1 files changed, 238 insertions, 101 deletions

diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go b/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go
index 7cb4402..5170b49 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go
@@ -5,7 +5,6 @@ import (
 
         "github.com/aws/aws-sdk-go/aws/awserr"
         "github.com/aws/aws-sdk-go/aws/credentials"
-
         "github.com/aws/aws-sdk-go/internal/ini"
 )
 
@@ -28,8 +27,12 @@ const (
 
         // endpoint discovery group
         enableEndpointDiscoveryKey = `endpoint_discovery_enabled` // optional
+
         // External Credential Process
-        credentialProcessKey = `credential_process`
+        credentialProcessKey = `credential_process` // optional
+
+        // Web Identity Token File
+        webIdentityTokenFileKey = `web_identity_token_file` // optional
 
         // DefaultSharedConfigProfile is the default profile to be used when
         // loading configuration from the config files if another profile name
@@ -37,36 +40,33 @@ const (
         DefaultSharedConfigProfile = `default`
 )
 
-type assumeRoleConfig struct {
-        RoleARN          string
-        SourceProfile    string
-        CredentialSource string
-        ExternalID       string
-        MFASerial        string
-        RoleSessionName  string
-}
-
 // sharedConfig represents the configuration fields of the SDK config files.
 type sharedConfig struct {
-        // Credentials values from the config file. Both aws_access_key_id
-        // and aws_secret_access_key must be provided together in the same file
-        // to be considered valid. The values will be ignored if not a complete group.
-        // aws_session_token is an optional field that can be provided if both of the
-        // other two fields are also provided.
+        // Credentials values from the config file. Both aws_access_key_id and
+        // aws_secret_access_key must be provided together in the same file to be
+        // considered valid. The values will be ignored if not a complete group.
+        // aws_session_token is an optional field that can be provided if both of
+        // the other two fields are also provided.
         //
         //      aws_access_key_id
         //      aws_secret_access_key
         //      aws_session_token
         Creds credentials.Value
 
-        AssumeRole       assumeRoleConfig
-        AssumeRoleSource *sharedConfig
+        CredentialSource     string
+        CredentialProcess    string
+        WebIdentityTokenFile string
+
+        RoleARN         string
+        RoleSessionName string
+        ExternalID      string
+        MFASerial       string
 
-        // An external process to request credentials
-        CredentialProcess string
+        SourceProfileName string
+        SourceProfile     *sharedConfig
 
-        // Region is the region the SDK should use for looking up AWS service endpoints
-        // and signing requests.
+        // Region is the region the SDK should use for looking up AWS service
+        // endpoints and signing requests.
         //
         //      region
         Region string
@@ -83,17 +83,18 @@ type sharedConfigFile struct {
         IniData  ini.Sections
 }
 
-// loadSharedConfig retrieves the configuration from the list of files
-// using the profile provided. The order the files are listed will determine
+// loadSharedConfig retrieves the configuration from the list of files using
+// the profile provided. The order the files are listed will determine
 // precedence. Values in subsequent files will overwrite values defined in
 // earlier files.
 //
 // For example, given two files A and B. Both define credentials. If the order
-// of the files are A then B, B's credential values will be used instead of A's.
+// of the files are A then B, B's credential values will be used instead of
+// A's.
 //
 // See sharedConfig.setFromFile for information how the config files
 // will be loaded.
-func loadSharedConfig(profile string, filenames []string) (sharedConfig, error) {
+func loadSharedConfig(profile string, filenames []string, exOpts bool) (sharedConfig, error) {
         if len(profile) == 0 {
                 profile = DefaultSharedConfigProfile
         }
@@ -104,16 +105,11 @@ func loadSharedConfig(profile string, filenames []string) (sharedConfig, error)
         }
 
         cfg := sharedConfig{}
-        if err = cfg.setFromIniFiles(profile, files); err != nil {
+        profiles := map[string]struct{}{}
+        if err = cfg.setFromIniFiles(profiles, profile, files, exOpts); err != nil {
                 return sharedConfig{}, err
         }
 
-        if len(cfg.AssumeRole.SourceProfile) > 0 {
-                if err := cfg.setAssumeRoleSource(profile, files); err != nil {
-                        return sharedConfig{}, err
-                }
-        }
-
         return cfg, nil
 }
 
@@ -137,60 +133,88 @@ func loadSharedConfigIniFiles(filenames []string) ([]sharedConfigFile, error) {
         return files, nil
 }
 
-func (cfg *sharedConfig) setAssumeRoleSource(origProfile string, files []sharedConfigFile) error {
-        var assumeRoleSrc sharedConfig
-
-        if len(cfg.AssumeRole.CredentialSource) > 0 {
-                // setAssumeRoleSource is only called when source_profile is found.
-                // If both source_profile and credential_source are set, then
-                // ErrSharedConfigSourceCollision will be returned
-                return ErrSharedConfigSourceCollision
+func (cfg *sharedConfig) setFromIniFiles(profiles map[string]struct{}, profile string, files []sharedConfigFile, exOpts bool) error {
+        // Trim files from the list that don't exist.
+        var skippedFiles int
+        var profileNotFoundErr error
+        for _, f := range files {
+                if err := cfg.setFromIniFile(profile, f, exOpts); err != nil {
+                        if _, ok := err.(SharedConfigProfileNotExistsError); ok {
+                                // Ignore profiles not defined in individual files.
+                                profileNotFoundErr = err
+                                skippedFiles++
+                                continue
+                        }
+                        return err
+                }
+        }
+        if skippedFiles == len(files) {
+                // If all files were skipped because the profile is not found, return
+                // the original profile not found error.
+                return profileNotFoundErr
         }
 
-        // Multiple level assume role chains are not support
-        if cfg.AssumeRole.SourceProfile == origProfile {
-                assumeRoleSrc = *cfg
-                assumeRoleSrc.AssumeRole = assumeRoleConfig{}
+        if _, ok := profiles[profile]; ok {
+                // if this is the second instance of the profile the Assume Role
+                // options must be cleared because they are only valid for the
+                // first reference of a profile. The self linked instance of the
+                // profile only have credential provider options.
+                cfg.clearAssumeRoleOptions()
         } else {
-                err := assumeRoleSrc.setFromIniFiles(cfg.AssumeRole.SourceProfile, files)
-                if err != nil {
+                // First time a profile has been seen, It must either be a assume role
+                // or credentials. Assert if the credential type requires a role ARN,
+                // the ARN is also set.
+                if err := cfg.validateCredentialsRequireARN(profile); err != nil {
                         return err
                 }
         }
+        profiles[profile] = struct{}{}
 
-        if len(assumeRoleSrc.Creds.AccessKeyID) == 0 {
-                return SharedConfigAssumeRoleError{RoleARN: cfg.AssumeRole.RoleARN}
+        if err := cfg.validateCredentialType(); err != nil {
+                return err
         }
 
-        cfg.AssumeRoleSource = &assumeRoleSrc
-
-        return nil
-}
+        // Link source profiles for assume roles
+        if len(cfg.SourceProfileName) != 0 {
+                // Linked profile via source_profile ignore credential provider
+                // options, the source profile must provide the credentials.
+                cfg.clearCredentialOptions()
 
-func (cfg *sharedConfig) setFromIniFiles(profile string, files []sharedConfigFile) error {
-        // Trim files from the list that don't exist.
-        for _, f := range files {
-                if err := cfg.setFromIniFile(profile, f); err != nil {
+                srcCfg := &sharedConfig{}
+                err := srcCfg.setFromIniFiles(profiles, cfg.SourceProfileName, files, exOpts)
+                if err != nil {
+                        // SourceProfile that doesn't exist is an error in configuration.
                         if _, ok := err.(SharedConfigProfileNotExistsError); ok {
-                                // Ignore proviles missings
-                                continue
+                                err = SharedConfigAssumeRoleError{
+                                        RoleARN:       cfg.RoleARN,
+                                        SourceProfile: cfg.SourceProfileName,
+                                }
                         }
                         return err
                 }
+
+                if !srcCfg.hasCredentials() {
+                        return SharedConfigAssumeRoleError{
+                                RoleARN:       cfg.RoleARN,
+                                SourceProfile: cfg.SourceProfileName,
+                        }
+                }
+
+                cfg.SourceProfile = srcCfg
         }
 
         return nil
 }
 
-// setFromFile loads the configuration from the file using
-// the profile provided. A sharedConfig pointer type value is used so that
-// multiple config file loadings can be chained.
+// setFromFile loads the configuration from the file using the profile
+// provided. A sharedConfig pointer type value is used so that multiple config
+// file loadings can be chained.
 //
 // Only loads complete logically grouped values, and will not set fields in cfg
-// for incomplete grouped values in the config. Such as credentials. For example
-// if a config file only includes aws_access_key_id but no aws_secret_access_key
-// the aws_access_key_id will be ignored.
-func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile) error {
+// for incomplete grouped values in the config. Such as credentials. For
+// example if a config file only includes aws_access_key_id but no
+// aws_secret_access_key the aws_access_key_id will be ignored.
+func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile, exOpts bool) error {
         section, ok := file.IniData.GetSection(profile)
         if !ok {
                 // Fallback to to alternate profile name: profile <name>
@@ -200,42 +224,30 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile) e
                 }
         }
 
-        // Shared Credentials
-        akid := section.String(accessKeyIDKey)
-        secret := section.String(secretAccessKey)
-        if len(akid) > 0 && len(secret) > 0 {
-                cfg.Creds = credentials.Value{
-                        AccessKeyID:     akid,
-                        SecretAccessKey: secret,
-                        SessionToken:    section.String(sessionTokenKey),
-                        ProviderName:    fmt.Sprintf("SharedConfigCredentials: %s", file.Filename),
-                }
-        }
+        if exOpts {
+                // Assume Role Parameters
+                updateString(&cfg.RoleARN, section, roleArnKey)
+                updateString(&cfg.ExternalID, section, externalIDKey)
+                updateString(&cfg.MFASerial, section, mfaSerialKey)
+                updateString(&cfg.RoleSessionName, section, roleSessionNameKey)
+                updateString(&cfg.SourceProfileName, section, sourceProfileKey)
+                updateString(&cfg.CredentialSource, section, credentialSourceKey)
 
-        // Assume Role
-        roleArn := section.String(roleArnKey)
-        srcProfile := section.String(sourceProfileKey)
-        credentialSource := section.String(credentialSourceKey)
-        hasSource := len(srcProfile) > 0 || len(credentialSource) > 0
-        if len(roleArn) > 0 && hasSource {
-                cfg.AssumeRole = assumeRoleConfig{
-                        RoleARN:          roleArn,
-                        SourceProfile:    srcProfile,
-                        CredentialSource: credentialSource,
-                        ExternalID:       section.String(externalIDKey),
-                        MFASerial:        section.String(mfaSerialKey),
-                        RoleSessionName:  section.String(roleSessionNameKey),
-                }
+                updateString(&cfg.Region, section, regionKey)
         }
 
-        // `credential_process`
-        if credProc := section.String(credentialProcessKey); len(credProc) > 0 {
-                cfg.CredentialProcess = credProc
-        }
+        updateString(&cfg.CredentialProcess, section, credentialProcessKey)
+        updateString(&cfg.WebIdentityTokenFile, section, webIdentityTokenFileKey)
 
-        // Region
-        if v := section.String(regionKey); len(v) > 0 {
-                cfg.Region = v
+        // Shared Credentials
+        creds := credentials.Value{
+                AccessKeyID:     section.String(accessKeyIDKey),
+                SecretAccessKey: section.String(secretAccessKey),
+                SessionToken:    section.String(sessionTokenKey),
+                ProviderName:    fmt.Sprintf("SharedConfigCredentials: %s", file.Filename),
+        }
+        if creds.HasKeys() {
+                cfg.Creds = creds
         }
 
         // Endpoint discovery
@@ -247,6 +259,95 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile) e
         return nil
 }
 
+func (cfg *sharedConfig) validateCredentialsRequireARN(profile string) error {
+        var credSource string
+
+        switch {
+        case len(cfg.SourceProfileName) != 0:
+                credSource = sourceProfileKey
+        case len(cfg.CredentialSource) != 0:
+                credSource = credentialSourceKey
+        case len(cfg.WebIdentityTokenFile) != 0:
+                credSource = webIdentityTokenFileKey
+        }
+
+        if len(credSource) != 0 && len(cfg.RoleARN) == 0 {
+                return CredentialRequiresARNError{
+                        Type:    credSource,
+                        Profile: profile,
+                }
+        }
+
+        return nil
+}
+
+func (cfg *sharedConfig) validateCredentialType() error {
+        // Only one or no credential type can be defined.
+        if !oneOrNone(
+                len(cfg.SourceProfileName) != 0,
+                len(cfg.CredentialSource) != 0,
+                len(cfg.CredentialProcess) != 0,
+                len(cfg.WebIdentityTokenFile) != 0,
+        ) {
+                return ErrSharedConfigSourceCollision
+        }
+
+        return nil
+}
+
+func (cfg *sharedConfig) hasCredentials() bool {
+        switch {
+        case len(cfg.SourceProfileName) != 0:
+        case len(cfg.CredentialSource) != 0:
+        case len(cfg.CredentialProcess) != 0:
+        case len(cfg.WebIdentityTokenFile) != 0:
+        case cfg.Creds.HasKeys():
+        default:
+                return false
+        }
+
+        return true
+}
+
+func (cfg *sharedConfig) clearCredentialOptions() {
+        cfg.CredentialSource = ""
+        cfg.CredentialProcess = ""
+        cfg.WebIdentityTokenFile = ""
+        cfg.Creds = credentials.Value{}
+}
+
+func (cfg *sharedConfig) clearAssumeRoleOptions() {
+        cfg.RoleARN = ""
+        cfg.ExternalID = ""
+        cfg.MFASerial = ""
+        cfg.RoleSessionName = ""
+        cfg.SourceProfileName = ""
+}
+
+func oneOrNone(bs ...bool) bool {
+        var count int
+
+        for _, b := range bs {
+                if b {
+                        count++
+                        if count > 1 {
+                                return false
+                        }
+                }
+        }
+
+        return true
+}
+
+// updateString will only update the dst with the value in the section key, key
+// is present in the section.
+func updateString(dst *string, section ini.Section, key string) {
+        if !section.Has(key) {
+                return
+        }
+        *dst = section.String(key)
+}
+
 // SharedConfigLoadError is an error for the shared config file failed to load.
 type SharedConfigLoadError struct {
         Filename string
@@ -304,7 +405,8 @@ func (e SharedConfigProfileNotExistsError) Error() string {
 // profile contains assume role information, but that information is invalid
 // or not complete.
 type SharedConfigAssumeRoleError struct {
-        RoleARN string
+        RoleARN       string
+        SourceProfile string
 }
 
 // Code is the short id of the error.
@@ -314,8 +416,10 @@ func (e SharedConfigAssumeRoleError) Code() string {
 
 // Message is the description of the error
 func (e SharedConfigAssumeRoleError) Message() string {
-        return fmt.Sprintf("failed to load assume role for %s, source profile has no shared credentials",
-                e.RoleARN)
+        return fmt.Sprintf(
+                "failed to load assume role for %s, source profile %s has no shared credentials",
+                e.RoleARN, e.SourceProfile,
+        )
 }
 
 // OrigErr is the underlying error that caused the failure.
@@ -327,3 +431,36 @@ func (e SharedConfigAssumeRoleError) OrigErr() error {
 func (e SharedConfigAssumeRoleError) Error() string {
         return awserr.SprintError(e.Code(), e.Message(), "", nil)
 }
+
+// CredentialRequiresARNError provides the error for shared config credentials
+// that are incorrectly configured in the shared config or credentials file.
+type CredentialRequiresARNError struct {
+        // type of credentials that were configured.
+        Type string
+
+        // Profile name the credentials were in.
+        Profile string
+}
+
+// Code is the short id of the error.
+func (e CredentialRequiresARNError) Code() string {
+        return "CredentialRequiresARNError"
+}
+
+// Message is the description of the error
+func (e CredentialRequiresARNError) Message() string {
+        return fmt.Sprintf(
+                "credential type %s requires role_arn, profile %s",
+                e.Type, e.Profile,
+        )
+}
+
+// OrigErr is the underlying error that caused the failure.
+func (e CredentialRequiresARNError) OrigErr() error {
+        return nil
+}
+
+// Error satisfies the error interface.
+func (e CredentialRequiresARNError) Error() string {
+        return awserr.SprintError(e.Code(), e.Message(), "", nil)
+}