Prioritize assume role credentials and deprecate built-in network providers (smithy-lang#773)

* Move PROFILE_ASSUME_ROLE before PROFILE_SESSION_KEYS and PROFILE_STATIC_KEYS in StandardProvider

* Update profile session and static key providers to defer when assume role configuration exists in profile

* Update env credentials provider to defer when profile_name is configured in IdentityChain.create()

* Add deprecation notices to IMDSCredentialsResolver and ContainerCredentialsResolver

Author: arandito

packages/smithy-aws-core/.changes/next-release/smithy-aws-core-breaking-3ecac569c6ea4f2691d472816fde80ae.json

@@ -0,0 +1,4 @@
+{
+  "type": "breaking",
+  "description": "Updated the credential chain precedence so assume role credentials are resolved before session and static profile keys."
+}

packages/smithy-aws-core/.changes/next-release/smithy-aws-core-enhancement-168e61426c534a2f92107d39f9241a9e.json

@@ -0,0 +1,4 @@
+{
+  "type": "enhancement",
+  "description": "Updated profile session and static key providers to defer when the selected profile declares an assume-role configuration."
+}

packages/smithy-aws-core/.changes/next-release/smithy-aws-core-enhancement-6fb937c32d5448e88bf1d5f8246389af.json

@@ -0,0 +1,4 @@
+{
+  "type": "enhancement",
+  "description": "Deprecated the built-in IMDS and container credentials resolvers in favor of the resolvers provided by the `aws-credentials-imds` and `aws-credentials-http` packages."
+}

packages/smithy-aws-core/.changes/next-release/smithy-aws-core-enhancement-e32f94fda81c4875a1e24a804eef9788.json

@@ -0,0 +1,4 @@
+{
+  "type": "enhancement",
+  "description": "Updated environment credentials provider to defer when `profile_name` is passed to `IdentityChain.create()`."
+}

packages/smithy-aws-core/src/smithy_aws_core/identity/chain/__init__.py

@@ -185,8 +185,9 @@ async def create[ChainIdentity: Identity](
         :param identity_type: The identity type to resolve.
         :param config_file: Parsed config/credentials file. Loaded from disk
             when not set.
-        :param profile_name: Profile name to use. If omitted, the shared config
-            provider uses ``AWS_PROFILE`` when set, otherwise ``default``.
+        :param profile_name: Explicit profile name to use. When set, top-level
+            environment credential resolution is suppressed. If omitted, the shared
+            config provider uses ``AWS_PROFILE`` when set, otherwise ``default``.
         :param region_override: Region to use for providers whose resolvers
             fetch credentials through a service call.
         :param http_client: HTTP client to use for providers whose resolvers make

packages/smithy-aws-core/src/smithy_aws_core/identity/chain/ordering.py

@@ -13,9 +13,9 @@ class StandardProvider(Enum):
     ENVIRONMENT = "Environment", None
     WEB_IDENTITY_TOKEN_ENV = "WebIdentityTokenEnv", "aws-credentials-sts"
     SHARED_CONFIG = "SharedConfig", None
+    PROFILE_ASSUME_ROLE = "ProfileAssumeRole", "aws-credentials-sts"
     PROFILE_SESSION_KEYS = "ProfileSessionKeys", None
     PROFILE_STATIC_KEYS = "ProfileStaticKeys", None
-    PROFILE_ASSUME_ROLE = "ProfileAssumeRole", "aws-credentials-sts"
     PROFILE_WEB_IDENTITY = "ProfileWebIdentity", "aws-credentials-sts"
     PROFILE_SSO_SESSION = "ProfileSsoSession", "aws-credentials-sso"
     PROFILE_LOGIN = "Login", "aws-credentials-login"

packages/smithy-aws-core/src/smithy_aws_core/identity/chain/providers/environment.py

@@ -14,7 +14,7 @@
 
 
 class EnvironmentCredentialsProvider:
-    """Adds an environment resolver when credentials are configured in the environment."""
+    """Adds an environment resolver unless an explicit profile is selected."""
 
     @property
     def name(self) -> str:
@@ -35,6 +35,9 @@ async def setup(
         if identity_type is not AWSCredentialsIdentity:
             return
 
+        if setup.profile_name is not None:
+            return
+
         if not os.getenv(_ACCESS_KEY_ID) or not os.getenv(_SECRET_ACCESS_KEY):
             return
 

packages/smithy-aws-core/src/smithy_aws_core/identity/chain/providers/profile.py

@@ -11,6 +11,7 @@
 _SECRET_ACCESS_KEY = "aws_secret_access_key"  # noqa: S105
 _SESSION_TOKEN = "aws_session_token"  # noqa: S105
 _ACCOUNT_ID = "aws_account_id"
+_ROLE_ARN = "role_arn"
 
 
 class ProfileSessionCredentialsProvider:
@@ -36,6 +37,9 @@ async def setup(self, identity_type: type[Identity], setup: ChainSetup) -> None:
         if config_file is None or profile_name is None:
             return
 
+        if config_file.get(profile_name, _ROLE_ARN) is not None:
+            return
+
         access_key_id = config_file.get(profile_name, _ACCESS_KEY_ID)
         secret_access_key = config_file.get(profile_name, _SECRET_ACCESS_KEY)
         session_token = config_file.get(profile_name, _SESSION_TOKEN)
@@ -74,6 +78,9 @@ async def setup(self, identity_type: type[Identity], setup: ChainSetup) -> None:
         if config_file is None or profile_name is None:
             return
 
+        if config_file.get(profile_name, _ROLE_ARN) is not None:
+            return
+
         access_key_id = config_file.get(profile_name, _ACCESS_KEY_ID)
         secret_access_key = config_file.get(profile_name, _SECRET_ACCESS_KEY)
         if access_key_id is None or secret_access_key is None:

packages/smithy-aws-core/src/smithy_aws_core/identity/container.py

@@ -4,6 +4,7 @@
 import ipaddress
 import json
 import os
+import warnings
 from dataclasses import dataclass
 from datetime import UTC, datetime
 from urllib.parse import urlparse
@@ -106,7 +107,12 @@ def _is_allowed_container_metadata_host(self, hostname: str) -> bool:
 class ContainerCredentialsResolver(
     IdentityResolver[AWSCredentialsIdentity, AWSIdentityProperties]
 ):
-    """Resolves AWS Credentials from container credential sources."""
+    """Resolves AWS Credentials from container credential sources.
+
+    .. warning::
+        This resolver is deprecated. Use the resolver provided by the
+        ``aws-credentials-http`` package instead.
+    """
 
     ENV_VAR = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
     ENV_VAR_FULL = "AWS_CONTAINER_CREDENTIALS_FULL_URI"
@@ -118,6 +124,12 @@ def __init__(
         http_client: HTTPClient,
         config: ContainerCredentialsConfig | None = None,
     ):
+        warnings.warn(
+            "`ContainerCredentialsResolver` is deprecated; install "
+            "`aws-credentials-http` and use its resolver instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         self._http_client = http_client
         self._config = config or ContainerCredentialsConfig()
         self._client = ContainerMetadataClient(http_client, self._config)

packages/smithy-aws-core/src/smithy_aws_core/identity/imds.py

@@ -2,6 +2,7 @@
 #  SPDX-License-Identifier: Apache-2.0
 import asyncio
 import json
+import warnings
 from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
 from types import MappingProxyType
@@ -182,11 +183,22 @@ async def get(self, *, path: str) -> str:
 class IMDSCredentialsResolver(
     IdentityResolver[AWSCredentialsIdentity, AWSIdentityProperties]
 ):
-    """Resolves AWS Credentials from an EC2 Instance Metadata Service (IMDS) client."""
+    """Resolves AWS Credentials from an EC2 Instance Metadata Service (IMDS) client.
+
+    .. warning::
+        This resolver is deprecated. Use the resolver provided by the
+        ``aws-credentials-imds`` package instead.
+    """
 
     _METADATA_PATH_BASE = "/latest/meta-data/iam/security-credentials"
 
     def __init__(self, http_client: HTTPClient, config: Config | None = None):
+        warnings.warn(
+            "`IMDSCredentialsResolver` is deprecated; install "
+            "`aws-credentials-imds` and use its resolver instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         # TODO: Respect IMDS specific config values from aws shared config file and environment.
         self._http_client = http_client
         self._ec2_metadata_client = EC2Metadata(http_client=http_client, config=config)