DuckTypers? here. Don't worry about looking it any further for this project though.

My bad, that comment was supposed to be removed. It was in reference to using updateProfile to invalidate credential fields. The plan now is to allow language clients to invalidate credential fields by calling updateProfile with an Unknown profile kind. Note that they cannot invalidate using the IAM profile kinds because the credential fields must be non-null for their duck typers to pass.

floralph · 2025-07-15T01:31:10Z

server/aws-lsp-identity/src/language-server/profiles/sharedConfigProfileStore.ts

+                            const relevantFields = [...fields.required, ...fields.optional]
+                            for (const field of relevantFields) {
+                                if (settings[field] !== undefined) {
+                                    profile.settings![field] = settings[field]


Did TS required the ! after settings given it's explicitly defined in line 53 above?

Yes TS still requires ! . I think it's because the settings field is optional in the Profile interface definition.

floralph · 2025-07-15T01:37:20Z

core/aws-lsp-core/src/credentials/credentialsProvider.ts

    accessKeyId: string
    secretAccessKey: string
    sessionToken?: string
+    expiration?: Date


How is this field used?

My bad, this PoC version of IamCredentials isn't used. I confused it with this. The expiration field on the runtimes IamCredentials is used in this PR to ease conversions to/from StsCredential (analogous to SSOToken from the SSO cache) and decide when to refresh the credential.

* test: codecov integration * add coverage script for chat-client and lsp core * add c8 configs * use js files for coverage

* feat: add conversation compaction * fix: address comments * fix: add unit tests * fix: fix unit tests

…s#1912) * fix: use document change events for auto trigger classifier input * fix: improve readability

* fix: add active user tracker and emit metrics * fix: add time window state persistence across IDE restarts * fix: lint

* fix: align auto trigger classifier with documentChangeEvent * fix: add unit test

…ality (aws#1908)

* fix(amazonq): replacing image's large binary in log * fix(amazonq): replacing image's large binary in log

…ws#1915)

…on notification (aws#1904)

* fix: treat `echo`/`find`/`grep` as mutating as discussed in internal channels * tst

…1887)

…1922)

…o iam-profile

…ws#1924)

* chore(release): release packages from branch main * build: add missing packagelock file (aws#1927) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Will Lo <[email protected]>

codecov-commenter · 2025-07-18T15:35:29Z

Codecov Report

❌ Patch coverage is 77.65326% with 339 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (feature/flare-iam-base@99d2f70). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...nguage-server/agenticChat/agenticChatController.ts	54.48%	264 Missing ⚠️
chat-client/src/client/mynahUi.ts	17.39%	19 Missing ⚠️
...ge-server/inline-completion/codeWhispererServer.ts	56.09%	17 Missing and 1 partial ⚠️
...-lsp-codewhisperer/src/shared/activeUserTracker.ts	93.19%	12 Missing and 1 partial ⚠️
...language-server/agenticChat/tools/chatDb/chatDb.ts	92.18%	10 Missing ⚠️
core/aws-lsp-core/src/util/processUtils.ts	80.76%	5 Missing ⚠️
...r/agenticChat/context/additionalContextProvider.ts	92.68%	3 Missing ⚠️
...r/agenticChat/context/agenticChatTriggerContext.ts	97.36%	1 Missing ⚠️
...ver/agenticChat/context/contextCommandsProvider.ts	50.00%	1 Missing ⚠️
.../language-server/agenticChat/qAgenticChatServer.ts	66.66%	1 Missing ⚠️
... and 4 more

Additional details and impacted files

@@                    Coverage Diff                    @@
##             feature/flare-iam-base    #1845   +/-   ##
=========================================================
  Coverage                          ?   65.96%           
=========================================================
  Files                             ?      238           
  Lines                             ?    50623           
  Branches                          ?     3385           
=========================================================
  Hits                              ?    33393           
  Misses                            ?    17170           
  Partials                          ?       60

Flag	Coverage Δ
unittests	`65.96% <77.65%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The identity LSP was changed to load and save IAM profile kinds.

liramon1 requested a review from a team as a code owner July 8, 2025 13:43

This was referenced Jul 8, 2025

feat(identity): add STS credential management #1846

Merged

feat: add support for IAM/STS credentials management #1685

Closed

liramon1 marked this pull request as draft July 9, 2025 19:51

feat(identity): add support for IAM profile kinds

64e2915

liramon1 force-pushed the iam-profile branch from a8d7afd to 64e2915 Compare July 10, 2025 20:55

refactor: prefix IAM-related profiles with 'Iam'

4d11e05

liramon1 mentioned this pull request Jul 10, 2025

feat(identity): add support for retrieving IAM user credentials #1869

Merged

liramon1 added 2 commits July 11, 2025 11:55

refactor: move profile fields into profileTypes object

473af32

fix: add region as optional field to IamRoleSourceProfile

ea715af

liramon1 marked this pull request as ready for review July 11, 2025 18:42

floralph mentioned this pull request Jul 15, 2025

feat(runtimes): add handlers for IAM and STS credentials management aws/language-server-runtimes#599

Merged

floralph reviewed Jul 15, 2025

View reviewed changes

liramon1 added 2 commits July 15, 2025 14:57

fix: naming changes

354568e

chore: rename profile in unit test title

9530ae4

liramon1 mentioned this pull request Jul 16, 2025

feat(identity): add support for retrieving IAM user credentials liramon1/language-servers#1

Closed

liramon1 changed the base branch from main to liramon/flare-iam July 16, 2025 18:50

liramon1 deleted the branch aws:feature/flare-iam-base July 16, 2025 18:57

liramon1 closed this Jul 16, 2025

liramon1 reopened this Jul 16, 2025

liramon1 changed the base branch from liramon/flare-iam to feature/flare-iam-base July 16, 2025 19:00

liramon1 force-pushed the iam-profile branch from c6737f1 to 9530ae4 Compare July 16, 2025 19:11

ctlai95 and others added 3 commits July 16, 2025 12:33

test: codecov integration (aws#1896)

a8816e2

* test: codecov integration * add coverage script for chat-client and lsp core * add c8 configs * use js files for coverage

feat: add conversation compaction (aws#1895)

8bb7144

* feat: add conversation compaction * fix: address comments * fix: add unit tests * fix: fix unit tests

feat: adding streakLength back to UTDE telemetry (aws#1902)

152f1c5

floralph approved these changes Jul 16, 2025

View reviewed changes

tsmithsz and others added 4 commits July 16, 2025 14:32

fix: add proper encoding support for shell output (aws#1903)

44a6d62

fix: use document change events for auto trigger classifier input (aw…

2204da6

…s#1912) * fix: use document change events for auto trigger classifier input * fix: improve readability

fix: remove disclaimer message (aws#1884)

0845eed

test(chat-client): add unit tests (aws#1913)

a2e369b

Will-ShaoHua and others added 17 commits July 16, 2025 16:22

chore(amazonq): add inline completion debug log (aws#1906)

8190ba5

feat: add active user tracking with state persistence (aws#1892)

a5587c5

* fix: add active user tracker and emit metrics * fix: add time window state persistence across IDE restarts * fix: lint

fix: align auto trigger classifier with documentChangeEvent (aws#1914)

f308e17

* fix: align auto trigger classifier with documentChangeEvent * fix: add unit test

refactor(amazonq): moved string constants to a const file for code qu…

1c64d72

…ality (aws#1908)

fix(amazonq): replacing image's large binary in log (aws#1905)

a06ed62

* fix(amazonq): replacing image's large binary in log * fix(amazonq): replacing image's large binary in log

fix: should trigger edits if one of the following lines is non-empty (a…

b298602

…ws#1915)

fix(amazonq): change to use promptStickyCard to show image verificati…

caaefef

…on notification (aws#1904)

fix: treat echo/find/grep as mutating (aws#1921)

ef801a3

* fix: treat `echo`/`find`/`grep` as mutating as discussed in internal channels * tst

fix: pinned @Code symbols do not persist between IDE sessions (aws#…

b5c715f

…1887)

fix: replace thinking with working and replace stop with cancel (aws#…

371e731

…1922)

chore: bump language-server-runtimes version

4fce84c

Merge remote-tracking branch 'remotes/aws/feature/flare-iam-base' int…

bb6ddc5

…o iam-profile

fix: editor state does not use the same language id as file context (a…

c10866d

…ws#1924)

build: bump runtime to 0.2.112 (aws#1926)

7f6d100

build: aws/lsp-core (aws#1928)

4069938

Merge remote-tracking branch 'aws/main' into iam-profile

524a686

liramon1 merged commit 1491f4f into aws:feature/flare-iam-base Jul 18, 2025
5 checks passed

liramon1 mentioned this pull request Jul 18, 2025

feat: add IAM credentials authentication #1936

Closed

liramon1 added a commit to liramon1/language-servers that referenced this pull request Jul 24, 2025

feat(identity): add support for IAM profile management (aws#1845)

7adf678

The identity LSP was changed to load and save IAM profile kinds.

liramon1 added a commit to liramon1/language-servers that referenced this pull request Jul 24, 2025

feat(identity): add support for IAM profile management (aws#1845)

fb3ac8f

The identity LSP was changed to load and save IAM profile kinds.

liramon1 added a commit to liramon1/language-servers that referenced this pull request Jul 24, 2025

feat(identity): add support for IAM profile management (aws#1845)

79a413a

The identity LSP was changed to load and save IAM profile kinds.

liramon1 mentioned this pull request Jul 24, 2025

feat: add IAM credentials authentication #1981

Draft

liramon1 added a commit that referenced this pull request Jul 25, 2025

feat(identity): add support for IAM profile management (#1845)

ee7b94e

The identity LSP was changed to load and save IAM profile kinds.

liramon1 added a commit that referenced this pull request Jul 25, 2025

feat(identity): add support for IAM profile management (#1845)

903a3ad

The identity LSP was changed to load and save IAM profile kinds.

liramon1 added a commit that referenced this pull request Jul 28, 2025

feat(identity): add support for IAM profile management (#1845)

727b419

The identity LSP was changed to load and save IAM profile kinds.

liramon1 added a commit that referenced this pull request Jul 30, 2025

feat(identity): add support for IAM profile management (#1845)

1502b40

The identity LSP was changed to load and save IAM profile kinds.

liramon1 added a commit that referenced this pull request Aug 1, 2025

feat(identity): add support for IAM profile management (#1845)

e77e886

The identity LSP was changed to load and save IAM profile kinds.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(identity): add support for IAM profile management #1845

feat(identity): add support for IAM profile management #1845

Uh oh!

liramon1 commented Jul 8, 2025 •

edited

Loading

Uh oh!

floralph Jul 15, 2025

Uh oh!

floralph Jul 15, 2025

Uh oh!

floralph Jul 15, 2025

Uh oh!

floralph Jul 15, 2025

Uh oh!

liramon1 Jul 15, 2025

Uh oh!

floralph Jul 15, 2025

Uh oh!

liramon1 Jul 15, 2025

Uh oh!

floralph Jul 15, 2025

Uh oh!

liramon1 Jul 15, 2025 •

edited

Loading

Uh oh!

codecov-commenter commented Jul 18, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

feat(identity): add support for IAM profile management #1845

feat(identity): add support for IAM profile management #1845

Uh oh!

Conversation

liramon1 commented Jul 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

License

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liramon1 Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

liramon1 commented Jul 8, 2025 •

edited

Loading

liramon1 Jul 15, 2025 •

edited

Loading

codecov-commenter commented Jul 18, 2025 •

edited

Loading