Skip to content

Add web identity related feature ids - #919

Merged
ubaskota merged 2 commits into
developfrom
web_identity_token_impl
Nov 12, 2026
Merged

ubaskota merged 2 commits into
developfrom
web_identity_token_impl

Conversation

@ubaskota

Copy link
Copy Markdown
Contributor

Issue #, if available:

Description of changes:
Add web identity credential feature IDs

Add the User-Agent business metrics feature IDs for STS AssumeRoleWithWebIdentity credentials to AwsFeatureId:

  • CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN ("h"): web identity configured by environment variables
  • CREDENTIALS_STS_ASSUME_ROLE_WEB_ID ("k"): credentials resolved with AssumeRoleWithWebIdentity
  • CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN ("q"): web identity configured by a shared config profile

These let the web identity credential providers in aws-credentials-sts record how credentials were resolved.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@ubaskota
ubaskota requested a review from a team as a code owner November 11, 2026 01:30
@@ -0,0 +1,4 @@
{
"type": "feature",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit - This is more important for the future world when we're more stable: I think a change like this should be an enhancement instead of feature. feature changes trigger minor bumps. I understand why you want it here since it ensures the next client release will use a version that has these feature ids. However, feature id registration should be robust (meaning it shouldn't blow up when trying to register an unknown value). So I think this going out in a patch bump is the right move. I don't think triggering a minor bump for SDK clients should be a result of adding new feature ids.

Suggested change
"type": "feature",
"type": "enhancement",

Comment on lines +56 to +59
CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN = "h"
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID = "k"
CREDENTIALS_PROFILE = "n"
CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN = "q"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tests are failing:

make check-py
make[1]: Entering directory '/home/runner/work/smithy-python/smithy-python'
uv run ruff check packages --config pyproject.toml
S105 Possible hardcoded password assigned to: "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN"
  --> packages/smithy-aws-core/src/smithy_aws_core/business_metrics.py:56:45
   |
54 |     CREDENTIALS_CODE = "e"
55 |     CREDENTIALS_ENV_VARS = "g"
56 |     CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN = "h"
   |                                             ^^^
57 |     CREDENTIALS_STS_ASSUME_ROLE_WEB_ID = "k"
58 |     CREDENTIALS_PROFILE = "n"
   |

S105 Possible hardcoded password assigned to: "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN"
  --> packages/smithy-aws-core/src/smithy_aws_core/business_metrics.py:59:44
   |
57 |     CREDENTIALS_STS_ASSUME_ROLE_WEB_ID = "k"
58 |     CREDENTIALS_PROFILE = "n"
59 |     CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN = "q"
   |                                            ^^^
60 |     CREDENTIALS_PROFILE_PROCESS = "v"
61 |     CREDENTIALS_PROCESS = "w"

We either need to rename or add in-line ignores for these checks

@ubaskota
ubaskota force-pushed the web_identity_token_impl branch from e16db8e to bf9b363 Compare November 12, 2026 01:10
@ubaskota
ubaskota merged commit 7862022 into develop Nov 12, 2026
26 checks passed
@jonathan343
jonathan343 deleted the web_identity_token_impl branch November 12, 2026 03:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants