⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
botocore
/
__pycache__
/
View File Name :
credentials.cpython-312.pyc
Pe;K | d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl m Z d dl m Z d dlmZ d dlmZmZ d dlZd dlZd dlmZ d dlmZmZ d d lmZ d d lm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ d d l%m&Z& d d l'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z. ej^ e0 Z1 e d g d Z2dZ3dZ4dGdZ5 G d d Z6d Z7d Z8d Z9dHdZ:d Z;d Z<d Z= G d d Z> G d d e> Z? G d d e? Z@ G d! d" ZA G d# d$eA ZB G d% d&eB ZC G d' d(eB ZD G d) d* ZE G d+ d,eE ZF G d- d.eE ZG G d/ d0eE ZH G d1 d2eE ZI G d3 d4eE ZJ G d5 d6eE ZK G d7 d8eE ZL G d9 d:eE ZM G d; d<eE ZN G d= d> ZO G d? d@eE ZP G dA dB ZQ G dC dDeA ZR G dE dFeE ZSy)I N) namedtuple)deepcopy)sha1parse)tzlocaltzutc)UNSIGNED)compat_shell_split total_seconds)Config) ConfigNotFoundCredentialRetrievalErrorInfiniteLoopConfigErrorInvalidConfigErrorMetadataRetrievalErrorPartialCredentialsError RefreshWithMFAUnsupportedErrorUnauthorizedSSOTokenErrorUnknownCredentialError)SSOTokenProvider)ContainerMetadataFetcherFileWebIdentityTokenLoaderInstanceMetadataFetcher JSONFileCacheSSOTokenLoaderparse_key_val_fileresolve_imds_endpoint_modeReadOnlyCredentials access_key secret_keytokeniX c j d xs d} j d } j d } j j d du} j d t t j d d}|i }t }t } t t || j | } t || } t fd t | ||t || | g | } || g} | j || }t t! | | g}| |z |z }|r&|j# | t$ j' d t) | }|S )zCreate a default credential resolver. This creates a pre-configured credential resolver that includes the default lookup chain for credentials. profiledefaultmetadata_service_timeout metadata_service_num_attemptsN ec2_metadata_service_endpointec2_metadata_v1_disabled)r* "ec2_metadata_service_endpoint_mode ec2_credential_refresh_windowr+ )timeout num_attempts user_agentconfig)iam_role_fetcher)cache region_namec j S N) full_configsessions 6/usr/lib/python3/dist-packages/botocore/credentials.py<lambda>z,create_credential_resolver.<locals>.<lambda>m s G / / ) load_configclient_creatorr3 profile_namecredential_sourcerprofile_provider_builderr? disable_env_varszWSkipping environment variable credential check because profile name was explicitly set. providers)get_config_variableinstance_variablesgetr !_DEFAULT_ADVISORY_REFRESH_TIMEOUT EnvProviderContainerProviderInstanceMetadataProviderr r0 ProfileProviderBuilderAssumeRoleProvider_get_client_creator CanonicalNameCredentialSourcerrE OriginalEC2Provider BotoProviderremoveloggerdebugCredentialResolver)r9 r3 r4 r? metadata_timeoutr/ rC imds_config env_providercontainer_providerinstance_metadata_providerrA assume_role_provider pre_profileprofile_providers post_profilerE resolvers ` r: create_credential_resolverra A s ..y9FYL 223MN../NOL 11377 B$N *1)D)D +* /I / *K$+$?$? &% K } =L*,!90$% ))+ " 6u+ ./*7K@!9 -/I J ": K 1::!) ; " L //,>I & 8 "I6H Or< c @ e Zd ZdZ d dZd dZd Zd Zd Zd Z d Z y) rM a This class handles the creation of profile based providers. NOTE: This class is only intended for internal use. This class handles the creation and ordering of the various credential providers that primarly source their configuration from the shared config. This is needed to enable sharing between the default credential chain and the source profile chain created by the assume role provider. Nc < || _ || _ || _ || _ y r6 )_session_cache _region_name_sso_token_cache)selfr9 r3 r4 sso_token_caches r: __init__z ProfileProviderBuilder.__init__ s" ' / r< c | j || | j | | j | | j | | j | gS r6 ) _create_web_identity_provider_create_sso_provider"_create_shared_credential_provider_create_process_provider_create_config_providerrh r? rC s r: rE z ProfileProviderBuilder.providers sZ . . % %l 3 3 3L A ) ), 7 ( ( 6 r< c $ t | fd S )Nc 0 j j S r6 rd r7 rh s r: r; zAProfileProviderBuilder._create_process_provider.<locals>.<lambda> 9 9r< )r? r= )ProcessProviderrh r? s ` r: ro z/ProfileProviderBuilder._create_process_provider s %9 r< c R | j j d }t || S )Ncredentials_file)r? creds_filename)rd rF SharedCredentialProvider)rh r? credential_files r: rn z9ProfileProviderBuilder._create_shared_credential_provider s* --;;<NO'%* r< c R | j j d }t || S )N config_file)r? config_filename)rd rF ConfigProvider)rh r? r s r: rp z.ProfileProviderBuilder._create_config_provider s) mm77 F % ' r< c z t fdt j j j || S )Nc 0 j j S r6 rt ru s r: r; zFProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda> rv r< )r= r> r3 r? rC )!AssumeRoleWithWebIdentityProviderrO rd rf re rq s ` r: rl z4ProfileProviderBuilder._create_web_identity_provider s9 09. t 0 0 ++% - r< c t fd j j | j j t j j | S )Nc 0 j j S r6 rt ru s r: r; z=ProfileProviderBuilder._create_sso_provider.<locals>.<lambda> rv r< )r3 r? )r= r> r? r3 token_cachetoken_provider) SSOProviderrd create_clientre rg r rx s ` r: rm z+ProfileProviderBuilder._create_sso_provider sN 9 ==66%++ --+ ++ ) r< NNNF) __name__ __module__ __qualname____doc__rj rE ro rn rp rl rm r< r: rM rM s1 FJ0 r< rM c 8 t | }|j S r6 )ra load_credentials)r9 r` s r: get_credentialsr s )'2H $ $ &&r< c P t j j t S r6 )datetimenowr r r< r: _local_nowr s ++r< c P t | t j r| S t | S r6 ) isinstancer r )values r: _parse_if_neededr s! %**+ <r< c t | t j r#|r| j S | j d S | S )Nz%Y-%m-%dT%H:%M:%S%Z)r r isoformatstrftime)r isos r: _serialize_if_neededr s7 %**+ ??$ $~~ 344 Lr< c fd}|S )Nc V di} |j di | j | fi |S )Nr4 r )updater ) service_namekwargscreate_client_kwargsr4 r9 s r: r> z+_get_client_creator.<locals>.client_creator s; -{ ; # ##-f-$w$$\J5IJJr< r )r9 r4 r> s `` r: rO rO s K r< c fd}|S )Nc j j di } | d }|d |d |d t |d dS )N Credentials AccessKeyIdSecretAccessKey SessionToken Expirationr! r" r# expiry_timer ) assume_roler )response credentialsclientparamss r: refreshz-create_assume_role_refresher.<locals>.refresh sT %6%%// }- &m4%&78 0/ L0IJ r< r )r r r s `` r: create_assume_role_refresherr s Nr< c & G d d } || S )Nc e Zd Zd Zd Zy)/create_mfa_serial_refresher.<locals>._Refresherc || _ d| _ y )NF)_refresh_has_been_called)rh r s r: rj z8create_mfa_serial_refresher.<locals>._Refresher.__init__ s #DM$)D !r< c \ | j r t d| _ | j S NT)r r r ru s r: __call__z8create_mfa_serial_refresher.<locals>._Refresher.__call__$ s* $$ 566$(D !==? "r< N)r r r rj r r r< r: _Refresherr s * #r< r r )actual_refreshr s r: create_mfa_serial_refresherr s # # n %%r< c $ e Zd ZdZddZd Zd Zy)r ap Holds the credentials needed to authenticate requests. :param str access_key: The access key part of the credentials. :param str secret_key: The secret key part of the credentials. :param str token: The security token, valid only for session credentials. :param str method: A string which identifies where the credentials were found. Nc d || _ || _ || _ |d}|| _ | j y )Nexplicit)r! r" r# method _normalize)rh r! r" r# r s r: rj zCredentials.__init__; s2 $$ > F r< c t j j | j | _ t j j | j | _ y r6 )botocorecompatensure_unicoder! r" ru s r: r zCredentials._normalizeF s8 #//88 I"//88 Ir< c X t | j | j | j S r6 )r r! r" r# ru s r: get_frozen_credentialsz"Credentials.get_frozen_credentialsP s" " OOT__djj r< NN)r r r r rj r r r r< r: r r 0 s J r< r c e Zd ZdZeZeZeddfdZ d Z e dd Z e d Zej d Ze d Zej d Ze d Zej d Zd Zdd Zd Zd Zd Zed Zd Zd Zy)RefreshableCredentialsa Holds the credentials needed to authenticate requests. In addition, it knows how to refresh itself. :param str access_key: The access key part of the credentials. :param str secret_key: The secret key part of the credentials. :param str token: The security token, valid only for session credentials. :param datetime expiry_time: The expiration time of the credentials. :param function refresh_using: Callback function to refresh the credentials. :param str method: A string which identifies where the credentials were found. :param function time_fetcher: Callback function to retrieve current time. Nc || _ || _ || _ || _ || _ || _ t j | _ || _ t ||| | _ | j ||| _ | | | _ y y r6 )_refresh_using _access_key _secret_key_token _expiry_time _time_fetcher threadingLock _refresh_lockr r _frozen_credentialsr _advisory_refresh_timeout_mandatory_refresh_timeout) rh r! r" r# r refresh_usingr time_fetcheradvisory_timeoutmandatory_timeouts r: rj z RefreshableCredentials.__init__l s ,%% ' ) &^^ - #6 E$ '-=D * (.?D + )r< c t j j | j | _ t j j | j | _ y r6 )r r r r r ru s r: r z!RefreshableCredentials._normalize s< #??99$:J:JK#??99$:J:JKr< c z i }|||d< |||d< | d|d |d |d | j |d ||d|}|S ) Nr r r! r" r# r )r! r" r# r r r r )_expiry_datetime)clsmetadatar r r r r instances r: create_from_metadataz+RefreshableCredentials.create_from_metadata s| ')9F% & (*;F& ' - -7#,,Xm-DE' r< c : | j | j S zWarning: Using this property can lead to race conditions if you access another property subsequently along the refresh boundary. Please use get_frozen_credentials instead. )r r ru s r: r! z!RefreshableCredentials.access_key r< c || _ y r6 )r rh r s r: r! z!RefreshableCredentials.access_key r< c : | j | j S r )r r ru s r: r" z!RefreshableCredentials.secret_key r r< c || _ y r6 )r r s r: r" z!RefreshableCredentials.secret_key r r< c : | j | j S r )r r ru s r: r# z RefreshableCredentials.token s {{r< c || _ y r6 )r r s r: r# z RefreshableCredentials.token s r< c R | j | j z }t | S r6 )r r r )rh deltas r: _seconds_remainingz)RefreshableCredentials._seconds_remaining s& !!D$6$6$88 U##r< c | j y| | j }| j |k\ ryt j d y)a Check if a refresh is needed. A refresh is needed if the expiry time associated with the temporary credentials is less than the provided ``refresh_in``. If ``time_delta`` is not provided, ``self.advisory_refresh_needed`` will be used. For example, if your temporary credentials expire in 10 minutes and the provided ``refresh_in`` is ``15 * 60``, then this function will return ``True``. :type refresh_in: int :param refresh_in: The number of seconds before the credentials expire in which refresh attempts should be made. :return: True if refresh needed, False otherwise. Fz!Credentials need to be refreshed.T)r r r rT rU )rh refresh_ins r: refresh_neededz%RefreshableCredentials.refresh_needed sJ ( $ 77J " " $ 2 89r< c & | j d S )Nr )r )r ru s r: _is_expiredz"RefreshableCredentials._is_expired s ""a"00r< c | j | j sy | j j d r | j | j s | j j y | j | j }| j | | j j y | j | j rM| j 5 | j | j s d d d y | j d d d d y y # | j j w xY w# 1 sw Y y xY w)NF) is_mandatoryT)r r r acquirereleaser _protected_refresh)rh is_mandatory_refreshs r: r z RefreshableCredentials._refresh s$ ""4#A#AB % %e , -**4+I+IJ ""**, (,':':33($ ''5I'J""**, !@!@ A ##**4+J+JK $# ''T': $# B ""**, $#s# D" 0-D" EE" D>E c l | j }| j | t | j | j | j | _ | j r"d}t j | t | y # t $ r$ |rdnd}t j d|d |r Y y w xY w)N mandatoryadvisoryzARefreshing temporary credentials failed during %s refresh period.Texc_infozLCredentials were refreshed, but the refreshed credentials are still expired.) r ExceptionrT warning_set_from_datar r r r r r RuntimeError)rh r r period_namemsgs r: r z)RefreshableCredentials._protected_refresh s **,H$ H%#6 d . . $ ; NN3 s# # + )5+:K NN, ! s B *B32B3c t | S r6 r )time_strs r: r z'RefreshableCredentials._expiry_datetime= s X r< c d g d}|s|}n|D cg c] }||vs| }}|r+d}t | j |dj | z |d | _ |d | _ |d | _ t |d | _ t j d | j | j y c c}w ) Nr z7Credential refresh failed, response did not contain: %s, provider error_msgr! r" r# r z(Retrieved credentials will expire at: %s) r r joinr! r" r# r r rT rU r )rh data expected_keys missing_keyskmessages r: r z%RefreshableCredentials._set_from_dataA s L (L'4F}! A}LF OG* !DIIl$;; |, |,'] !$}"5 6 68I8I ! Gs B-B-c : | j | j S )a Return immutable credentials. The ``access_key``, ``secret_key``, and ``token`` properties on this class will always check and refresh credentials if needed before returning the particular credentials. This has an edge case where you can get inconsistent credentials. Imagine this: # Current creds are "t1" tmp.access_key ---> expired? no, so return t1.access_key # ---- time is now expired, creds need refreshing to "t2" ---- tmp.secret_key ---> expired? yes, refresh and return t2.secret_key This means we're using the access key from t1 with the secret key from t2. To fix this issue, you can request a frozen credential object which is guaranteed not to change. The frozen credentials returned from this method should be used immediately and then discarded. The typical usage pattern would be:: creds = RefreshableCredentials(...) some_code = SomeSignerObject() # I'm about to sign the request. # The frozen credentials are only used for the # duration of generate_presigned_url and will be # immediately thrown away. request = some_code.sign_some_request( with_credentials=creds.get_frozen_credentials()) print("Signed request:", request) )r r ru s r: r z-RefreshableCredentials.get_frozen_credentialsX s D '''r< r r6 )r r r r rI r "_DEFAULT_MANDATORY_REFRESH_TIMEOUTr r rj r classmethodr propertyr! setterr" r# r r r r r staticmethodr r r r r< r: r r V s !B "D @:L 2 ! ! ! ! \\ $ D1 ;<%$N .#(r< r c . e Zd ZdZefdZd fd Z xZS ) DeferredRefreshableCredentialszyRefreshable credentials that don't require initial credentials. refresh_using will be called upon first access. c || _ d | _ d | _ d | _ d | _ || _ t j | _ || _ d | _ y r6 ) r r r r r r r r r r r )rh r r r s r: rj z'DeferredRefreshableCredentials.__init__ sO + ) &^^ - #' r< c < | j yt | | S r )r superr )rh r __class__s r: r z-DeferredRefreshableCredentials.refresh_needed s" # # +w%j11r< r6 )r r r r r rj r __classcell__r% s @r: r! r! ~ s <F (2 2r< r! c H e Zd ZdZd dZd Zd Zd Zd Zd Z d Z d Z d Z y) CachedCredentialFetcherr$ Nc n |i }|| _ | j | _ | | j }|| _ y r6 )re _create_cache_key _cache_key DEFAULT_EXPIRY_WINDOW_SECONDS_expiry_window_seconds)rh r3 expiry_window_secondss r: rj z CachedCredentialFetcher.__init__ s= =E 002 ($($F$F !&;#r< c t d )Nz_create_cache_key()NotImplementedErrorru s r: r+ z)CachedCredentialFetcher._create_cache_key s !"788r< c |j dd j t j d }|j dd S )N:_/)replaceossep)rh filenames r: _make_file_safez'CachedCredentialFetcher._make_file_safe s8 ##C-55bffcB S))r< c t d )Nz_get_credentials()r1 ru s r: _get_credentialsz(CachedCredentialFetcher._get_credentials s !"677r< c " | j S r6 )_get_cached_credentialsru s r: fetch_credentialsz)CachedCredentialFetcher.fetch_credentials s ++--r< c | j }|"| j }| j | nt j d |d }t |d d }|d |d |d |d S ) zGet up-to-date credentials. This will check the cache for up-to-date credentials, calling assume role if none are available. z*Credentials for role retrieved from cache.r r T)r r r r r )_load_from_cacher= _write_to_cacherT rU r )rh r creds expirations r: r? z/CachedCredentialFetcher._get_cached_credentials s ((* ,,.H * LLE F ')% *=4H . 12>*% r< c | j | j v rJt | j | j }| j | s|S t j d y )Nz6Credentials were found in cache, but they are expired.)r, re r r rT rU )rh rD s r: rB z(CachedCredentialFetcher._load_from_cache sP ??dkk ) T[[ 9:E##E* L r< c H t | | j | j < y r6 )r re r, )rh r s r: rC z'CachedCredentialFetcher._write_to_cache s '/'9 DOO$r< c n t |d d }t |t z }|| j k S )z!Check if credentials are expired.r r )r r r r. )rh r end_timesecondss r: r z#CachedCredentialFetcher._is_expired s8 #K $>|$LM :< 784444r< r ) r r r r- rj r+ r; r= r@ r? rB rC r r r< r: r) r) s5 $+!<9* 8. , :5r< r) c 2 e Zd Z d fd Zd Zd Z xZS ) BaseAssumeRoleCredentialFetcherc . || _ || _ |i | _ nt | | _ | j | j d< | j j d | _ d| _ | j s| j t | % || y )NRoleArnRoleSessionNameF) _client_creator _role_arn_assume_kwargsr rH _role_session_name_using_default_session_name_generate_assume_role_namer$ rj )rh r> role_arn extra_argsr3 r/ r% s r: rj z(BaseAssumeRoleCredentialFetcher.__init__ s . ! "$D "*:"6D )- I&"&"5"5"9"9:K"L +0(&& + + - 56r< c dt t j z | _ | j | j d< d| _ y )Nzbotocore-session-%srO T)inttimerS rR rT ru s r: rU z:BaseAssumeRoleCredentialFetcher._generate_assume_role_name s9 "73tyy{;K"L 151H1H -.+/(r< c ( t | j }| j r|d= d|v rt j |d |d< t j |d }t |j d j }| j | S )Create a predictable cache key for the current configuration. The cache key is intended to be compatible with file names. rO PolicyT) sort_keysutf-8) r rR rT jsonloadsdumpsr encode hexdigestr; rh args argument_hashs r: r+ z1BaseAssumeRoleCredentialFetcher._create_cache_key s ++, + +&' t "ZZX 7DNzz$$/ T[[ 12<<> ##M22r< r )r r r rj rU r+ r& r' s @r: rL rL s " 700 3r< rL c : e Zd Z d fd Zd Zd Zd Z xZS )AssumeRoleCredentialFetcherc || _ || _ | j t j | _ t | ||||| y)a :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type source_credentials: Credentials :param source_credentials: The credentials to use to create the client for the call to AssumeRole. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type mfa_prompter: callable :param mfa_prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, NrW r3 r/ )_source_credentials _mfa_promptergetpassr$ rj ) rh r> source_credentialsrV rW mfa_prompterr3 r/ r% s r: rj z$AssumeRoleCredentialFetcher.__init__ sO R $6 ) %!( D !"7 r< c f | j }| j } |j di |S )'Get credentials by calling assume role.r )_assume_role_kwargs_create_clientr )rh r r s r: r= z,AssumeRoleCredentialFetcher._get_credentialsF s4 ))+$$&!v!!+F++r< c t | j }|j d }|d|z }| j | }||d< |j d }|||d< |S )AGet the arguments for assume role based on current configuration. SerialNumberzEnter MFA code for %s: TokenCodeDurationSeconds)r rR rH rm )rh assume_role_kwargs mfa_serialprompt token_codeduration_secondss r: rs z/AssumeRoleCredentialFetcher._assume_role_kwargsL sx %d&9&9 :'++N; !.;F ++F3J.8 { +-112CD '4D 0 1!!r< c | j j }| j d|j |j |j S )z2Create an STS client using the source credentials.sts)aws_access_key_idaws_secret_access_keyaws_session_token)rl r rP r! r" r# )rh frozen_credentialss r: rt z*AssumeRoleCredentialFetcher._create_client^ sM ! 5 5 L L N## 0 ; ;"4"?"? 0 6 6 $ r< )NNNN)r r r rj r= rs rt r& r' s @r: ri ri s& "4 l, "$ r< ri c 2 e Zd Z d fd Zd Zd Z xZS )*AssumeRoleWithWebIdentityCredentialFetcherc < || _ t | ||||| y)aG :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type web_identity_token_loader: callable :param web_identity_token_loader: A callable that takes no arguments and returns a web identity token str. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, rk N)_web_identity_token_loaderr$ rj )rh r> web_identity_token_loaderrV rW r3 r/ r% s r: rj z3AssumeRoleWithWebIdentityCredentialFetcher.__init__l s0 H +D' !"7 r< c | j }t t }| j d| } |j di |S )rr )signature_versionr r1 r )rs r r rP assume_role_with_web_identity)rh r r1 r s r: r= z;AssumeRoleWithWebIdentityCredentialFetcher._get_credentials sG ))+ (3%%eF%;3v33=f==r< c Z t | j }| j }||d< |S )rv WebIdentityToken)r rR r )rh rz identity_tokens r: rs z>AssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargs s3 %d&9&9 : 88:1?-.!!r< r )r r r rj r= rs r& r' s @r: r r i s ", \>"r< r c ( e Zd ZdZdZddZd Zd Zy)CredentialProviderNc || _ y r6 r8 )rh r9 s r: rj zCredentialProvider.__init__ s r< c y)a~ Loads the credentials from their source & sets them on the object. Subclasses should implement this method (by reading from disk, the environment, the network or wherever), returning ``True`` if they were found & loaded. If not found, this method should return ``False``, indictating that the ``CredentialResolver`` should fall back to the next available method. The default implementation does nothing, assuming the user has set the ``access_key/secret_key/token`` themselves. :returns: Whether credentials were found & set :rtype: Credentials Tr ru s r: loadzCredentialProvider.load s " r< c g }|D ] } |j || |S # t $ r t | j | w xY w)Nr cred_var)appendKeyErrorr METHOD)rh mapping key_namesfoundkey_names r: _extract_creds_from_mappingz.CredentialProvider._extract_creds_from_mapping sU !H WX ./ " - ![[8 s !!Ar6 )r r r r CANONICAL_NAMErj r r r r< r: r r s F N & r< r c J e Zd ZdZej fdZd Zd Ze d Z y)rw zcustom-processc < || _ || _ d | _ || _ y r6 ) _profile_name _load_config_loaded_config_popen)rh r? r= popens r: rj zProcessProvider.__init__ s! ) ' " r< c j y j }|j d %t j | fd j S t |d |d |j d j S )Nr c & j S r6 )_retrieve_credentials_using)credential_processrh s r: r; z&ProcessProvider.load.<locals>.<lambda> s 889KLr< r! r" r# )r! r" r# r )_credential_processr rH r r r r )rh creds_dictr s ` @r: r zProcessProvider.load s ! 5 5 % 556HI >>- ( 4)>>L !,/!,/ ..);; r< c t | }| j |t j t j }|j \ }}|j dk7 r&t | j |j d t j j j |j d }|j dd }|dk7 rt | j d| d |d |d |j d |j d dS # t $ r }t | j d| d }~ww xY w)N)stdoutstderrr r_ r Versionz<Version key not provided> zUnsupported version 'z8' for credential process provider, supported versions: 1r r r r r z"Missing required key in response: )r r subprocessPIPE communicate returncoder r decoder r r` ra rH r ) rh r process_listpr r parsedversiones r: r z+ProcessProvider._retrieve_credentials_using s7 **<= KK <<1 * g0F %%++FMM',BC**Y(DE a<* +G9 56 7 $] 3 $%6 7 N3 %zz, 7 * >qcB s /*D E#D==Ec | j | j | _ | j j di j | j i }|j d S )Nprofilesr )r r rH r )rh profile_configs r: r z#ProcessProvider._credential_process sa &"&"3"3"5D ,,00R@DD !!"677r< N) r r r r r Popenrj r r r r r r< r: rw rw s4 F8B8H8H (!F 8 8r< rw c e Zd ZdZdZd Zd Zy)rL ziam-roleEc2InstanceMetadatac || _ y r6 ) _role_fetcher)rh r2 s r: rj z!InstanceMetadataProvider.__init__( s -r< c | j }|j }|sy t j d|d t j || j |j }|S )Nz#Found credentials from IAM Role: %s role_namer r )r retrieve_iam_role_credentialsrT infor r r )rh fetcherr rD s r: r z InstanceMetadataProvider.load+ sj $$ 88: 18K3H ';; ;;!?? < r< N)r r r r r rj r r r< r: rL rL $ s F*N.r< rL c B e Zd ZdZdZdZdZddgZdZd d Z d Z d Z d Z y)rJ env EnvironmentAWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_SECURITY_TOKENAWS_SESSION_TOKENAWS_CREDENTIAL_EXPIRATIONNc b |t j }|| _ | j | | _ y)a :param environ: The environment variables (defaults to ``os.environ`` if no value is provided). :param mapping: An optional mapping of variable names to environment variable names. Use this if you want to change the mapping of access_key->AWS_ACCESS_KEY_ID, etc. The dict can have up to 3 keys: ``access_key``, ``secret_key``, ``session_token``. N)r8 environ_build_mapping_mapping)rh r r s r: rj zEnvProvider.__init__K s+ ?jjG ++G4 r< c i }|>| j |d< | j |d< | j |d< | j |d< |S |j d| j |d< |j d| j |d< |j d| j |d< t |d t s |d g|d< |j d| j |d< |S )Nr! r" r# r ) ACCESS_KEY SECRET_KEYTOKENS EXPIRY_TIMErH r list)rh r var_mappings r: r zEnvProvider._build_mapping[ s ?(,K %(,K %#';;K )-)9)9K & )0 doo)K % )0 doo)K % $+;;w #DK k' 2D9(3G(<'= G$)0 t / /*K & r< c f | j j | j d d }|rt j d | j } |d }|d }|/t | }t |d |d |d ||| j S t |d |d |d | j S y) zK Search for credentials in explicit environment variables. r! z+Found credentials in environment variables.F)require_expiryr Nr" r# )r r r ) r rH r rT r _create_credentials_fetcherr r r r )rh r! r r r s r: r zEnvProvider.loads s \\%%dmmL&A2F KKE F668G!7K%m4K& #K 0 - - - ( ") ;; L)L)G${{ r< c d | j | j | j dfd }|S )Nc z i }j d d }|st d ||d< j d d }|st d ||d< d |d< d D ] }j |d }|s||d< n d |d< j d d }|r||d< | r|st d |S )Nr! r r r" r# r )rH r ) r r r! r" token_env_varr# r r r r s r: r@ zBEnvProvider._create_credentials_fetcher.<locals>.fetch_credentials s K W\%:B?J - #gl.C )3K % W\%:B?J - #gl.C )3K %#'K !(!1 M26+0K( "2 *.K &!++gm&<bAK-8 M* k- #gm.D r< )T)r r r )rh r@ r r r s @@@r: r z'EnvProvider._create_credentials_fetcher s, --,,! F ! r< r ) r r r r r r r r r rj r r r r r< r: rJ rJ A s= F"N$J(J #$7 8F-K5 0 B(!r< rJ c . e Zd ZdZdZdZdZdZd dZd Z y) rQ zec2-credentials-file Ec2ConfigAWS_CREDENTIAL_FILEAWSAccessKeyId AWSSecretKeyNc T |t j }|t }|| _ || _ y r6 )r8 r r _environ_parser)rh r parsers r: rj z OriginalEC2Provider.__init__ s( ?jjG >'F r< c N d| j v rt j j | j d }| j | }| j |v rKt j d || j }|| j }t ||| j S yy)zN Search for a credential file used by original EC2 CLI tools. r z)Found credentials in AWS_CREDENTIAL_FILE.r N) r r8 path expanduserr r rT r r r r )rh full_pathrD r! r" s r: r zOriginalEC2Provider.load s !DMM 1** 34I LL+E%' GH "4?? 3 "4?? 3 ":z$++NN ( r< r ) r r r r r CRED_FILE_ENVr r rj r r r< r: rQ rQ s% #F N)M!J J r< rQ c 8 e Zd ZdZdZdZdZddgZd dZd Z d Z y) r| zshared-credentials-fileSharedCredentialsr r aws_security_tokenr Nc n || _ |d}|| _ |t j j }|| _ y )Nr' )_creds_filenamer r configloaderraw_config_parse _ini_parser)rh r{ r? ini_parsers r: rj z!SharedCredentialProvider.__init__ s< - $L ) !..??J%r< c | j | j }| j |v r|| j }| j |v rtt j d| j | j || j | j \ }}| j | }t |||| j S y y # t $ r Y y w xY w)Nz0Found credentials in shared credentials file: %sr ) r r r r r rT r r r _get_session_tokenr r )rh available_credsr1 r! r" r# s r: r z SharedCredentialProvider.load s " . .t/C/C DO 0$T%7%78F&( F(( *.)I)IDOOT__*& J //7" E$++ ) 1 s B> > C C c < | j D ] }||v s|| c S y r6 r )rh r1 token_envvars r: r z+SharedCredentialProvider._get_session_token s# KKLv% l++ (r< r ) r r r r r r r r rj r r r r< r: r| r| s2 &F(N$J(J #$7 8F&(,r< r| c < e Zd ZdZdZdZdZdZddgZd d Z d Z d Z y) r z0INI based config provider with profile sections.z config-file SharedConfigr r r r Nc f || _ || _ |t j j }|| _ y)a :param config_filename: The session configuration scoped to the current profile. This is available via ``session.config``. :param profile_name: The name of the current profile. :param config_parser: A config parser callable. N)_config_filenamer r r r= _config_parser)rh r r? config_parsers r: rj zConfigProvider.__init__ s3 !0 ) $ 1 1 = =M +r< c | j | j }| j |d v r|d | j }| j |v rtt j d| j | j || j | j \ }}| j | }t |||| j S yy# t $ r Y yw xY w)zr If there is are credentials in the configuration associated with the session, use those. Nr z$Credentials found in config file: %sr ) r r r r r rT r r r r r r )rh r7 r r! r" r# s r: r zConfigProvider.load, s --d.C.CDK Z!8 8 ( 4T5G5G HN.0 :)) *.)I)I"DOOT__*& J //?" E$++ 1 # s C CCc < | j D ] }||v s|| c S y r6 r )rh r token_names r: r z!ConfigProvider._get_session_tokenF s# ++J^+%j11 &r< r6 ) r r r r r r r r r rj r r r r< r: r r s5 : F#N$J(J #$7 8F , 42r< r c 6 e Zd ZdZdZdZddgZdZdZd d Z d Z y) rR z boto-config Boto2Config BOTO_CONFIGz /etc/boto.cfgz~/.botor r Nc | |t j }|t j j }|| _ || _ y r6 )r8 r r r r r r )rh r r s r: rj zBotoProvider.__init__U s6 ?jjG !..??J %r< c | j | j v r| j | j g}n | j }|D ] } | j | }d|v s|d }| j |v s.t j d| | j || j | j \ }}t ||| j c S y# t $ r Y w xY w)z; Look for credentials in boto config file. r z)Found credentials in boto config file: %sr N) BOTO_CONFIG_ENVr DEFAULT_CONFIG_FILENAMESr r r rT r r r r r )rh potential_locationsr: r1 r r! r" s r: r zBotoProvider.load] s 4== 0#'==1E1E#F"G "&"?"? +H ))(3 & $] 3 ??k1KKCX .2-M-M#T__doo.*J '"Jt{{ , " s C CCr ) r r r r r r r r r rj r r r< r: rR rR L s0 F"N#O / ; $J(J&r< rR c e Zd ZdZdZdZdZdZej ddfdZ d Z d Z d Z d Z d Zd Zd Zd Zd Zd Zd Zd Zy)rN assume-roleNrV web_identity_token_filer$ c || _ || _ || _ || _ || _ i | _ || _ || _ | j g| _ y)a :type load_config: callable :param load_config: A function that accepts no arguments, and when called, will return the full configuration dictionary for the session (``session.full_config``). :type client_creator: callable :param client_creator: A factory function that will create a client when called. Has the same interface as ``botocore.session.Session.create_client``. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in the CLI. :type profile_name: str :param profile_name: The name of the profile. :type prompter: callable :param prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type credential_sourcer: CanonicalNameCredentialSourcer :param credential_sourcer: A credential provider that takes a configuration, which is used to provide the source credentials for the STS call. N) r3 r rP r _prompterr _credential_sourcer_profile_provider_builder_visited_profiles)rh r= r> r3 r? prompterr@ rA s r: rj zAssumeRoleProvider.__init__ sX V ' . )! !#5 )A&"&"4"4!5 r< c | j | _ | j j di }|j | j i }| j | r| j | j S y Nr )r r rH r _has_assume_role_config_vars_load_creds_via_assume_role)rh r r& s r: r zAssumeRoleProvider.load sk " / / 1&&**:r:,,t 1 126 , ,W 533D4F4FG G 6r< c > | j |v xr | j |vS r6 )ROLE_CONFIG_VARWEB_IDENTITY_TOKE_FILE_VARrh r& s r: r z/AssumeRoleProvider._has_assume_role_config_vars s* G + ; + +7 : r< c | j | }| j || }i }|j d }|||d< |j d }|||d< |j d }|||d< |j d }|||d< t | j ||d || j | j } | j } | t | } t | j | t S ) Nrole_session_namerO external_id ExternalIdr{ rw r~ ry rV )r> ro rV rW rp r3 )r r r ) _get_role_config_resolve_source_credentialsrH ri rP r r3 r@ r r! r r ) rh r? role_configro rW r' r( r{ r~ r refreshers r: r! z.AssumeRoleProvider._load_creds_via_assume_role s ++L9 ! = = 'OO,? @ (,=J( )!oom4 "'2J| $ __\2 !)3J~ &&??+=> ',<J( )- // 1 ,! ** -- !3I>I .;;## r< c | j j di }|| }|j d }|d }|j d }|j d }|j d }|j d } |j d } |||| ||d } | t | | d< ||t d |z ||t | j d || j || | S | j || | S # t $ r Y cw xY w)z?Retrieves and validates the role configuration for the profile.r source_profilerV credential_sourcer{ r( r' r~ )rV r( r{ r' r/ r0 zDThe profile "%s" contains both source_profile and credential_source.r z#source_profile or credential_sourcer ) r rH rY ValueErrorr r r _validate_credential_source_validate_source_profile) rh r? r r& r/ rV r0 r{ r( r' r~ r, s r: r* z#AssumeRoleProvider._get_role_config sZ &&**:r:<( %56:& #KK(; < [[ . kk-0 #KK(; <";;'9: !&$!2 ,!2 ' 256F2G ./ (^-G$)+78 &>+A) > * , ,\;L M ) ), G- s C? ? D D c | j t d| d| d | j j | st d| d| d y )NzThe credential_source "z" is specified in profile "z)", but no source provider was configured.r1 zThe credential source "z" referenced in profile "z" is not valid.)r r is_supported)rh parent_profiler0 s r: r3 z.AssumeRoleProvider._validate_credential_source5 s # # +$./@.A B$$2#3 4=> ''445FG$./@.A B$$2#33CE Hr< c X t | j | | j | g S r6 )any_has_static_credentialsr r% s r: _source_profile_has_credentialsz2AssumeRoleProvider._source_profile_has_credentialsF s0 ,,W511': r< c | j j di }||vrt d| d| d || }|| j vry ||k7 rt || j | j | st || j y )Nr zThe source_profile "z " referenced in the profile "z" does not exist.r1 )r/ visited_profiles)r rH r r r r: )rh parent_profile_namesource_profile_namer r/ s r: r4 z+AssumeRoleProvider._validate_source_profileN s &&**:r: h .$+,?+@ A%%8$99KM ""56 d&<&< < "5 5) 2!%!7!7 ++N;) 2!%!7!7 <r< c 4 ddg}t fd|D S )Nr r c 3 & K | ] }|v y wr6 r ).0 static_keyr& s r: <genexpr>z=AssumeRoleProvider._has_static_credentials.<locals>.<genexpr>v s G;Z:(; )r9 )rh r& static_keyss ` r: r: z*AssumeRoleProvider._has_static_credentialst s .0CD G;GGGr< c |j d }|| j || S |d }| j j | | j | S )Nr0 r/ )rH _resolve_credentials_from_sourcer r !_resolve_credentials_from_profile)rh r, r? r0 r/ s r: r+ z.AssumeRoleProvider._resolve_source_credentialsx sb 'OO,? @ (88!< %%56 %%n555nEEr< c | j j di }|| }| j | r | j s| j | S | j | s| j | sM| j j |d }t | }|j }|d}t ||z |S | j | S )Nr TrB z.The source profile "%s" must have credentials.r1 ) r rH r: r (_resolve_static_credentials_from_profiler rE rV r r r! )rh r? r r& r^ profile_chainr error_messages r: rI z4AssumeRoleProvider._resolve_credentials_from_profile s &&**:r:<( ( ( 122 @@I I ) ) 227; $ > > H H )!% !I ! //@ AM'88:K"D ) +l : // ==r< c t |d |d |j d S # t $ r%}t | j t | d }~ww xY w)Nr r r r r )r rH r r r str)rh r& r s r: rK z;AssumeRoleProvider._resolve_static_credentials_from_profile s_ "#67"#:; kk"56 ) s1v s "% A AAc ` | j j | }|t |d|z |S )NzBNo credentials found in credential_source referenced in profile %sr )r ro r )rh r0 r? r s r: rH z3AssumeRoleProvider._resolve_credentials_from_source sJ ..AA **$&23 r< )r r r r r r# r$ EXPIRY_WINDOW_SECONDSrn rj r r r! r* r3 r; r4 r: r+ rI rK rH r r< r: rN rN y sy F N O!: $ !%<6|H * X/b" $LH F >B r< rN c L e Zd ZdZdZddddZ d dZd Zd Zd Z d Z d Z y)r z assume-role-with-web-identityNAWS_WEB_IDENTITY_TOKEN_FILEAWS_ROLE_SESSION_NAME AWS_ROLE_ARN)r r' rV c v || _ || _ || _ || _ d | _ || _ |t }|| _ y r6 )r3 r rP r _profile_config_disable_env_varsr _token_loader_cls)rh r= r> r? r3 rC token_loader_clss r: rj z*AssumeRoleWithWebIdentityProvider.__init__ sG ' - ) # !1 # 9 !1 r< c " | j S r6 ) _assume_role_with_web_identityru s r: r z&AssumeRoleWithWebIdentityProvider.load s 2244r< c | j C| j }|j di }|j | j i | _ | j j | S r )rW r rH r )rh key loaded_configr s r: _get_profile_configz5AssumeRoleWithWebIdentityProvider._get_profile_config s^ ' - - /M$((R8H#+<<0B0BB#GD ##'',,r< c | j ry | j j | }|r%|t j v rt j | S y r6 )rX _CONFIG_TO_ENV_VARrH r8 r )rh r^ env_keys r: _get_env_configz1AssumeRoleWithWebIdentityProvider._get_env_config sD ! !))--c2 w"**,::g& &r< c N | j | }||S | j | S r6 )rd r` )rh r^ env_values r: _get_configz-AssumeRoleWithWebIdentityProvider._get_config s/ ((- '',,r< c L | j d }|sy | j | }| j d }|sd}t | i }| j d }|||d< t | j |||| j }t | j |j S ) Nr rV zThe provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r1 r' rO )r> r rV rW r3 r ) rg rY r r rP r3 r! r r@ )rh token_path token_loaderrV r rW r' r s r: r\ z@AssumeRoleWithWebIdentityProvider._assume_role_with_web_identity s %%&?@ --j9 ##J/H %y9 9 , ,-@ A (,=J( )< //&2 !** .;;!33 r< )NFN) r r r r r rb rj r r` rd rg r\ r r< r: r r sF ,FN#@ 4" 2&5-- " r< r c 0 e Zd Zd Zd Zd Zd Zd Zd Zy)rP c || _ y r6 ) _providersrh rE s r: rj z'CanonicalNameCredentialSourcer.__init__ s #r< c X || j D cg c] }|j c}v S c c}w )aL Validates a given source name. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: bool :returns: True if the credential provider is supported, False otherwise. )rm r )rh source_namer s r: r6 z+CanonicalNameCredentialSourcer.is_supported s+ I Aq / / III Is 'c | j | }t |t r|j S |j S )a Loads source credentials based on the provided configuration. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: Credentials ) _get_providerr rV r r )rh rp sources r: ro z1CanonicalNameCredentialSourcer.source_credentials+ s: ##K0 f 0 1**, ,{{} r< c | j | }|j dv r$| j d }|||S t ||g S | t | |S )a# Return a credential provider by its canonical name. :type canonical_name: str :param canonical_name: The canonical name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. ) sharedconfigsharedcredentialsr name) _get_provider_by_canonical_namelower_get_provider_by_methodrV r )rh canonical_namer r\ s r: rr z,CanonicalNameCredentialSourcer._get_provider9 sv 77G !%J J#'#?#? #N #/ #// *+?*JKK (n= =r< c | j D ]6 }|j }|s|j |j k( s4|c S y)zReturn a credential provider by its canonical name. This function is strict, it does not attempt to address compatibility issues. N)rm r rz )rh r| r rx s r: ry z>CanonicalNameCredentialSourcer._get_provider_by_canonical_name_ s; H**D (<(<(>> (r< c L | j D ] }|j |k( s|c S y)z0Return a credential provider by its METHOD name.N)rm r )rh r r s r: r{ z6CanonicalNameCredentialSourcer._get_provider_by_methodk s! H&( (r< N) r r r rj r6 ro rr ry r{ r r< r: rP rP s" $ J $L r< rP c P e Zd ZdZdZdZdZdZdZddZ d Z d Z d Z d Z d Zd Zy)rK zcontainer-role EcsContainer&AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"AWS_CONTAINER_CREDENTIALS_FULL_URI!AWS_CONTAINER_AUTHORIZATION_TOKEN&AWS_CONTAINER_AUTHORIZATION_TOKEN_FILENc \ |t j }| t }|| _ || _ y r6 )r8 r r r _fetcher)rh r r s r: rj zContainerProvider.__init__z s+ ?jjG ?.0G r< c | j | j v s| j | j v r| j S y r6 )ENV_VARr ENV_VAR_FULL_retrieve_or_failru s r: r zContainerProvider.load s: <<4== (D,=,= ,N))+ + -Or< c J | j r3| j j | j | j }n| j | j }| j | } | }t |d |d |d | j t |d | S )Nr! r" r# r )r! r" r# r r r ) _provided_relative_urir full_urlr r r _create_fetcherr r r )rh full_urir rD s r: r z#ContainerProvider._retrieve_or_fail s & & (}}--dmmDLL.IJH}}T%6%67H&&x0 % \* \*.;;(})=>! r< c \ d }| j | j v r>| j | j }t | 5 }|j }d d d n1| j | j v r| j | j }|| j | d|iS y # 1 sw Y !xY w)N Authorization)ENV_VAR_AUTH_TOKEN_FILEr openreadENV_VAR_AUTH_TOKEN_validate_auth_token)rh auth_tokenauth_token_file_path token_files r: _build_headersz ContainerProvider._build_headers s ' '4== 8#'==1M1M#N *+z '__ . ,+ $ $ 5 t'>'>?J ! % %j 1#Z0 0 " ,+s B""B+c * d|v sd|v r t d y )N z,Auth token value is not a legal header value)r2 )rh r s r: r z&ContainerProvider._validate_auth_token s" : !3 KL L "4r< c fd}|S )Nc j } j j | }|d |d |d |d d S # t $ r=}t j d|d t j t | d }~ww xY w) N)headersz'Error retrieving container metadata: %sTr r r r Tokenr r ) r r retrieve_full_urir rT rU r r rO )r r r r rh s r: fetch_credsz6ContainerProvider._create_fetcher.<locals>.fetch_creds s --/ ==:: g ; '} 5 &'8 9!'* ' 5 * =q4 / ![[CF s -A B 8BB r )rh r rf r r s `` r: r z!ContainerProvider._create_fetcher s ( r< c 2 | j | j v S r6 )r r ru s r: r z(ContainerProvider._provided_relative_uri s ||t}},,r< r )r r r r r r r r r rj r r r r r r r r< r: rK rK r sF F#N6G7L< F , 1M.-r< rK c 6 e Zd Zd Zd Zd Zd Zd Zd Zd Z y) rV c || _ y)zQ :param providers: A list of ``CredentialProvider`` instances. NrD rn s r: rj zCredentialResolver.__init__ s #r< c | j D cg c] }|j c}j | }| j j || yc c}w # t $ r t | w xY w)a= Inserts a new instance of ``CredentialProvider`` into the chain that will be tried before an existing one. :param name: The short name of the credentials you'd like to insert the new credentials before. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` rw N)rE r indexr2 r insert)rh rx credential_providerr offsets r: insert_beforez CredentialResolver.insert_before sd 4(,71ahh7==dCF f&9: 8 4(d3 3 4s A AA A A-c d | j | }| j j |dz | y)a9 Inserts a new type of ``Credentials`` instance into the chain that will be tried after an existing one. :param name: The short name of the credentials you'd like to insert the new credentials after. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` r N)_get_provider_offsetrE r )rh rx r r s r: insert_afterz CredentialResolver.insert_after s- **40 fqj*=>r< c | j D cg c] }|j }}||vry|j | }| j j | yc c}w )z Removes a given ``Credentials`` instance from the chain. :param name: The short name of the credentials instance to remove. :type name: string N)rE r r pop)rh rx r available_methodsr s r: rS zCredentialResolver.remove sT 04~~ >~!QXX~ > ( ( "((. 6" ?s Ac > | j | j | S )zReturn a credential provider by name. :type name: str :param name: The name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. )rE r )rh rx s r: get_providerz CredentialResolver.get_provider s ~~d 7 7 =>>r< c | j D cg c] }|j c}j | S c c}w # t $ r t | w xY w)Nrw )rE r r r2 r )rh rx r s r: r z'CredentialResolver._get_provider_offset sL 4&*nn5nAHHn5;;DA A5 4(d3 3 4s : 5: : Ac | j D ]8 }t j d|j |j }|6|c S y)zw Goes through the credentials chain, returning the first ``Credentials`` that could be loaded. z Looking for credentials via: %sN)rE rT rU r r )rh r rD s r: r z#CredentialResolver.load_credentials s@ H LL:HOO L MMOE ' r< N) r r r rj r r rS r r r r r< r: rV rV s% #;(?" # ?4 r< rV c @ e Zd ZdZ d fd Zd Zd Zd Z xZS )SSOCredentialFetcherz%Y-%m-%dT%H:%M:%SZc || _ || _ || _ || _ || _ || _ | | _ | | _ t | % || y r6 ) rP _sso_region _role_name _account_id _start_url _token_loader_token_provider_sso_session_namer$ rj ) rh start_url sso_regionr account_idr> rj r3 r/ r sso_session_namer% s r: rj z SSOCredentialFetcher.__init__* sS . %#%# ) - !1 56r< c , | j | j d}| j r| j |d< n| j |d< t j |dd }t |j d j }| j | S )r\ )roleName accountId sessionNamestartUrlT),r4 )r^ separatorsr_ ) r r r r r` rb r rc rd r; re s r: r+ z&SSOCredentialFetcher._create_cache_keyA s )) ! !"&"8"8D #D zz$$:F T[[ 12<<> ##M22r< c |dz }t j j |t }|j | j S )Ng @@)r fromtimestampr r _UTC_DATE_FORMAT)rh timestamp_mstimestamp_seconds timestamps r: _parse_timestampz%SSOCredentialFetcher._parse_timestampW s? (6 1 %%334EuwO !!$"7"788r< c t t | j }| j d| }| j r5| j j }|j j }n | j | j d }| j | j |d} |j d i |}|d }d|d |d |d | j! |d d d }|S # |j j $ r t w xY w)z4Get credentials by calling SSO get role credentials.)r r4 ssor accessToken)r r r roleCredentials accessKeyIdsecretAccessKey sessionTokenrE )r r r r ) ProviderTyper r )r r r rP r load_tokenget_frozen_tokenr# r r r r get_role_credentials exceptionsUnauthorizedExceptionr r )rh r1 r initial_token_datar# r r r s r: r= z%SSOCredentialFetcher._get_credentials] s( & (( %%eF%; !%!5!5!@!@!B &779??E&&t7 FE )) .2v22<V<H 01 " *= 9#./@#A +N ; " 3 3K 4M N 66 .+- - .s )C' '$D )NNNNN) r r r r rj r+ r r= r& r' s @r: r r ' s. + " 7.3,9 !r< r c e Zd ZdZej j ej j dddd ZdZ dZ e e z Z d dZ d Z d Zd Zy) r r ~z.awsr3 ) sso_role_namesso_account_id) sso_start_urlr Nc |t | j }|| _ || _ |i }|| _ || _ || _ || _ y r6 )r _SSO_TOKEN_CACHE_DIR _token_cacher r3 r rP r )rh r= r> r? r3 r r s r: rj zSSOProvider.__init__ sS '(A(ABK ' - =E ' - )r< c | j }|j di }| j }|j | j i |j di }t fd| j D ry | j | \ }}i }g }| j |z } | D ] } | |v r || || < |j | " |r#dj | } t d|d| |S )Nr sso_sessionsc 3 & K | ] }|v y wr6 r )rB cr s r: rD z/SSOProvider._load_sso_config.<locals>.<genexpr> s -OA^ #-OrE r z The profile "zB" is configured to use SSO but is missing required configuration: r1 ) r rH r all _PROFILE_REQUIRED_CONFIG_VARS _resolve_sso_session_reference_ALL_REQUIRED_CONFIG_VARSr r r ) rh r_ r r? r resolved_config extra_reqsr1 missing_config_varsall_required_configs config_varmissingr s @r: _load_sso_configz SSOProvider._load_sso_config s ))+ $$Z4)) ! d&8&8"=$(( < -1-O-O &*&I&I L' # # = = J .J_,%4Z%@z"#**:6 / ii 34G$ 5A'K r< c ( |j d }||dfS ||vrd| d}t | |j }|| }|j D ]: \ }}|j || |k7 rd| d|| d| d }t | |||< < |d fS ) N sso_sessionr z+The specified sso-session does not exist: ""r1 zThe value for z" is inconsistent between profile (z) and sso-session (z).)r )rH r copyitems) rh r r r r r1 r9 r vals r: r z*SSOProvider._resolve_sso_session_reference s )--m< #!2% % < /EFVEWWXYI$y9 9 $$& /0 &}}OJzz*c*c1$ZL 1 &z 2 33Fse2O )9==!$F: / '''r< c 2 | j }|sy |d |d |d |d | j t | j | j d}d|v r|d |d< | j |d < t d i |}t | j |j S ) Nr r r r )r3 )r r r r r> rj r3 r r r r r ) r rP r r r3 r r r! r r@ )rh sso_configfetcher_kwargs sso_fetchers r: r zSSOProvider.load s **, $O4$\2#O4$%56 " 2 2 *1B1B CZZ J &1;M1JN- ./3/C/CN+ ,*<^< -;;%77 r< r )r r r r r8 r r r r r _SSO_REQUIRED_CONFIG_VARSr rj r r r r r< r: r r sr F 77-- S&%1 %!! &(AA *("H(. r< r r r )Tr rn r` loggingr8 r r rZ collectionsr r r hashlibr dateutil.parserr dateutil.tzr r botocore.compatr botocore.configloaderr r r botocore.configr botocore.exceptionsr r r r r r r r r botocore.tokensr botocore.utilsr r r r r r r getLoggerr rT r r rI ra rM r r r r rO r r r r r! r) rL ri r r rw rL rJ rQ r| r rR rN r rP rK rV r r r r< r: <module>r s " ! & = " - 8 $ @ &- "$+ !]@J J Z' , &$# # Le([ e(P 2%; 2.B5 B5J23&= 23jW "A W t@"#@"F+ +\G8( G8T 1 :{!$ {!| , F+, 1 +,\92' 92x*% *ZE+ EP V (: V rU U pN-* N-ba aHW2 Wtx $ x r<