Handle Non-Standard STS XML Response - S3 Compatible STS Endpoint #2816
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rohangoli
force-pushed
the
handle-non-stnd-sts-response
branch
from
c628c4a to
1e027a6
Compare
Contributor
snazy
reviewed
Oct 17, 2025
Member
snazy
left a comment
snazy
left a comment
There was a problem hiding this comment.
@rohangoli can you elaborate why that credentials attribute is not present?
I don't see a fundamental difference between the documented ECS response and AWS response, beside that the XML namespacing in the ECS response looks different.
I'm concerned about the usage of ThreadLocal holding the last captured STS response. The assumption in getSubscopedCreds() this PR is that the parsing happens within the same thread, but I'm not sure that this is a guaranteed behavior. StsResponseCapture exposes non-ECS credentials to any caller to any call site.
Maybe software.amazon.awssdk.core.interceptor.ExecutionInterceptor#modifyHttpResponseContent/modifyAsyncHttpResponseContent are better alternatives?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
sequenceDiagram participant Polaris as Polaris (caller) participant SDK as AWS SDK (StsClient) participant Interceptor as StsResponseCaptureInterceptor participant Holder as StsResponseCapture (ThreadLocal) participant Parser as StsXmlParser participant Integration as AwsCredentialsStorageIntegration Polaris->>SDK: assumeRole(...) SDK->>Interceptor: afterTransmission(context) Interceptor->>Holder: setLastBody(rawHttpBody) SDK->>SDK: unmarshal to AssumeRoleResponse SDK-->>Polaris: AssumeRoleResponse (credentials==null) Polaris->>Integration: handle response Integration->>Holder: getLastBody() alt raw body present Integration->>Parser: parseToAccessConfig(rawBody) Parser-->>Integration: AccessConfig (keys + expiresAt) Integration->>Integration: merge into AccessConfig.Builder else no raw body Integration->>Integration: failover (error path) end Integration->>Holder: clear() %% recommendedWhy are the changes needed?
Request
Response
Polaris debug logs:
Does this PR introduce any user-facing change?
How was this patch tested?
CHANGELOG.md