Repository navigation
Expand file tree
/
Copy pathaws.ts
More file actions
74 lines (63 loc) · 2.25 KB
/
Copy pathaws.ts
File metadata and controls
74 lines (63 loc) · 2.25 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
import { logForDebugging } from './debug.js'
/** AWS short-term credentials format. */
export type AwsCredentials = {
AccessKeyId: string
SecretAccessKey: string
SessionToken: string
Expiration?: string
}
/** Output from `aws sts get-session-token` or `aws sts assume-role`. */
export type AwsStsOutput = {
Credentials: AwsCredentials
}
type AwsError = {
name: string
}
export function isAwsCredentialsProviderError(err: unknown) {
return (err as AwsError | undefined)?.name === 'CredentialsProviderError'
}
/** Typeguard to validate AWS STS assume-role output */
export function isValidAwsStsOutput(obj: unknown): obj is AwsStsOutput {
if (!obj || typeof obj !== 'object') {
return false
}
const output = obj as Record<string, unknown>
// Check if Credentials exists and has required fields
if (!output.Credentials || typeof output.Credentials !== 'object') {
return false
}
const credentials = output.Credentials as Record<string, unknown>
return (
typeof credentials.AccessKeyId === 'string' &&
typeof credentials.SecretAccessKey === 'string' &&
typeof credentials.SessionToken === 'string' &&
credentials.AccessKeyId.length > 0 &&
credentials.SecretAccessKey.length > 0 &&
credentials.SessionToken.length > 0
)
}
/** Throws if STS caller identity cannot be retrieved. */
export async function checkStsCallerIdentity(): Promise<void> {
const { STSClient, GetCallerIdentityCommand } = await import(
'@aws-sdk/client-sts'
)
await new STSClient().send(new GetCallerIdentityCommand({}))
}
/**
* Clear AWS credential provider cache by forcing a refresh
* This ensures that any changes to ~/.aws/credentials are picked up immediately
*/
export async function clearAwsIniCache(): Promise<void> {
try {
logForDebugging('Clearing AWS credential provider cache')
const { fromIni } = await import('@aws-sdk/credential-providers')
const iniProvider = fromIni({ ignoreCache: true })
await iniProvider() // This updates the global file cache
logForDebugging('AWS credential provider cache refreshed')
} catch (_error) {
// Ignore errors - we're just clearing the cache
logForDebugging(
'Failed to clear AWS credential cache (this is expected if no credentials are configured)',
)
}
}