refactor: switch from awsutil to awsutilv2 (#34)

* fix(storage): Storage Assume Role Support

This commit introduces fixes to enable operators to use AWS dynamic
credentials on the storage side of this plugin, namely validation,
improved credential lifecycle management to allow for storage buckets to
be updated from static to dynamic credentials and vice versa, and a new
way to determine credential types.

It also introduces new tests for dynamic credential usage for the
various functions.

* fix(storage): Static rotated creds being deleted on plugin err

On Storage Bucket update, when we determine if the credentials are to be
updated to new ones, we call `credState.ReplaceCreds`.

This call, if the old credentials were managed by us (rotated at create
time), will delete the old credentials and set the new ones onto
credState.

We called this function without validating if the incoming credentials
are valid. This could get the bucket in a state where where, while we'd
return an update error if the incoming credentials weren't working with
S3 (err in the dry run process that happens at the end of the update),
we'd also silently delete the old credentials the bucket used, rendering
the bucket completely broken.

---------

Co-authored-by: Hugo <hugoamvieira@users.noreply.github.com>

internal/credential/attributes.go

@@ -9,7 +9,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
 	"github.com/hashicorp/boundary-plugin-aws/internal/values"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
@@ -68,25 +68,45 @@ func GetCredentialsConfig(secrets *structpb.Struct, attrs *CredentialAttributes,
 		badFields[fmt.Sprintf("secrets.%s", s)] = "unrecognized field"
 	}
 
-	if len(badFields) > 0 {
-		return nil, errors.InvalidArgumentError("Error in the secrets provided", badFields)
-	}
-
-	opts := []awsutil.Option{
-		awsutil.WithEnvironmentCredentials(true),
-	}
-	if accessKey != "" && secretKey != "" {
+	opts := []awsutil.Option{}
+	// logic for parsing the credential type
+	// supported types:
+	//		- user static credential
+	//		- ec2 assume role dynamic credential
+	//		- enviornment variables credential
+	switch {
+	// static credentials and dynamic credentials cannot be used together
+	case accessKey != "" && secretKey != "" && attrs.RoleArn != "":
+		badFields[fmt.Sprintf("secrets.%s", ConstAccessKeyId)] = "conflicts with role_arn value"
+		badFields[fmt.Sprintf("secrets.%s", ConstSecretAccessKey)] = "conflicts with role_arn value"
+		badFields[fmt.Sprintf("attributes.%s", ConstRoleArn)] = "conflicts with access_key_id and secret_access_key values"
+	// static credential is missing it's secret_access_key
+	case accessKey != "" && secretKey == "":
+		badFields[fmt.Sprintf("secrets.%s", ConstSecretAccessKey)] = "missing required value"
+	// static credential is missing it's access_key_id
+	case accessKey == "" && secretKey != "":
+		badFields[fmt.Sprintf("secrets.%s", ConstAccessKeyId)] = "missing required value"
+	// dynamic credentials and credential rotation is not supported
+	case len(attrs.RoleArn) > 0 && !attrs.DisableCredentialRotation:
+		badFields[fmt.Sprintf("attributes.%s", ConstDisableCredentialRotation)] = "disable_credential_rotation attribute is required when providing a role_arn"
+	// add static credentials
+	case accessKey != "" && secretKey != "":
 		opts = append(opts,
 			awsutil.WithAccessKey(accessKey),
 			awsutil.WithSecretKey(secretKey),
 		)
+	// add dynamic credentials
+	case attrs.RoleArn != "":
+		opts = append(opts, awsutil.WithRoleArn(attrs.RoleArn))
 	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Error in the secrets provided", badFields)
+	}
+
 	if attrs.Region != "" {
 		opts = append(opts, awsutil.WithRegion(attrs.Region))
 	}
-	if attrs.RoleArn != "" {
-		opts = append(opts, awsutil.WithRoleArn(attrs.RoleArn))
-	}
 	if attrs.RoleExternalId != "" {
 		opts = append(opts, awsutil.WithRoleExternalId(attrs.RoleExternalId))
 	}

internal/credential/attributes_test.go

@@ -6,7 +6,7 @@ package credential
 import (
 	"testing"
 
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -118,7 +118,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 		expectedErrContains string
 	}{
 		{
-			name: "no secrets",
+			name: "no credentials",
 			attrs: &CredentialAttributes{
 				Region: "us-west-2",
 			},
@@ -130,7 +130,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 			name: "with static credentials",
 			secrets: &structpb.Struct{
 				Fields: map[string]*structpb.Value{
-					ConstAccessKeyId:     structpb.NewStringValue("foobar"),
+					ConstAccessKeyId:     structpb.NewStringValue("AKIAfoobar"),
 					ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
 				},
 			},
@@ -138,7 +138,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 				Region: "us-west-2",
 			},
 			expected: &awsutil.CredentialsConfig{
-				AccessKey: "foobar",
+				AccessKey: "AKIAfoobar",
 				SecretKey: "bazqux",
 				Region:    "us-west-2",
 			},
@@ -160,7 +160,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 			name: "missing secret key",
 			secrets: &structpb.Struct{
 				Fields: map[string]*structpb.Value{
-					ConstAccessKeyId: structpb.NewStringValue("foobar"),
+					ConstAccessKeyId: structpb.NewStringValue("AKIAfoobar"),
 				},
 			},
 			required: true,
@@ -173,7 +173,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 			name: "unknown fields",
 			secrets: &structpb.Struct{
 				Fields: map[string]*structpb.Value{
-					ConstAccessKeyId:     structpb.NewStringValue("foobar"),
+					ConstAccessKeyId:     structpb.NewStringValue("AKIAfoobar"),
 					ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
 					"foo":                structpb.NewBoolValue(true),
 					"bar":                structpb.NewBoolValue(true),
@@ -188,7 +188,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 			name: "valid ignore creds_last_rotated_time",
 			secrets: &structpb.Struct{
 				Fields: map[string]*structpb.Value{
-					ConstAccessKeyId:          structpb.NewStringValue("foobar"),
+					ConstAccessKeyId:          structpb.NewStringValue("AKIAfoobar"),
 					ConstSecretAccessKey:      structpb.NewStringValue("bazqux"),
 					ConstCredsLastRotatedTime: structpb.NewStringValue("2006-01-02T15:04:05+07:00"),
 				},
@@ -197,7 +197,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 				Region: "us-west-2",
 			},
 			expected: &awsutil.CredentialsConfig{
-				AccessKey: "foobar",
+				AccessKey: "AKIAfoobar",
 				SecretKey: "bazqux",
 				Region:    "us-west-2",
 			},
@@ -215,6 +215,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 				RoleTags: map[string]string{
 					"foo": "bar",
 				},
+				DisableCredentialRotation: true,
 			},
 			expected: &awsutil.CredentialsConfig{
 				Region:          "us-west-2",
@@ -230,7 +231,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 			name: "with static credential & assume role",
 			secrets: &structpb.Struct{
 				Fields: map[string]*structpb.Value{
-					ConstAccessKeyId:     structpb.NewStringValue("foobar"),
+					ConstAccessKeyId:     structpb.NewStringValue("AKIAfoobar"),
 					ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
 				},
 			},
@@ -243,17 +244,21 @@ func TestGetCredentialsConfig(t *testing.T) {
 					"foo": "bar",
 				},
 			},
-			expected: &awsutil.CredentialsConfig{
-				AccessKey:       "foobar",
-				SecretKey:       "bazqux",
+			expectedErrContains: "attributes.role_arn: conflicts with access_key_id and secret_access_key values, secrets.access_key_id: conflicts with role_arn value, secrets.secret_access_key: conflicts with role_arn value",
+		},
+		{
+			name:    "with dynamic credentials and no disable credential rotation",
+			secrets: &structpb.Struct{Fields: map[string]*structpb.Value{}},
+			attrs: &CredentialAttributes{
 				Region:          "us-west-2",
-				RoleARN:         "arn:aws:iam::123456789012:role/S3Access",
+				RoleArn:         "arn:aws:iam::123456789012:role/S3Access",
 				RoleExternalId:  "1234567890",
 				RoleSessionName: "test-session",
 				RoleTags: map[string]string{
 					"foo": "bar",
 				},
 			},
+			expectedErrContains: "attributes.disable_credential_rotation: disable_credential_rotation attribute is required when providing a role_arn",
 		},
 	}
 

internal/credential/state.go

@@ -4,19 +4,41 @@
 package credential
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/hashicorp/boundary-plugin-aws/internal/values"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
+type CredentialType int
+
+const (
+	// StaticAWS denotes an Access Key Id that begins with "AKIA". These are
+	// long-term access keys, provided by AWS, for an IAM user or an AWS account
+	// root user.
+	// https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-access-keys-and-secret-access-keys
+	StaticAWS CredentialType = iota
+
+	// DynamicAWS denotes the presence of a RoleARN, or an Access Key Id that
+	// begins with "ASIA". The latter are temporary credentials access keys that
+	// are created using AWS STS operations.
+	DynamicAWS
+
+	// StaticOther denotes the presence of an Access Key Id that does not follow
+	// the AKIA/ASIA convention outlined by AWS.
+	StaticOther
+
+	// Unknown is a catch-all for everything else.
+	Unknown
+)
+
 // rotationWaitTimeout controls the time we wait for credential rotation to
 // succeed. This is important to ensure that rotated credentials can be used
 // right away.
@@ -85,11 +107,11 @@ func NewAwsCredentialPersistedState(opts ...AwsCredentialPersistedStateOption) (
 // ValidateCreds takes the credentials configuration from the persisted state
 // and runs sts.GetCallerIdentity for the current credentials, which is done
 // to check that the credentials are valid.
-func (s *AwsCredentialPersistedState) ValidateCreds() error {
+func (s *AwsCredentialPersistedState) ValidateCreds(ctx context.Context) error {
 	if s.CredentialsConfig == nil {
 		return errors.New("missing credentials config")
 	}
-	if _, err := s.CredentialsConfig.GetCallerIdentity(s.testOpts...); err != nil {
+	if _, err := s.CredentialsConfig.GetCallerIdentity(ctx, s.testOpts...); err != nil {
 		return fmt.Errorf("error validating credentials: %w", err)
 	}
 	return nil
@@ -100,11 +122,14 @@ func (s *AwsCredentialPersistedState) ValidateCreds() error {
 // written into the credentials config and the persisted state. On any error, the old credentials are not overwritten.
 // This ensures that any generated new secret key never leaves this function in case of an error, even though it will
 // still result in an extraneous access key existing.
-func (s *AwsCredentialPersistedState) RotateCreds() error {
+func (s *AwsCredentialPersistedState) RotateCreds(ctx context.Context) error {
 	if s.CredentialsConfig == nil {
 		return errors.New("missing credentials config")
 	}
-	if err := s.CredentialsConfig.RotateKeys(append([]awsutil.Option{
+	if GetCredentialType(s.CredentialsConfig) != StaticAWS {
+		return errors.New("invalid credential type")
+	}
+	if err := s.CredentialsConfig.RotateKeys(ctx, append([]awsutil.Option{
 		awsutil.WithValidityCheckTimeout(rotationWaitTimeout),
 	}, s.testOpts...)...); err != nil {
 		return fmt.Errorf("error rotating credentials: %w", err)
@@ -116,7 +141,7 @@ func (s *AwsCredentialPersistedState) RotateCreds() error {
 // ReplaceCreds replaces the access key in the state with a new key.
 // If the existing key was rotated at any point in time, it is
 // deleted first, otherwise it's left alone.
-func (s *AwsCredentialPersistedState) ReplaceCreds(credentialsConfig *awsutil.CredentialsConfig) error {
+func (s *AwsCredentialPersistedState) ReplaceCreds(ctx context.Context, credentialsConfig *awsutil.CredentialsConfig) error {
 	if credentialsConfig == nil {
 		return errors.New("missing new credentials config")
 	}
@@ -124,11 +149,11 @@ func (s *AwsCredentialPersistedState) ReplaceCreds(credentialsConfig *awsutil.Cr
 		return errors.New("missing credentials config")
 	}
 
-	if !s.CredsLastRotatedTime.IsZero() {
-		// Delete old/existing credentials. This is done with the same
-		// credentials to ensure that it has the proper permissions to do
-		// it.
-		if err := s.DeleteCreds(); err != nil {
+	// Delete old/existing credentials. This action is only possible for static credential types.
+	// This is done with the same credentials to ensure that it has the proper permissions to do it.
+	ct := GetCredentialType(s.CredentialsConfig)
+	if !s.CredsLastRotatedTime.IsZero() && ct == StaticAWS {
+		if err := s.DeleteCreds(ctx); err != nil {
 			return err
 		}
 	}
@@ -142,21 +167,22 @@ func (s *AwsCredentialPersistedState) ReplaceCreds(credentialsConfig *awsutil.Cr
 // DeleteCreds deletes the credentials in the state. The access key
 // ID, secret access key, and rotation time fields are zeroed out in
 // the state just to ensure that they cannot be re-used after.
-func (s *AwsCredentialPersistedState) DeleteCreds() error {
+func (s *AwsCredentialPersistedState) DeleteCreds(ctx context.Context) error {
 	if s.CredentialsConfig == nil {
 		return errors.New("missing credentials config")
 	}
+	if GetCredentialType(s.CredentialsConfig) != StaticAWS {
+		return errors.New("invalid credential type")
+	}
 
-	if err := s.CredentialsConfig.DeleteAccessKey(s.CredentialsConfig.AccessKey, s.testOpts...); err != nil {
+	if err := s.CredentialsConfig.DeleteAccessKey(ctx, s.CredentialsConfig.AccessKey, s.testOpts...); err != nil {
 		// Determine if the deletion error was due to a missing
 		// resource. If it was, just pass it.
-		var awsErr awserr.Error
-		if errors.As(err, &awsErr) {
-			if awsErr.Code() == iam.ErrCodeNoSuchEntityException {
-				s.CredentialsConfig = nil
-				s.CredsLastRotatedTime = time.Time{}
-				return nil
-			}
+		var awsErr *iamTypes.NoSuchEntityException
+		if errors.As(err, &awsErr) && awsErr.ErrorCode() == "NoSuchEntity" {
+			s.CredentialsConfig = nil
+			s.CredsLastRotatedTime = time.Time{}
+			return nil
 		}
 
 		// Otherwise treat it as an actual error.
@@ -168,10 +194,9 @@ func (s *AwsCredentialPersistedState) DeleteCreds() error {
 	return nil
 }
 
-// GetSession returns a configured AWS session for the credentials in
-// the state.
-func (s *AwsCredentialPersistedState) GetSession() (*session.Session, error) {
-	return s.CredentialsConfig.GetSession(s.testOpts...)
+// GenerateCredentialChain returns a AWS configuration for the credentials in the state.
+func (s *AwsCredentialPersistedState) GenerateCredentialChain(ctx context.Context) (*aws.Config, error) {
+	return s.CredentialsConfig.GenerateCredentialChain(ctx, s.testOpts...)
 }
 
 // ToMap returns a map of the credentials stored in the persisted state.
@@ -179,7 +204,15 @@ func (s *AwsCredentialPersistedState) GetSession() (*session.Session, error) {
 // return a map for long-term credentials with following keys:
 // access_key_id, secret_access_key & creds_last_rotated_time
 func (s *AwsCredentialPersistedState) ToMap() map[string]any {
-	if HasDynamicCredentials(s.CredentialsConfig.AccessKey) {
+	ct := GetCredentialType(s.CredentialsConfig)
+	// Dynamic AWS credentials are temporary credentials that expire within an hour.
+	// ToMap() returns an empty map here so that Boundary does not store temporary
+	// credentials into the database.
+	//
+	// Uknown credentials are not aws compatiable secrets that may have been provided
+	// for a non-aws s3 compatiable service. These credentials will not be returned
+	// because the plugin does not know how to manage non-aws credentials.
+	if ct == DynamicAWS || ct == Unknown {
 		return map[string]any{}
 	}
 	return map[string]any{
@@ -256,18 +289,22 @@ func AwsCredentialPersistedStateFromProto(secrets *structpb.Struct, attrs *Crede
 	return s, nil
 }
 
-// HasDynamicCredentials returns true if the access key is a dynamic credential type.
-//
-// https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-access-keys-and-secret-access-keys
-// Access key IDs beginning with ASIA are temporary credentials access keys that you create using AWS STS operations.
-func HasDynamicCredentials(accessKey string) bool {
-	return strings.HasPrefix(accessKey, "ASIA")
-}
+// GetCredentialType returns the credential type based on the given
+// AccessKey/RoleARN. See CredentialType definition for more information.
+func GetCredentialType(cc *awsutil.CredentialsConfig) CredentialType {
+	if cc == nil {
+		return Unknown
+	}
 
-// HasStaticCredentials returns true if the access key is a static credential type.
-//
-// https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-access-keys-and-secret-access-keys
-// Access key IDs beginning with AKIA are long-term access keys for an IAM user or an AWS account root user.
-func HasStaticCredentials(accessKey string) bool {
-	return strings.HasPrefix(accessKey, "AKIA")
+	if len(cc.RoleARN) > 0 || strings.HasPrefix(cc.AccessKey, "ASIA") {
+		return DynamicAWS
+	}
+	if strings.HasPrefix(cc.AccessKey, "AKIA") {
+		return StaticAWS
+	}
+	if len(cc.AccessKey) > 0 {
+		return StaticOther
+	}
+
+	return Unknown
 }

internal/credential/state_test.go

@@ -4,15 +4,16 @@
 package credential
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/structpb"
 )
@@ -383,7 +384,7 @@ func TestAwsCatalogPersistedState_ValidateCreds(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
-			err := tc.in.ValidateCreds()
+			err := tc.in.ValidateCreds(context.Background())
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
@@ -407,11 +408,33 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 			in:          &AwsCredentialPersistedState{},
 			expectedErr: "missing credentials config",
 		},
+		{
+			name: "cannot delete dynamic credential type",
+			in: &AwsCredentialPersistedState{
+				CredentialsConfig: &awsutil.CredentialsConfig{
+					AccessKey: "ASIAfoobar",
+					SecretKey: "bazqux",
+				},
+				CredsLastRotatedTime: time.Now(),
+			},
+			expectedErr: "invalid credential type",
+		},
+		{
+			name: "cannot delete unknown credential type",
+			in: &AwsCredentialPersistedState{
+				CredentialsConfig: &awsutil.CredentialsConfig{
+					AccessKey: "DNEfoobar",
+					SecretKey: "bazqux",
+				},
+				CredsLastRotatedTime: time.Now(),
+			},
+			expectedErr: "invalid credential type",
+		},
 		{
 			name: "rotation error",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 					Region:    "us-west-2",
 				},
@@ -423,13 +446,13 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 					),
 				},
 			},
-			expectedErr: fmt.Sprintf("error rotating credentials: error calling CreateAccessKey: error calling aws.GetUser: %s", testGetUserErr),
+			expectedErr: fmt.Sprintf("error rotating credentials: error calling CreateAccessKey: error calling iam.GetUser: %s", testGetUserErr),
 		},
 		{
 			name: "good",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 					Region:    "us-west-2",
 				},
@@ -441,7 +464,7 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 						awsutil.NewMockIAM(
 							awsutil.WithGetUserOutput(
 								&iam.GetUserOutput{
-									User: &iam.User{
+									User: &iamTypes.User{
 										Arn:      aws.String("arn:aws:iam::123456789012:user/JohnDoe"),
 										UserId:   aws.String("AIDAJQABLZS4A3QDU576Q"),
 										UserName: aws.String("JohnDoe"),
@@ -450,7 +473,7 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 							),
 							awsutil.WithCreateAccessKeyOutput(
 								&iam.CreateAccessKeyOutput{
-									AccessKey: &iam.AccessKey{
+									AccessKey: &iamTypes.AccessKey{
 										AccessKeyId:     aws.String("one"),
 										SecretAccessKey: aws.String("two"),
 										UserName:        aws.String("JohnDoe"),
@@ -474,7 +497,7 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
-			err := tc.in.RotateCreds()
+			err := tc.in.RotateCreds(context.Background())
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
@@ -514,7 +537,7 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 			name: "deletion error",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 				},
 				CredsLastRotatedTime: time.Now(),
@@ -533,7 +556,7 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 			name: "good with delete of old rotated",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 				},
 				CredsLastRotatedTime: time.Now(),
@@ -557,7 +580,7 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 			name: "good without delete of old rotated",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 				},
 				testOpts: []awsutil.Option{
@@ -583,7 +606,7 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
 			state.Reset()
-			err := tc.in.ReplaceCreds(tc.credentialConfig)
+			err := tc.in.ReplaceCreds(context.Background(), tc.credentialConfig)
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
@@ -609,11 +632,33 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 			in:          &AwsCredentialPersistedState{},
 			expectedErr: "missing credentials config",
 		},
+		{
+			name: "cannot delete dynamic credential type",
+			in: &AwsCredentialPersistedState{
+				CredentialsConfig: &awsutil.CredentialsConfig{
+					AccessKey: "ASIAfoobar",
+					SecretKey: "bazqux",
+				},
+				CredsLastRotatedTime: time.Now(),
+			},
+			expectedErr: "invalid credential type",
+		},
+		{
+			name: "cannot delete unknown credential type",
+			in: &AwsCredentialPersistedState{
+				CredentialsConfig: &awsutil.CredentialsConfig{
+					AccessKey: "DNEfoobar",
+					SecretKey: "bazqux",
+				},
+				CredsLastRotatedTime: time.Now(),
+			},
+			expectedErr: "invalid credential type",
+		},
 		{
 			name: "deletion error",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 				},
 				testOpts: []awsutil.Option{
@@ -630,14 +675,14 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 			name: "deletion error, but OK because key was just gone",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 				},
 				testOpts: []awsutil.Option{
 					awsutil.WithIAMAPIFunc(
 						awsutil.NewMockIAM(
 							awsutil.WithDeleteAccessKeyError(
-								awserr.New(iam.ErrCodeNoSuchEntityException, "", nil),
+								&iamTypes.NoSuchEntityException{},
 							),
 						),
 					),
@@ -648,7 +693,7 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 			name: "good",
 			in: &AwsCredentialPersistedState{
 				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "foobar",
+					AccessKey: "AKIAfoobar",
 					SecretKey: "bazqux",
 				},
 				testOpts: []awsutil.Option{
@@ -664,7 +709,7 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
-			err := tc.in.DeleteCreds()
+			err := tc.in.DeleteCreds(context.Background())
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
@@ -677,7 +722,7 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 	}
 }
 
-func TestAwsCatalogPersistedState_GetSession(t *testing.T) {
+func TestAwsCatalogPersistedState_GenerateCredentialChain(t *testing.T) {
 	require := require.New(t)
 	cases := []struct {
 		name        string
@@ -693,7 +738,7 @@ func TestAwsCatalogPersistedState_GetSession(t *testing.T) {
 				},
 				testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
 			},
-			expectedErr: fmt.Sprintf("error reading options in GetSession: %s", testOptionErr),
+			expectedErr: fmt.Sprintf("error reading options in GenerateCredentialChain: %s", testOptionErr),
 		},
 		{
 			name: "static credentials",
@@ -736,7 +781,7 @@ func TestAwsCatalogPersistedState_GetSession(t *testing.T) {
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			_, err := tc.in.GetSession()
+			_, err := tc.in.GenerateCredentialChain(context.Background())
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
@@ -746,74 +791,53 @@ func TestAwsCatalogPersistedState_GetSession(t *testing.T) {
 	}
 }
 
-func TestHasStaticCredentials(t *testing.T) {
-	require := require.New(t)
-	cases := []struct {
-		name      string
-		accessKey string
-		expected  bool
+func TestGetCredentialType(t *testing.T) {
+	tests := []struct {
+		name             string
+		credConfig       *awsutil.CredentialsConfig
+		expectedCredType CredentialType
 	}{
 		{
-			name:      "dynamic credential",
-			accessKey: "ASIAEXAMPLE",
-			expected:  false,
+			name:             "nil credential config",
+			credConfig:       nil,
+			expectedCredType: Unknown,
 		},
 		{
-			name:      "static credential",
-			accessKey: "AKIAEXAMPLE",
-			expected:  true,
+			name:             "empty credential config",
+			credConfig:       &awsutil.CredentialsConfig{},
+			expectedCredType: Unknown,
 		},
 		{
-			name:      "other credential",
-			accessKey: "EXAMPLE",
-			expected:  false,
+			name:             "static aws",
+			credConfig:       &awsutil.CredentialsConfig{AccessKey: "AKIAfoobar"},
+			expectedCredType: StaticAWS,
 		},
 		{
-			name:      "empty",
-			accessKey: "",
-			expected:  false,
+			name:             "static other",
+			credConfig:       &awsutil.CredentialsConfig{AccessKey: "cK3kNFa24foobar"},
+			expectedCredType: StaticOther,
+		},
+		{
+			name:             "dynamic aws - role arn",
+			credConfig:       &awsutil.CredentialsConfig{RoleARN: "arn:aws:iam::123456789012:role/S3Access"},
+			expectedCredType: DynamicAWS,
+		},
+		{
+			name:             "dynamic aws - access key",
+			credConfig:       &awsutil.CredentialsConfig{AccessKey: "ASIAfoobar"},
+			expectedCredType: DynamicAWS,
+		},
+		{
+			name:             "dynamic aws - role arn and access key",
+			credConfig:       &awsutil.CredentialsConfig{AccessKey: "ASIAfoobar", RoleARN: "arn:aws:iam::123456789012:role/S3Access"},
+			expectedCredType: DynamicAWS,
 		},
 	}
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require.Equal(tc.expected, HasStaticCredentials(tc.accessKey))
-		})
-	}
-}
 
-func TestHasDynamicCredentials(t *testing.T) {
-	require := require.New(t)
-	cases := []struct {
-		name      string
-		accessKey string
-		expected  bool
-	}{
-		{
-			name:      "dynamic credential",
-			accessKey: "ASIAEXAMPLE",
-			expected:  true,
-		},
-		{
-			name:      "static credential",
-			accessKey: "AKIAEXAMPLE",
-			expected:  false,
-		},
-		{
-			name:      "other credential",
-			accessKey: "EXAMPLE",
-			expected:  false,
-		},
-		{
-			name:      "empty",
-			accessKey: "",
-			expected:  false,
-		},
-	}
-	for _, tc := range cases {
-		tc := tc
+	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			require.Equal(tc.expected, HasDynamicCredentials(tc.accessKey))
+			ct := GetCredentialType(tc.credConfig)
+			require.Equal(t, tc.expectedCredType, ct)
 		})
 	}
 }

internal/credential/testing.go

@@ -4,10 +4,11 @@
 package credential
 
 import (
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/aws/aws-sdk-go/service/iam/iamiface"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
@@ -27,25 +28,25 @@ func (s *testMockIAMState) Reset() {
 }
 
 type testMockIAM struct {
-	iamiface.IAMAPI
+	awsutil.IAMClient
 
 	State *testMockIAMState
 }
 
-func (m *testMockIAM) DeleteAccessKey(input *iam.DeleteAccessKeyInput) (*iam.DeleteAccessKeyOutput, error) {
+func (m *testMockIAM) DeleteAccessKey(ctx context.Context, input *iam.DeleteAccessKeyInput, opts ...func(*iam.Options)) (*iam.DeleteAccessKeyOutput, error) {
 	m.State.DeleteAccessKeyCalled = true
-	return m.IAMAPI.DeleteAccessKey(input)
+	return m.IAMClient.DeleteAccessKey(ctx, input, opts...)
 }
 
 func newTestMockIAM(state *testMockIAMState, opts ...awsutil.MockIAMOption) awsutil.IAMAPIFunc {
-	return func(sess *session.Session) (iamiface.IAMAPI, error) {
+	return func(awsConfig *aws.Config) (awsutil.IAMClient, error) {
 		m := &testMockIAM{
 			State: state,
 		}
 		f := awsutil.NewMockIAM(opts...)
 		var err error
 
-		m.IAMAPI, err = f(sess)
+		m.IAMClient, err = f(awsConfig)
 		return m, err
 	}
 }