mirror of
https://github.com/aws-actions/configure-aws-credentials.git
synced 2026-09-01 05:45:06 +09:00
Tom Keller
378a941623
Ambient credential resolution built a bare STS client, so a web-identity token found by the SDK default chain (e.g. AWS_WEB_IDENTITY_TOKEN_FILE on a self-hosted runner) was exchanged with public STS instead of any operator-configured sts-endpoint. Resolution now passes the configured region, endpoint, and proxy handler to the default provider chain.
31 lines
1.3 KiB
TypeScript
31 lines
1.3 KiB
TypeScript
import { describe, expect, it, vi } from 'vitest';
|
|
|
|
vi.mock('@aws-sdk/credential-provider-node', () => ({
|
|
defaultProvider: vi.fn(() => async () => ({ accessKeyId: 'AKIA', secretAccessKey: 'secret' })),
|
|
}));
|
|
|
|
import { defaultProvider } from '@aws-sdk/credential-provider-node';
|
|
import { CredentialsClient } from '../src/CredentialsClient';
|
|
|
|
describe('CredentialsClient', {}, () => {
|
|
it('pins ambient credential resolution to the configured region and STS endpoint', {}, async () => {
|
|
const client = new CredentialsClient({
|
|
region: 'eu-west-1',
|
|
stsEndpoint: 'https://sts.example.com',
|
|
roleChaining: false,
|
|
});
|
|
// biome-ignore lint/suspicious/noExplicitAny: any required to call private method
|
|
await (client as any).loadCredentials();
|
|
expect(defaultProvider).toHaveBeenCalledWith({
|
|
clientConfig: expect.objectContaining({ region: 'eu-west-1', endpoint: 'https://sts.example.com' }),
|
|
});
|
|
});
|
|
|
|
it('omits unset client config values from ambient credential resolution', {}, async () => {
|
|
const client = new CredentialsClient({ region: 'eu-west-1', roleChaining: false });
|
|
// biome-ignore lint/suspicious/noExplicitAny: any required to call private method
|
|
await (client as any).loadCredentials();
|
|
expect(defaultProvider).toHaveBeenLastCalledWith({ clientConfig: { region: 'eu-west-1' } });
|
|
});
|
|
});
|