aws/credential: Add credential_process provider (#2217)

Adds support for the shared configuration file's `credential_process` property. This property allows the application to execute a command in order to retrieve AWS credentials for AWS service API request.  In order to use this feature your application must enable the SDK's support of the shared configuration file. See, https://docs.aws.amazon.com/sdk-for-go/api/aws/session/#hdr-Sessions_from_Shared_Config for more information on enabling shared config support.

Fixes #1834

aws/credentials/processcreds/testdata/expired.json

@@ -0,0 +1,7 @@
+{
+    "Version": 1, 
+    "AccessKeyId": "accessKey", 
+    "SecretAccessKey": "secret", 
+    "SessionToken": "tokenDefault", 
+    "Expiration": "2000-01-01T00:00:00-00:00"
+}

aws/credentials/processcreds/testdata/malformed.json

@@ -0,0 +1,2 @@
+{
+    "Version": 1

aws/credentials/processcreds/testdata/missingkey.json

@@ -0,0 +1,4 @@
+{
+    "Version": 1,
+    "AccessKeyId": "accesskey"
+}

aws/credentials/processcreds/testdata/missingsecret.json

@@ -0,0 +1,4 @@
+{
+    "Version": 1, 
+    "SecretAccessKey": "secretkey"
+}

aws/credentials/processcreds/testdata/nonexpire.json

@@ -0,0 +1,6 @@
+{
+    "Version": 1, 
+    "AccessKeyId": "accessKey", 
+    "SecretAccessKey": "secret", 
+    "SessionToken": "nonDefaultToken"
+}

aws/credentials/processcreds/testdata/shconfig.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = cat ./testdata/expired.json
+
+[profile non_expire]
+credential_process = cat ./testdata/nonexpire.json 
+
+[profile not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = cat ./testdata/verybad.json 

aws/credentials/processcreds/testdata/shconfig_win.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = type .\testdata\expired.json
+
+[profile non_expire]
+credential_process = type .\testdata\nonexpire.json
+
+[profile not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = type .\testdata\verybad.json 

aws/credentials/processcreds/testdata/shcred.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = cat ./testdata/expired.json
+
+[non_expire]
+credential_process = cat ./testdata/nonexpire.json 
+
+[not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = cat ./testdata/verybad.json 

aws/credentials/processcreds/testdata/shcred_win.ini

@@ -0,0 +1,10 @@
+[default]
+credential_process = type .\testdata\expired.json
+
+[non_expire]
+credential_process = type .\testdata\nonexpire.json
+
+[not_alone]
+aws_access_key_id = notFromCredProcAccess
+aws_secret_access_key = notFromCredProcSecret
+credential_process = type .\testdata\verybad.json 

aws/credentials/processcreds/testdata/static.json

@@ -0,0 +1,5 @@
+{
+    "Version":1,
+    "AccessKeyId":"accesskey",
+    "SecretAccessKey":"secretkey"
+}

aws/credentials/processcreds/testdata/verybad.json

@@ -0,0 +1,5 @@
+{
+    "Version":1,
+    "AccessKeyId":"veryBadAccessKeyID",
+    "SecretAccessKey":"veryBadSecretAccessKey"
+}

aws/credentials/processcreds/testdata/wrongversion.json

@@ -0,0 +1,3 @@
+{
+    "Version": 2
+}

aws/session/session.go

@@ -14,6 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/client"
 	"github.com/aws/aws-sdk-go/aws/corehandlers"
 	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/credentials/processcreds"
 	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
 	"github.com/aws/aws-sdk-go/aws/csm"
 	"github.com/aws/aws-sdk-go/aws/defaults"
@@ -534,6 +535,10 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config, envCfg envConfig, sharedCfg share
 			cfg.Credentials = credentials.NewStaticCredentialsFromCreds(
 				sharedCfg.Creds,
 			)
+		} else if len(sharedCfg.CredentialProcess) > 0 {
+			cfg.Credentials = processcreds.NewCredentials(
+				sharedCfg.CredentialProcess,
+			)
 		} else {
 			// Fallback to default credentials provider, include mock errors
 			// for the credential chain so user can identify why credentials

aws/session/shared_config.go

@@ -28,6 +28,8 @@ const (
 
 	// endpoint discovery group
 	enableEndpointDiscoveryKey = `endpoint_discovery_enabled` // optional
+	// External Credential Process
+	credentialProcessKey = `credential_process`
 
 	// DefaultSharedConfigProfile is the default profile to be used when
 	// loading configuration from the config files if another profile name
@@ -60,6 +62,9 @@ type sharedConfig struct {
 	AssumeRole       assumeRoleConfig
 	AssumeRoleSource *sharedConfig
 
+	// An external process to request credentials
+	CredentialProcess string
+
 	// Region is the region the SDK should use for looking up AWS service endpoints
 	// and signing requests.
 	//
@@ -223,6 +228,11 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile) e
 		}
 	}
 
+	// `credential_process`
+	if credProc := section.String(credentialProcessKey); len(credProc) > 0 {
+		cfg.CredentialProcess = credProc
+	}
+
 	// Region
 	if v := section.String(regionKey); len(v) > 0 {
 		cfg.Region = v