@aws-sdk/credential-provider-node - npm Package Compare versions

Comparing version 3.614.0 to 3.616.0

dist-cjs/index.js

@@ -66,11 +66,35 @@ "use strict";
 // src/defaultProvider.ts
+var multipleCredentialSourceWarningEmitted = false;
 var defaultProvider = /* @__PURE__ */ __name((init = {}) => (0, import_property_provider.memoize)(
   (0, import_property_provider.chain)(
-    ...init.profile || process.env[import_shared_ini_file_loader.ENV_PROFILE] ? [] : [
-      async () => {
-        var _a;
-        (_a = init.logger) == null ? void 0 : _a.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
-        return (0, import_credential_provider_env.fromEnv)(init)();
+    async () => {
+      var _a, _b, _c, _d;
+      const profile = init.profile ?? process.env[import_shared_ini_file_loader.ENV_PROFILE];
+      if (profile) {
+        const envStaticCredentialsAreSet = process.env[import_credential_provider_env.ENV_KEY] && process.env[import_credential_provider_env.ENV_SECRET];
+        if (envStaticCredentialsAreSet) {
+          if (!multipleCredentialSourceWarningEmitted) {
+            const warnFn = ((_a = init.logger) == null ? void 0 : _a.warn) && ((_c = (_b = init.logger) == null ? void 0 : _b.constructor) == null ? void 0 : _c.name) !== "NoOpLogger" ? init.logger.warn : console.warn;
+            warnFn(
+              `@aws-sdk/credential-provider-node - defaultProvider::fromEnv WARNING:
+    Multiple credential sources detected: 
+    Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
+    This SDK will proceed with the AWS_PROFILE value.
+    
+    However, a future version may change this behavior to prefer the ENV static credentials.
+    Please ensure that your environment only sets either the AWS_PROFILE or the
+    AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.
+`
+            );
+            multipleCredentialSourceWarningEmitted = true;
+          }
+        }
+        throw new import_property_provider.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+          logger: init.logger,
+          tryNextLink: true
+        });
       }
-    ],
+      (_d = init.logger) == null ? void 0 : _d.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
+      return (0, import_credential_provider_env.fromEnv)(init)();
+    },
     async () => {
@@ -77,0 +101,0 @@ var _a;

dist-es/defaultProvider.js

@@ -1,13 +0,33 @@
-import { fromEnv } from "@aws-sdk/credential-provider-env";
+import { ENV_KEY, ENV_SECRET, fromEnv } from "@aws-sdk/credential-provider-env";
 import { chain, CredentialsProviderError, memoize } from "@smithy/property-provider";
 import { ENV_PROFILE } from "@smithy/shared-ini-file-loader";
 import { remoteProvider } from "./remoteProvider";
-export const defaultProvider = (init = {}) => memoize(chain(...(init.profile || process.env[ENV_PROFILE]
-    ? []
-    : [
-        async () => {
-            init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
-            return fromEnv(init)();
-        },
-    ]), async () => {
+let multipleCredentialSourceWarningEmitted = false;
+export const defaultProvider = (init = {}) => memoize(chain(async () => {
+    const profile = init.profile ?? process.env[ENV_PROFILE];
+    if (profile) {
+        const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
+        if (envStaticCredentialsAreSet) {
+            if (!multipleCredentialSourceWarningEmitted) {
+                const warnFn = init.logger?.warn && init.logger?.constructor?.name !== "NoOpLogger" ? init.logger.warn : console.warn;
+                warnFn(`@aws-sdk/credential-provider-node - defaultProvider::fromEnv WARNING:
+    Multiple credential sources detected: 
+    Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
+    This SDK will proceed with the AWS_PROFILE value.
+    
+    However, a future version may change this behavior to prefer the ENV static credentials.
+    Please ensure that your environment only sets either the AWS_PROFILE or the
+    AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.
+`);
+                multipleCredentialSourceWarningEmitted = true;
+            }
+        }
+        throw new CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+            logger: init.logger,
+            tryNextLink: true,
+        });
+    }
+    init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
+    return fromEnv(init)();
+}, async () => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
@@ -14,0 +34,0 @@ const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;

package.json

 {
   "name": "@aws-sdk/credential-provider-node",
-  "version": "3.614.0",
+  "version": "3.616.0",
   "description": "AWS credential provider that sources credentials from a Node.JS environment. ",
@@ -32,6 +32,6 @@ "engines": {
     "@aws-sdk/credential-provider-env": "3.609.0",
-    "@aws-sdk/credential-provider-http": "3.614.0",
-    "@aws-sdk/credential-provider-ini": "3.614.0",
+    "@aws-sdk/credential-provider-http": "3.616.0",
+    "@aws-sdk/credential-provider-ini": "3.616.0",
     "@aws-sdk/credential-provider-process": "3.614.0",
-    "@aws-sdk/credential-provider-sso": "3.614.0",
+    "@aws-sdk/credential-provider-sso": "3.616.0",
     "@aws-sdk/credential-provider-web-identity": "3.609.0",
@@ -38,0 +38,0 @@ "@aws-sdk/types": "3.609.0",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

36363

increased by7.53%

Lines of code

328

increased by14.69%

Worsened metrics

Number of low supply chain risk alerts

12

increased by50%

Dependency changes

• + Added@aws-sdk/client-sso@3.616.0(transitive)

• + Added@aws-sdk/core@3.616.0(transitive)

• + Added@aws-sdk/credential-provider-http@3.616.0(transitive)

• + Added@aws-sdk/credential-provider-ini@3.616.0(transitive)

• + Added@aws-sdk/credential-provider-sso@3.616.0(transitive)

• + Added@aws-sdk/middleware-host-header@3.616.0(transitive)

• + Added@aws-sdk/middleware-recursion-detection@3.616.0(transitive)

• + Added@aws-sdk/middleware-user-agent@3.616.0(transitive)

• - Removed@aws-sdk/client-sso@3.614.0(transitive)

• - Removed@aws-sdk/core@3.614.0(transitive)

• - Removed@aws-sdk/credential-provider-http@3.614.0(transitive)

• - Removed@aws-sdk/credential-provider-ini@3.614.0(transitive)

• - Removed@aws-sdk/credential-provider-sso@3.614.0(transitive)

• - Removed@aws-sdk/middleware-host-header@3.609.0(transitive)

• - Removed@aws-sdk/middleware-recursion-detection@3.609.0(transitive)

• - Removed@aws-sdk/middleware-user-agent@3.614.0(transitive)

• - Removed@smithy/signature-v4@3.1.2(transitive)

• Updated@aws-sdk/credential-provider-http@3.616.0

• Updated@aws-sdk/credential-provider-ini@3.616.0

• Updated@aws-sdk/credential-provider-sso@3.616.0