Feature/master/credential cache

.changes/next-release/bugfix-AWSSignInService-5a96d38.json

@@ -0,0 +1,6 @@
+{
+    "type": "bugfix",
+    "category": "AWS Sign-In Service",
+    "contributor": "",
+    "description": "`LoginCredentialsProvider` now defaults `asyncCredentialUpdateEnabled` to false, matching its documented behavior and the other credential providers. Credential refreshes happen on the calling thread unless the option is enabled explicitly."
+}

.changes/next-release/feature-AWSSDKforJavav2-55b76bf.json

@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "AWS SDK for Java v2",
+    "contributor": "",
+    "description": "Standardize cached credential stale/prefetch windows, improve credential refresh resilliancy (static-stability) and add automatic credential invalidation/refresh."
+}

.github/workflows/mixed-version-compatibility-review.yml

@@ -46,11 +46,10 @@ jobs:
           # Look for new public methods in the changed base class files
           # Filter out obvious false positives: comments, string literals, javadoc
           NEW_METHODS=$(git diff remotes/origin/${{ github.base_ref }} -- $BASE_CLASS_FILES | \
-
-          grep '^+.*public.*(' | \                # Find lines with new public methods
-          grep -v '^+[[:space:]]*//.*' | \        # Line comments  
-          grep -v '^+[[:space:]]*\*.*' | \        # Javadoc lines
-          grep -v '^+[[:space:]]*/\*.*' || true   # Block comments
+            grep '^+.*public.*(' | \
+            grep -v '^+[[:space:]]*//.*' | \
+            grep -v '^+[[:space:]]*\*.*' | \
+            grep -v '^+[[:space:]]*/\*.*' || true)
 
           if [ -n "$NEW_METHODS" ]; then
             echo "::warning::New public methods detected in base classes:"

build-tools/src/main/resources/software/amazon/awssdk/spotbugs-suppressions.xml

@@ -346,6 +346,7 @@
             <Class name="~software\.amazon\.awssdk\.auth\.credentials\.internal\.HttpCredentialsLoader" />
             <Class name="~software\.amazon\.awssdk\.auth\.credentials\.ContainerCredentialsProvider" />
             <Class name="~software\.amazon\.awssdk\.auth\.credentials\.InstanceProfileCredentialsProvider" />
+            <Class name="~software\.amazon\.awssdk\.core\.internal\.http\.pipeline\.stages\.utils\.AuthErrorInvalidationHelper" />
 
             <Class name="~software\.amazon\.awssdk\.messagemanager\.sns\.internal\.SnsHostProvider" />
 

codegen/src/main/java/software/amazon/awssdk/codegen/poet/client/ClientClassUtils.java

@@ -559,8 +559,7 @@ static MethodSpec resolveEndpointMethod(AuthSchemeSpecUtils authSchemeSpecUtils,
                            authSchemeOption.nestedClass("Builder"));
             b.addStatement("$1T rs = $1T.create(endpointParams.region().id())", regionSet);
             b.addStatement("optionBuilder.putSignerProperty($T.REGION_SET, rs)", awsV4aHttpSigner);
-            b.addStatement("selectedAuthScheme = new $T(selectedAuthScheme.identity(), selectedAuthScheme.signer(), "
-                           + "optionBuilder.build())", SelectedAuthScheme.class);
+            b.addStatement("selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build()");
             b.endControlFlow();
         }
 

codegen/src/main/java/software/amazon/awssdk/codegen/poet/rules/EndpointResolverUtilsSpec.java

@@ -602,7 +602,9 @@ private static CodeBlock copyV4EndpointSignerPropertiesToAuth() {
         code.addStatement("option.putSignerProperty($T.SERVICE_SIGNING_NAME, v4AuthScheme.signingName())",
                           AwsV4HttpSigner.class);
         code.endControlFlow();
-        code.addStatement("return new $T<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build())",
+        code.addStatement("return $T.<T>builder().identity(selectedAuthScheme.identity())"
+                          + ".signer(selectedAuthScheme.signer()).authSchemeOption(option.build())"
+                          + ".identityProvider(selectedAuthScheme.identityProvider()).build()",
                           SelectedAuthScheme.class);
         code.endControlFlow();
         return code.build();
@@ -631,7 +633,9 @@ private CodeBlock copyV4aEndpointSignerPropertiesToAuth() {
         code.addStatement("option.putSignerProperty($T.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName())",
                           AwsV4aHttpSigner.class);
         code.endControlFlow();
-        code.addStatement("return new $T<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build())",
+        code.addStatement("return $T.<T>builder().identity(selectedAuthScheme.identity())"
+                          + ".signer(selectedAuthScheme.signer()).authSchemeOption(option.build())"
+                          + ".identityProvider(selectedAuthScheme.identityProvider()).build()",
                           SelectedAuthScheme.class);
         code.endControlFlow();
         return code.build();
@@ -656,7 +660,9 @@ private CodeBlock copyS3ExpressEndpointSignerPropertiesToAuth() {
         code.addStatement("option.putSignerProperty($T.SERVICE_SIGNING_NAME, s3ExpressAuthScheme.signingName())",
                           AwsV4HttpSigner.class);
         code.endControlFlow();
-        code.addStatement("return new $T<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build())",
+        code.addStatement("return $T.<T>builder().identity(selectedAuthScheme.identity())"
+                          + ".signer(selectedAuthScheme.signer()).authSchemeOption(option.build())"
+                          + ".identityProvider(selectedAuthScheme.identityProvider()).build()",
                           SelectedAuthScheme.class);
         code.endControlFlow();
         return code.build();

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/client/test-unsigned-payload-trait-async-client-class.java

@@ -940,8 +940,7 @@ private Endpoint resolveEndpoint(SdkRequest request, ExecutionAttributes executi
                     AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
                     RegionSet rs = RegionSet.create(endpointParams.region().id());
                     optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, rs);
-                    selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
-                                                                optionBuilder.build());
+                    selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
                 }
                 executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
             }

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/client/test-unsigned-payload-trait-sync-client-class.java

@@ -818,8 +818,7 @@ private Endpoint resolveEndpoint(SdkRequest request, ExecutionAttributes executi
                     AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
                     RegionSet rs = RegionSet.create(endpointParams.region().id());
                     optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, rs);
-                    selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
-                                                                optionBuilder.build());
+                    selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
                 }
                 executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
             }

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-preSra.java

@@ -177,7 +177,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4AuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             if (endpointAuthScheme instanceof SigV4aAuthScheme) {
                 SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
@@ -191,7 +191,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4aAuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
                                                + "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-with-endpointsbasedauth.java

@@ -81,8 +81,7 @@ public SdkRequest modifyRequest(Context.ModifyRequest context, ExecutionAttribut
                     AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
                     RegionSet regionSet = RegionSet.create(endpointParams.region().id());
                     optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, regionSet);
-                    selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
-                                                                optionBuilder.build());
+                    selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
                 }
                 executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
             }
@@ -172,7 +171,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4AuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             if (endpointAuthScheme instanceof SigV4aAuthScheme) {
                 SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
@@ -188,7 +187,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4aAuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
                                                + "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-with-multiauthsigv4a.java

@@ -70,8 +70,7 @@ public SdkRequest modifyRequest(Context.ModifyRequest context, ExecutionAttribut
                     AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
                     RegionSet regionSet = RegionSet.create(endpointParams.region().id());
                     optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, regionSet);
-                    selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
-                                                                optionBuilder.build());
+                    selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
                 }
                 executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
             }
@@ -135,7 +134,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4AuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             if (endpointAuthScheme instanceof SigV4aAuthScheme) {
                 SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
@@ -151,7 +150,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4aAuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
                                                + "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-with-stringarray.java

@@ -144,7 +144,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4AuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             if (endpointAuthScheme instanceof SigV4aAuthScheme) {
                 SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
@@ -158,7 +158,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4aAuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
                                                + "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor.java

@@ -163,7 +163,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4AuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             if (endpointAuthScheme instanceof SigV4aAuthScheme) {
                 SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
@@ -177,7 +177,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
                 if (v4aAuthScheme.signingName() != null) {
                     option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
                 }
-                return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+                return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
             }
             throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
                                                + "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");

codegen/src/test/resources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolver-utils-with-endpointsbasedauth.java

@@ -101,7 +101,7 @@ public static <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointS
         if (v4AuthScheme.signingName() != null) {
           option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
         }
-        return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+        return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
       }
       if (endpointAuthScheme instanceof SigV4aAuthScheme) {
         SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
@@ -117,7 +117,7 @@ public static <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointS
         if (v4aAuthScheme.signingName() != null) {
           option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
         }
-        return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
+        return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
       }
       throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
                                          + "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");