
    pge+                         d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
Zd dlmZ d dl
mZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7 d d	l8m9Z9 d d
l:m;Z; d dl<m=Z= d dl>m?Z?m@Z@  ejA        eB          ZCd=dZD G d de'          ZEd ZFd ZGd ZHeHZI G d de          ZJ G d de)          ZK G d deK          ZL G d de          ZM G d deeM          ZN G d deeN          ZO G d d eN          ZP G d! d"e&          ZQ G d# d$e!          ZR G d% d&e           ZS G d' d(e$          ZT G d) d*e+          ZU G d+ d,e          ZV G d- d.e          ZW G d/ d0e          ZX G d1 d2e          ZY G d3 d4e          ZZ G d5 d6e          Z[ G d7 d8e          Z\ G d9 d:eM          Z] G d; d<e,          Z^dS )>    N)deepcopy)sha1)UNSIGNED)compat_shell_split)Config)%!_DEFAULT_ADVISORY_REFRESH_TIMEOUTAssumeRoleCredentialFetcherAssumeRoleProvider!AssumeRoleWithWebIdentityProviderBaseAssumeRoleCredentialFetcherBotoProviderCachedCredentialFetcherCanonicalNameCredentialSourcerConfigNotFoundConfigProviderContainerMetadataFetcherContainerProviderCredentialResolverCredentialRetrievalErrorCredentialsEnvProviderInstanceMetadataProviderInvalidConfigErrorMetadataRetrievalErrorOriginalEC2ProviderPartialCredentialsErrorProcessProviderProfileProviderBuilderReadOnlyCredentialsRefreshableCredentialsRefreshWithMFAUnsupportedErrorSharedCredentialProviderSSOProviderSSOTokenLoaderUnauthorizedSSOTokenErrorUnknownCredentialError_get_client_creator
_local_now_parse_if_needed_serialize_if_neededparseresolve_imds_endpoint_mode)tzutc)resolve_awaitable)	AioConfig)AioSSOTokenProvider)AioContainerMetadataFetcherAioInstanceMetadataFetcherc                 l                          d          pd}                      d          }                      d          }                                                     d          du}                      d          t                     t          d}|i }t                      }t                      }	t          t          || 	                                |          	          }
t           ||
          }t           fdt           |          ||t          ||	|
g          |          }||g}|                    ||          }t                      t!                      |	|
g}||z   |z   }|r/|                    |           t$                              d           t)          |          }|S )zCreate a default credential resolver.
    This creates a pre-configured credential resolver
    that includes the default lookup chain for
    credentials.
    profiledefaultmetadata_service_timeoutmetadata_service_num_attemptsNec2_metadata_service_endpoint)r8   "ec2_metadata_service_endpoint_modeec2_credential_refresh_window)timeoutnum_attempts
user_agentconfig)iam_role_fetcher)cacheregion_namec                       j         S N)full_config)sessions   7lib/python3.11/site-packages/aiobotocore/credentials.py<lambda>z,create_credential_resolver.<locals>.<lambda>i   s
    G/     )load_configclient_creatorr@   profile_namecredential_sourcerprofile_provider_builderrK   disable_env_varszWSkipping environment variable credential check because profile name was explicitly set.)	providers)get_config_variableinstance_variablesgetr,   r   AioEnvProviderAioContainerProviderAioInstanceMetadataProviderr2   r=   AioProfileProviderBuilderAioAssumeRoleProviderr'   !AioCanonicalNameCredentialSourcerrP   AioOriginalEC2ProviderAioBotoProviderremoveloggerdebugAioCredentialResolver)rE   r@   rA   rK   metadata_timeoutr<   rO   imds_configenv_providercontainer_providerinstance_metadata_providerrM   assume_role_providerpre_profileprofile_providerspost_profilerP   resolvers   `                 rF   create_credential_resolverrj   B   s1    ..y99FYL223MNN../NOOL113377	BB$N *1)D)D+*
 *
 /I/
 /
 *K K }!##L-//!<3$%))++	
 
 
" " "  9u+      1////*7K@@!<-/IJ
 
 ":	 	 	 	K 1::!) ;  
 	  "	L //,>I 
  	&&&8	
 	
 	

 %y999HOrH   c                   ,    e Zd Zd Zd Zd Zd Zd ZdS )rW   c                 ,     t          | fd          S )Nc                       j         j        S rC   _sessionrD   selfs   rF   rG   zDAioProfileProviderBuilder._create_process_provider.<locals>.<lambda>        9 rH   )rK   rI   )AioProcessProviderrq   rK   s   ` rF   _create_process_providerz2AioProfileProviderBuilder._create_process_provider   s)    !%9999
 
 
 	
rH   c                 X    | j                             d          }t          ||          S )Ncredentials_file)rK   creds_filename)ro   rQ   AioSharedCredentialProvider)rq   rK   credential_files      rF   "_create_shared_credential_providerz<AioProfileProviderBuilder._create_shared_credential_provider   s5    -;;<NOO*%*
 
 
 	
rH   c                 X    | j                             d          }t          ||          S )Nconfig_file)rK   config_filename)ro   rQ   AioConfigProvider)rq   rK   r}   s      rF   _create_config_providerz1AioProfileProviderBuilder._create_config_provider   s4    m77FF %'
 
 
 	
rH   c                 l     t           fdt           j         j                   j        ||          S )Nc                       j         j        S rC   rn   rp   s   rF   rG   zIAioProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>   rr   rH   )rI   rJ   r@   rK   rO   )$AioAssumeRoleWithWebIdentityProviderr'   ro   _region_name_cache)rq   rK   rO   s   `  rF   _create_web_identity_providerz7AioProfileProviderBuilder._create_web_identity_provider   sJ    39999.t0  +%-
 
 
 	
rH   c                      t           fd j        j        | j         j        t           j         j        |                    S )Nc                       j         j        S rC   rn   rp   s   rF   rG   z@AioProfileProviderBuilder._create_sso_provider.<locals>.<lambda>   rr   rH   )r@   rK   )rI   rJ   rK   r@   token_cachetoken_provider)AioSSOProviderro   create_clientr   _sso_token_cacher0   rt   s   ` rF   _create_sso_providerz.AioProfileProviderBuilder._create_sso_provider   s\    9999=6%+-.+)  
 
 
 	
rH   N)__name__
__module____qualname__ru   r{   r   r   r    rH   rF   rW   rW      s_        
 
 

 
 

 
 
	
 	
 	

 
 
 
 
rH   rW   c                 X   K   t          |           }|                                 d {V S rC   )rj   load_credentials)rE   ri   s     rF   get_credentialsr      s7      )'22H**,,,,,,,,,rH   c                       fd}|S )Nc                     K   4 d {V }  | j         di  d {V }d d d           d {V  n# 1 d {V swxY w Y   |d         }|d         |d         |d         t          |d                   dS )Nr   AccessKeyIdSecretAccessKeySessionToken
Expiration
access_key
secret_keytokenexpiry_timer   )assume_roler*   )stsresponsecredentialsclientparamss      rF   refreshz-create_assume_role_refresher.<locals>.refresh   s&      	7 	7 	7 	7 	7 	7 	7S,S_66v66666666H	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7}- &m4%&78 0/L0IJJ	
 
 	
s   2
<<r   )r   r   r   s   `` rF   create_assume_role_refresherr      s)    
 
 
 
 
 
 NrH   c                 <     G d d          } ||           j         S )Nc                       e Zd Zd Zd ZdS )/create_mfa_serial_refresher.<locals>._Refresherc                 "    || _         d| _        d S )NF)_refresh_has_been_called)rq   r   s     rF   __init__z8create_mfa_serial_refresher.<locals>._Refresher.__init__   s    #DM$)D!!!rH   c                 r   K   | j         rt                      d| _         |                                  d {V S NT)r   r!   r   rp   s    rF   callz4create_mfa_serial_refresher.<locals>._Refresher.call   sG      $ 7 5666$(D!(((((((rH   N)r   r   r   r   r   r   rH   rF   
_Refresherr      s2        	* 	* 	*	) 	) 	) 	) 	)rH   r   )r   )actual_refreshr   s     rF   create_mfa_serial_refresherr      s?    ) ) ) ) ) ) ) ) :n%%**rH   c                       e Zd Zd ZdS )AioCredentialsc                 F   K   t          | j        | j        | j                  S rC   )r   r   r   r   rp   s    rF   get_frozen_credentialsz%AioCredentials.get_frozen_credentials   s%      "OT_dj
 
 	
rH   N)r   r   r   r   r   rH   rF   r   r      s#        
 
 
 
 
rH   r   c                        e Zd Z fdZed             Zej        d             Zed             Zej        d             Zed             Zej        d             Zd Z	d	 Z
d
 Z xZS )AioRefreshableCredentialsc                 j     t                      j        |i | t          j                    | _        d S rC   )superr   asyncioLock_refresh_lockrq   argskwargs	__class__s      rF   r   z"AioRefreshableCredentials.__init__   s3    $)&)))$\^^rH   c                      t          d          NzAmissing call to self._refresh. Use get_frozen_credentials instead)NotImplementedError_access_keyrp   s    rF   r   z$AioRefreshableCredentials.access_key       "1
 
 	
rH   c                     || _         d S rC   )r   rq   values     rF   r   z$AioRefreshableCredentials.access_key       rH   c                      t          d          r   )r   _secret_keyrp   s    rF   r   z$AioRefreshableCredentials.secret_key  r   rH   c                     || _         d S rC   )r   r   s     rF   r   z$AioRefreshableCredentials.secret_key  r   rH   c                      t          d          r   )r   _tokenrp   s    rF   r   zAioRefreshableCredentials.token   r   rH   c                     || _         d S rC   )r   r   s     rF   r   zAioRefreshableCredentials.token)  s    rH   c                   K   |                      | j                  sd S | j                                        s| j        4 d {V  |                      | j                  s	 d d d           d {V  d S |                      | j                  }|                     |           d {V  	 d d d           d {V  d S # 1 d {V swxY w Y   d S |                      | j                  r~| j        4 d {V  |                      | j                  s	 d d d           d {V  d S |                     d           d {V  d d d           d {V  d S # 1 d {V swxY w Y   d S d S )N)is_mandatoryT)refresh_needed_advisory_refresh_timeoutr   locked_mandatory_refresh_timeout_protected_refresh)rq   is_mandatory_refreshs     rF   r   z"AioRefreshableCredentials._refresh-  s|     ""4#ABB 	F !((** 	A) 	 	 	 	 	 	 	 	**4+IJJ 	 	 	 	 	 	 	 	 	 	 	 	 	 	 (,':':3( ($ --!5 .          	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	   !@AA 	A ) A A A A A A A A**4+JKK A A A A A A A A A A A A A A --4-@@@@@@@@@	A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A	A 	As0   B>47B>>
CC8E'E
E #E c                   K   	 t          |                                            d {V }n7# t          $ r* |rdnd}t                              d|d           |r Y d S w xY w|                     |           t          | j        | j        | j	                  | _
        |                                 r+d}t                              |           t          |          d S )N	mandatoryadvisoryzARefreshing temporary credentials failed during %s refresh period.Texc_infozLCredentials were refreshed, but the refreshed credentials are still expired.)r.   _refresh_using	Exceptionr]   warning_set_from_datar   r   r   r   _frozen_credentials_is_expiredRuntimeError)rq   r   metadataperiod_namemsgs        rF   r   z,AioRefreshableCredentials._protected_refreshF  s"     	.t/B/B/D/DEEEEEEEEHH 	 	 	)5E++:KNN,	        FF!	" 	H%%%#6d.$
 $
   	$;  NN3s###	$ 	$s   ', 0A A c                 H   K   |                                   d {V  | j        S rC   )r   r   rp   s    rF   r   z0AioRefreshableCredentials.get_frozen_credentialsg  s/      mmoo''rH   )r   r   r   r   propertyr   setterr   r   r   r   r   __classcell__r   s   @rF   r   r      s       , , , , ,     X  ! ! !     X  ! ! !   X \  \A A A2$ $ $B( ( ( ( ( ( (rH   r   c                   *     e Zd ZefdZd fd	Z xZS )!AioDeferredRefreshableCredentialsc                     || _         d | _        d | _        d | _        d | _        || _        t          j                    | _        || _	        d | _
        d S rC   )r   r   r   r   _expiry_time_time_fetcherr   r   r   methodr   )rq   refresh_usingr   time_fetchers       rF   r   z*AioDeferredRefreshableCredentials.__init__m  sT    + )$\^^#'   rH   Nc                 X    | j         dS t                                          |          S r   )r   r   r   )rq   
refresh_inr   s     rF   r   z0AioDeferredRefreshableCredentials.refresh_neededx  s)    #+4ww%%j111rH   rC   )r   r   r   r(   r   r   r   r   s   @rF   r   r   l  sT        ;E 	( 	( 	( 	(2 2 2 2 2 2 2 2 2 2rH   r   c                        e Zd Zd Zd Zd ZdS )AioCachedCredentialFetcherc                 $   K   t          d          )Nz_get_credentials())r   rp   s    rF   _get_credentialsz+AioCachedCredentialFetcher._get_credentials  s      !"6777rH   c                 :   K   |                                   d {V S rC   )_get_cached_credentialsrp   s    rF   fetch_credentialsz,AioCachedCredentialFetcher.fetch_credentials  s*      11333333333rH   c                 6  K   |                                  }|0|                                  d{V }|                     |           nt                              d           |d         }t          |d         d          }|d         |d         |d	         |d
S )zGet up-to-date credentials.

        This will check the cache for up-to-date credentials, calling assume
        role if none are available.
        Nz*Credentials for role retrieved from cache.r   r   T)isor   r   r   r   )_load_from_cacher   _write_to_cacher]   r^   r*   )rq   r   creds
expirations       rF   r   z2AioCachedCredentialFetcher._get_cached_credentials  s       ((**!2244444444H  ****LLEFFF')%*=4HHH
. 12>*%	
 
 	
rH   N)r   r   r   r   r   r   r   rH   rF   r   r   ~  sA        8 8 84 4 4
 
 
 
 
rH   r   c                       e Zd ZdS )"AioBaseAssumeRoleCredentialFetcherN)r   r   r   r   rH   rF   r  r    s         	DrH   r  c                       e Zd Zd Zd ZdS )AioAssumeRoleCredentialFetcherc                    K   |                                  }|                                  d{V }|4 d{V } |j        di | d{V cddd          d{V  S # 1 d{V swxY w Y   dS )'Get credentials by calling assume role.Nr   )_assume_role_kwargs_create_clientr   )rq   r   r   r   s       rF   r   z/AioAssumeRoleCredentialFetcher._get_credentials  s"     ))++**,,,,,,,, 	3 	3 	3 	3 	3 	3 	3S(22622222222	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3 	3s   A
A),A)c                    K   | j                                          d{V }|                     d|j        |j        |j                  S )z2Create an STS client using the source credentials.Nr   )aws_access_key_idaws_secret_access_keyaws_session_token)_source_credentialsr   _client_creatorr   r   r   )rq   frozen_credentialss     rF   r  z-AioAssumeRoleCredentialFetcher._create_client  se       *AACCCCCCCC 	 ##0;"4"?06	 $ 
 
 	
rH   N)r   r   r   r   r  r   rH   rF   r
  r
    s2        3 3 3

 

 

 

 

rH   r
  c                   2     e Zd Z	 	 	 d fd	Zd Zd Z xZS )-AioAssumeRoleWithWebIdentityCredentialFetcherNc                 b    || _         t                                          |||||           d S )N)
extra_argsr@   expiry_window_seconds)_web_identity_token_loaderr   r   )rq   rJ   web_identity_token_loaderrole_arnr  r@   r  r   s          rF   r   z6AioAssumeRoleWithWebIdentityCredentialFetcher.__init__  sH     +D'!"7 	 	
 	
 	
 	
 	
rH   c                   K   |                                  }t          t                    }|                     d|          4 d{V } |j        di | d{V cddd          d{V  S # 1 d{V swxY w Y   dS )r  )signature_versionr   r>   Nr   )r  r/   r   r  assume_role_with_web_identity)rq   r   r>   r   s       rF   r   z>AioAssumeRoleWithWebIdentityCredentialFetcher._get_credentials  sJ     ))++ X666''f'== 	H 	H 	H 	H 	H 	H 	H==GGGGGGGGGG	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	H 	Hs   	A//
A9<A9c                 `    t          | j                  }|                                 }||d<   |S )zAGet the arguments for assume role based on current configuration.WebIdentityToken)r   _assume_kwargsr  )rq   assume_role_kwargsidentity_tokens      rF   r  zAAioAssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargs  s6    %d&9::88::1?-.!!rH   )NNN)r   r   r   r   r   r  r   r   s   @rF   r  r    si         "
 
 
 
 
 
(H H H" " " " " " "rH   r  c                   :     e Zd Zej        d fd
Zd Zd Z xZS )rs   )popenc                B     t                      j        |i |d|i d S )Nr(  )r   r   )rq   r(  r   r   r   s       rF   r   zAioProcessProvider.__init__  s0    $6&66666666rH   c                 8   K    j         d S                                 d {V }|                    d          %t                              | fd j                  S t          |d         |d         |                    d           j                  S )Nr   c                  .                                    S rC   )_retrieve_credentials_using)credential_processrq   s   rF   rG   z)AioProcessProvider.load.<locals>.<lambda>  s    889KLL rH   r   r   r   )r   r   r   r   )_credential_processr,  rS   r   create_from_metadataMETHODr   )rq   
creds_dictr-  s   ` @rF   loadzAioProcessProvider.load  s      !5%F;;<NOOOOOOOO
>>-((4,AALLLLL   !,/!,/..));	
 
 
 	
rH   c                   K   t          |          } | j        |t          j        t          j        d d {V }|                                 d {V \  }}|j        dk    r)t          | j        |                    d                    t          j
        j                            |                    d                    }|                    dd          }|dk    rt          | j        d| d	          	 |d
         |d         |                    d          |                    d          dS # t          $ r}t          | j        d|           d }~ww xY w)N)stdoutstderrr   utf-8provider	error_msgVersionz<Version key not provided>   zUnsupported version 'z8' for credential process provider, supported versions: 1r   r   r   r   r   z"Missing required key in response: )r   _popen
subprocessPIPEcommunicate
returncoder   r0  decodebotocorecompatjsonloadsrS   KeyError)	rq   r-  process_listpr4  r5  parsedversiones	            rF   r,  z.AioProcessProvider._retrieve_credentials_using  s      **<==$+*/*/
 
 
 
 
 
 
 
 
  !}}......<1*g0F0F    %++FMM',B,BCC**Y(DEEa<<*7G 7 7 7   	$]3$%67N33%zz,77	    	 	 	*BqBB   	s   98D2 2
E<EE)	r   r   r   r   create_subprocess_execr   r2  r,  r   r   s   @rF   rs   rs     sf        $+$B 7 7 7 7 7 7 7
 
 
(! ! ! ! ! ! !rH   rs   c                       e Zd Zd ZdS )rV   c                    K   | j         }|                                 d {V }|sd S t                              d|d                    t                              || j        |j                  }|S )Nz#Found credentials from IAM Role: %s	role_namer   r   )_role_fetcherretrieve_iam_role_credentialsr]   infor   r/  r0  )rq   fetcherr   r  s       rF   r2  z AioInstanceMetadataProvider.load   s      $ >>@@@@@@@@ 	418K3H	
 	
 	
 *>>;!? ? 
 

 rH   Nr   r   r   r2  r   rH   rF   rV   rV     s#            rH   rV   c                       e Zd Zd ZdS )rT   c                   K   | j                             | j        d         d          }|rt                              d           |                                 } |d          }|d         }|;t          |          }t          |d         |d         |d         ||| j        	          S t          |d         |d         |d         | j        
          S d S )Nr    z+Found credentials in environment variables.F)require_expiryr   r   r   )r   r   r   )
environrS   _mappingr]   rS  _create_credentials_fetcherr+   r   r0  r   )rq   r   rT  r   r   s        rF   r2  zAioEnvProvider.load2  s      \%%dmL&A2FF
 	KKEFFF6688G!'777K%m4K&#K000--(");    "L)L)G${	    4rH   NrU  r   rH   rF   rT   rT   1  s#            rH   rT   c                       e Zd Zd ZdS )rZ   c                 F  K   d| j         v rt          j                            | j         d                   }|                     |          }| j        |v rKt                              d           || j                 }|| j                 }t          ||| j
                  S d S d S )NAWS_CREDENTIAL_FILEz)Found credentials in AWS_CREDENTIAL_FILE.rZ  )_environospath
expanduser_parser
ACCESS_KEYr]   rS  
SECRET_KEYr   r0  )rq   	full_pathr  r   r   s        rF   r2  zAioOriginalEC2Provider.loadQ  s       DM11**34 I LL++E%''GHHH"4?3
"4?3
%
4;    (' 4rH   NrU  r   rH   rF   rZ   rZ   P  s#            rH   rZ   c                       e Zd Zd ZdS )ry   c                   K   	 |                      | j                  }n# t          $ r Y d S w xY w| j        |v r|| j                 }| j        |v rst
                              d| j                   |                     || j        | j                  \  }}| 	                    |          }t          |||| j                  S d S d S )Nz0Found credentials in shared credentials file: %srZ  )_ini_parser_creds_filenamer   _profile_namerf  r]   rS  _extract_creds_from_mappingrg  _get_session_tokenr   r0  )rq   available_credsr>   r   r   r   s         rF   r2  z AioSharedCredentialProvider.loadd  s      	"..t/CDDOO 	 	 	44	00$T%78F&((F(   *.)I)IDOT_* *&
J //77%
E$+    10((    
--NrU  r   rH   rF   ry   ry   c  s#            rH   ry   c                       e Zd Zd ZdS )r   c                   K   	 |                      | j                  }n# t          $ r Y d S w xY w| j        |d         v r|d         | j                 }| j        |v rqt
                              d| j                   |                     || j        | j                  \  }}| 	                    |          }t          |||| j                  S d S d S )Nprofilesz$Credentials found in config file: %srZ  )_config_parser_config_filenamer   rm  rf  r]   rS  rn  rg  ro  r   r0  )rq   rD   profile_configr   r   r   s         rF   r2  zAioConfigProvider.loadz  s     	--d.CDDKK 	 	 	44	Z!888(4T5GHN.00:)   *.)I)I"DOT_* *&
J //??%
E$+    10 4rq  NrU  r   rH   rF   r   r   y  s#            rH   r   c                       e Zd Zd ZdS )r[   c                   K   | j         | j        v r| j        | j                  g}n| j        }|D ]}	 |                     |          }n# t          $ r Y %w xY wd|v ri|d         }| j        |v rXt                              d|           |                     || j        | j	                  \  }}t          ||| j                  c S d S )Nr   z)Found credentials in boto config file: %srZ  )BOTO_CONFIG_ENVra  DEFAULT_CONFIG_FILENAMESrk  r   rf  r]   rS  rn  rg  r   r0  )rq   potential_locationsfilenamer>   r   r   r   s          rF   r2  zAioBotoProvider.load  s     4=00#'=1E#F"G"&"?+ 	 	H))(33!    &&$]3?k11KKCX   .2-M-M#T_do. .*J
 *"Jt{     	 	s   A
AANrU  r   rH   rF   r[   r[     s#            rH   r[   c                   2    e Zd Zd Zd Zd Zd Zd Zd ZdS )rX   c                   K   |                                  | _        | j                            di           }|                    | j        i           }|                     |          r |                     | j                   d {V S d S )Nrt  )_load_config_loaded_configrS   rm  _has_assume_role_config_vars_load_creds_via_assume_role)rq   rt  r4   s      rF   r2  zAioAssumeRoleProvider.load  s      "//11&**:r::,,t1266,,W55 	N99$:LMMMMMMMMM	N 	NrH   c                   K   |                      |          }|                     ||           d {V }i }|                    d          }|||d<   |                    d          }|||d<   |                    d          }|||d<   |                    d          }|||d<   t          | j        ||d	         || j        | j        
          }	|	j        }
|t          |
          }
t          | j
        |
t                    S )Nrole_session_nameRoleSessionNameexternal_id
ExternalId
mfa_serialSerialNumberduration_secondsDurationSecondsr  )rJ   source_credentialsr  r  mfa_prompterr@   )r   r   r   )_get_role_config_resolve_source_credentialsrS   r
  r  	_prompterr@   r   r   r   r0  r(   )rq   rK   role_configr  r  r  r  r  r  rT  	refreshers              rF   r  z1AioAssumeRoleProvider._load_creds_via_assume_role  sV     ++L99#'#C#C$
 $
 
 
 
 
 
 
 
'OO,?@@(,=J()!oom44"'2J|$ __\22
!)3J~&&??+=>>',<J()0/1 ,!*
 
 
 -	!3I>>I
 1;##
 
 
 	
rH   c                    K   |                     d          }||                     ||           d {V S |d         }| j                            |           |                     |           d {V S )Ncredential_sourcesource_profile)rS    _resolve_credentials_from_source_visited_profilesappend!_resolve_credentials_from_profile)rq   r  rK   r  r  s        rF   r  z1AioAssumeRoleProvider._resolve_source_credentials  s      'OO,?@@(>>!<         %%56%%n555;;NKKKKKKKKKrH   c                   K   | j                             di           }||         }|                     |          r| j        s|                     |          S |                     |          s|                     |          s^| j                            |d          }t          |          }|                                 d {V }|d}t          ||z            |S | 
                    |           d {V S )Nrt  TrN   z.The source profile "%s" must have credentials.r9  )r  rS   _has_static_credentials_profile_provider_builder(_resolve_static_credentials_from_profiler  rP   r_   r   r   r  )rq   rK   rt  r4   rg   profile_chainr   error_messages           rF   r  z7AioAssumeRoleProvider._resolve_credentials_from_profile  sI     &**:r::<( ((11	2	 @@III))
 
 	227;;	 !% > H H)!% !I ! ! 22CDDM - > > @ @@@@@@@K"D  )+l:    55lCCCCCCCCCrH   c                     	 t          |d         |d         |                    d                    S # t          $ r(}t          | j        t          |                    d }~ww xY w)Nr  r  r  )r   r   r   )r8  cred_var)r   rS   rF  r   r0  str)rq   r4   rK  s      rF   r  z>AioAssumeRoleProvider._resolve_static_credentials_from_profile  s    		!"#67"#:;kk"566   
  	 	 	)s1vv   	s   03 
A%#A  A%c                 v   K   | j                             |           d {V }|t          |d|z            |S )NzBNo credentials found in credential_source referenced in profile %sr7  )_credential_sourcerr  r   )rq   r  rK   r   s       rF   r  z6AioAssumeRoleProvider._resolve_credentials_from_source  sx       !4GG
 
 
 
 
 
 
 
 **$&23    rH   N)	r   r   r   r2  r  r  r  r  r  r   rH   rF   rX   rX     sx        N N N*
 *
 *
X	L 	L 	LD D D:
 
 
    rH   rX   c                       e Zd Zd Zd ZdS )r   c                 :   K   |                                   d {V S rC   )_assume_role_with_web_identityrp   s    rF   r2  z)AioAssumeRoleWithWebIdentityProvider.load%  s*      88:::::::::rH   c                 b  K   |                      d          }|sd S |                     |          }|                      d          }|sd}t          |          i }|                      d          }|||d<   t          | j        |||| j                  }t          | j        |j                  S )	Nweb_identity_token_filer  zThe provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r  r  r  )rJ   r  r  r  r@   rP  )	_get_config_token_loader_clsr   r  r  r@   r   r0  r   )rq   
token_pathtoken_loaderr  r9  r  r  rT  s           rF   r  zCAioAssumeRoleWithWebIdentityProvider._assume_role_with_web_identity(  s      %%&?@@
 	4--j99##J// 	:H  %y9999
 ,,-@AA(,=J()?/&2!*
 
 
 1;!3
 
 
 	
rH   N)r   r   r   r2  r  r   rH   rF   r   r   $  s2        ; ; ;"
 "
 "
 "
 "
rH   r   c                       e Zd Zd Zd ZdS )rY   c                    K   |                      |          }t          |t                    r|                                 d{V S |                                 d{V S )a  Loads source credentials based on the provided configuration.

        :type source_name: str
        :param source_name: The value of credential_source in the config
            file. This is the canonical name of the credential provider.

        :rtype: Credentials
        N)_get_provider
isinstancer_   r   r2  )rq   source_namesources      rF   r  z4AioCanonicalNameCredentialSourcer.source_credentialsN  sr       ##K00f344 	300222222222[[]]"""""""rH   c                     |                      |          }|                                dv r,|                     d          }|||S t          ||g          S |t	          |          |S )a#  Return a credential provider by its canonical name.

        :type canonical_name: str
        :param canonical_name: The canonical name of the provider.

        :raises UnknownCredentialError: Raised if no
            credential provider by the provided name
            is found.
        )sharedconfigsharedcredentialszassume-roleN)name)_get_provider_by_canonical_namelower_get_provider_by_methodr_   r&   )rq   canonical_namer8  re   s       rF   r  z/AioCanonicalNameCredentialSourcer._get_provider\  s     77GG !!%JJJ#'#?#?#N#N #/
 #//
 -.BH-MNNN(n====rH   N)r   r   r   r  r  r   rH   rF   rY   rY   M  s2        # # #$ $ $ $ $rH   rY   c                   0     e Zd Z fdZd Zd Zd Z xZS )rU   c                      t                      j        |i | t          | j        t                    rt                      | _        d S d S rC   )r   r   r  _fetcherr   r1   r   s      rF   r   zAioContainerProvider.__init__  sQ    $)&))) dm%=>> 	:799DMMM	: 	:rH   c                 v   K   | j         | j        v s| j        | j        v r|                                  d {V S d S rC   )ENV_VARra  ENV_VAR_FULL_retrieve_or_failrp   s    rF   r2  zAioContainerProvider.load  sQ      <4=((D,=,N,N//111111111 -O,NrH   c           
        K   |                                  r+| j                            | j        | j                           }n| j        | j                 }|                                 }|                     ||          } |             d {V }t          |d         |d         |d         | j	        t          |d                   |          S )Nr   r   r   r   )r   r   r   r   r   r   )_provided_relative_urir  full_urlra  r  r  _build_headers_create_fetcherr   r0  r)   )rq   full_uriheadersrT  r  s        rF   r  z&AioContainerProvider._retrieve_or_fail  s      &&(( 	8}--dmDL.IJJHH}T%67H%%''&&x99gii(\*\*.;(})=>>!
 
 
 	
rH   c                       fd}|S )Nc                  2  K   	 j                                        d {V } nR# t          $ rE}t                              d|d           t          j        t          |                    d }~ww xY w| d         | d         | d         | d	         d
S )N)r  z'Error retrieving container metadata: %sTr   r7  r   r   Tokenr   r   )r  retrieve_full_urir   r]   r^   r   r0  r  )r   rK  r  r  rq   s     rF   fetch_credsz9AioContainerProvider._create_fetcher.<locals>.fetch_creds  s      
!%!@!@g "A " "       *   =q4     /![CFF   	 '}5&'89!'*'5	  s   "( 
A7A A22A7r   )rq   r  r  r  s   ``` rF   r  z$AioContainerProvider._create_fetcher  s0    	 	 	 	 	 	 	& rH   )r   r   r   r   r2  r  r  r   r   s   @rF   rU   rU     se        : : : : :2 2 2
 
 
"      rH   rU   c                       e Zd Zd ZdS )r_   c                    K   | j         D ]B}t                              d|j                   |                                 d{V }||c S CdS )zw
        Goes through the credentials chain, returning the first ``Credentials``
        that could be loaded.
        zLooking for credentials via: %sN)rP   r]   r^   r0  r2  )rq   r8  r  s      rF   r   z&AioCredentialResolver.load_credentials  sj        	 	HLL:HOLLL"--//))))))E  ! trH   N)r   r   r   r   r   rH   rF   r_   r_     s#            rH   r_   c                   @     e Zd ZdZ	 	 	 	 	 d fd	Zd Zd Zd Z xZS )AioSSOCredentialFetcherz%Y-%m-%dT%H:%M:%SZNc                     || _         || _        || _        || _        || _        || _        |	| _        |
| _        t                      	                    ||           d S rC   )
r  _sso_region
_role_name_account_id
_start_url_token_loader_token_provider_sso_session_namer   r   )rq   	start_url
sso_regionrO  
account_idrJ   r  r@   r  r   sso_session_namer   s              rF   r   z AioSSOCredentialFetcher.__init__  sd      .%#%#)-!1 566666rH   c                    | j         | j        d}| j        r| j        |d<   n
| j        |d<   t	          j        |dd          }t          |                    d                                                    }| 	                    |          S )N)roleName	accountIdsessionNamestartUrlT),:)	sort_keys
separatorsr6  )
r  r  r  r  rD  dumpsr   encode	hexdigest_make_file_safe)rq   r   argument_hashs      rF   _create_cache_keyz)AioSSOCredentialFetcher._create_cache_key  s    )
 
 ! 	/"&"8D#Dz$$:FFFT[[1122<<>>##M222rH   c                     |dz  }t           j                             |t                                }|                    | j                  S )Ng     @@)datetimefromtimestampr-   strftime_UTC_DATE_FORMAT)rq   timestamp_mstimestamp_seconds	timestamps       rF   _parse_timestampz(AioSSOCredentialFetcher._parse_timestamp  sA    (61%334EuwwOO	!!$"7888rH   c           	        K   t          t          | j                  }|                     d|          4 d{V }| j        r9| j                                        }|                                 d{V j        }n |                     | j	                  d         }| j
        | j        |d}	  |j        di | d{V }n!# |j        j        $ r t                      w xY w|d         }d|d         |d	         |d
         |                     |d                   dd}|cddd          d{V  S # 1 d{V swxY w Y   dS )z4Get credentials by calling SSO get role credentials.)r  rA   ssor   NaccessToken)r  r  r  roleCredentialsaccessKeyIdsecretAccessKeysessionTokenr  )r   r   r   r   )ProviderTyper   r   )r   r   r  r  r  
load_tokenget_frozen_tokenr   r  r  r  r  get_role_credentials
exceptionsUnauthorizedExceptionr%   r  )rq   r>   r   initial_token_datar   r   r   r   s           rF   r   z(AioSSOCredentialFetcher._get_credentials  s5     &(
 
 
 ''f'== 	 	 	 	 	 	 	# K%)%9%D%D%F%F"1BBDDDDDDDDK**4?;;MJ !O!-$ F
2!<!<!F!Fv!F!FFFFFFF$: 2 2 2/1112"#45K !&#.}#='23D'E$/$?"&"7"7#L1# #	   
 
K ;	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	s+   A1D3-C D3CAD33
D= D=)NNNNN)	r   r   r   r  r   r  r  r   r   r   s   @rF   r  r    s        + "7 7 7 7 7 7.3 3 39 9 9# # # # # # #rH   r  c                       e Zd Zd ZdS )r   c                 4  K   |                                  }|sd S |d         |d         |d         |d         | j        t          | j                  | j        d}d|v r|d         |d<   | j        |d	<   t          di |}t          | j        |j	        
          S )Nsso_start_urlr  sso_role_namesso_account_id)r@   )r  r  rO  r  rJ   r  r@   sso_sessionr  r   rP  r   )
_load_sso_configr  r$   _token_cacher@   r  r  r   r0  r   )rq   
sso_configfetcher_kwargssso_fetchers       rF   r2  zAioSSOProvider.load"  s      **,,
 	4 $O4$\2#O4$%56"2*1BCCCZ
 
 J&&1;M1JN-./3/CN+,-????0;%7
 
 
 	
rH   NrU  r   rH   rF   r   r   !  s#        
 
 
 
 
rH   r   )NN)_r   r  rD  loggingrb  r=  copyr   hashlibr   botocore.compatrB  r   r   botocore.configr   botocore.credentialsr   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   dateutil.tzr-   aiobotocore._helpersr.   aiobotocore.configr/   aiobotocore.tokensr0   aiobotocore.utilsr1   r2   	getLoggerr   r]   rj   rW   r   r   r   create_aio_mfa_serial_refresherr   r   r   r   r  r
  r  rs   rV   rT   rZ   ry   r   r[   rX   r   rY   rU   r_   r  r   r   rH   rF   <module>r     s       				                           . . . . . . " " " " " "& & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &N       2 2 2 2 2 2 ( ( ( ( ( ( 2 2 2 2 2 2       
 
	8	$	$X X X Xv,
 ,
 ,
 ,
 ,
 6 ,
 ,
 ,
^- - -
  "+ + +& #> 
 
 
 
 
[ 
 
 
j( j( j( j( j( 6 j( j( j(Z2 2 2 2 2(A 2 2 2$
 
 
 
 
!8 
 
 
<	 	 	 	 	#%?	 	 	
 
 
 
 
!C
 
 
0&" &" &" &" &"&&" &" &"R9 9 9 9 9 9 9 9x    ":   $    [   >    0   &    ":   ,       0    l   4v v v v v. v v vr&
 &
 &
 &
 &
+L &
 &
 &
R3 3 3 3 3(F 3 3 3l1 1 1 1 1, 1 1 1h    .   ,Q Q Q Q Q8 Q Q Qh
 
 
 
 
[ 
 
 
 
 
rH   