0.35.0-alpha.1

aws-creds/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "aws-creds"
-version = "0.36.0"
+version = "0.37.0"
 authors = ["Drazen Urch"]
 description = "Tiny Rust library for working with Amazon IAM credential,s, supports `s3` crate"
 repository = "https://github.com/durch/rust-s3"
@@ -17,12 +17,12 @@ path = "src/lib.rs"
 [dependencies]
 thiserror = "1"
 home = "0.5"
-rust-ini = "0.19"
-attohttpc = { version = "0.26", default-features = false, features = [
+rust-ini = "0.21"
+attohttpc = { version = "0.28", default-features = false, features = [
     "json",
 ], optional = true }
 url = "2"
-quick-xml = { version = "0.30", features = ["serialize"] }
+quick-xml = { version = "0.32", features = ["serialize"] }
 serde = { version = "1", features = ["derive"] }
 time = { version = "^0.3.6", features = ["serde", "serde-well-known"] }
 log = "0.4"
@@ -35,5 +35,5 @@ native-tls-vendored = ["http-credentials", "attohttpc/tls-vendored"]
 rustls-tls = ["http-credentials", "attohttpc/tls-rustls"]
 
 [dev-dependencies]
-env_logger = "0.10"
+env_logger = "0.11"
 serde_json = "1"

aws-creds/src/credentials.rs

@@ -174,15 +174,19 @@ pub fn set_request_timeout(timeout: Option<Duration>) -> Option<Duration> {
     }
 }
 
-/// Sends a GET request to `url` with a request timeout if one was set.
 #[cfg(feature = "http-credentials")]
-fn http_get(url: &str) -> attohttpc::Result<attohttpc::Response> {
-    let mut builder = attohttpc::get(url);
-
+fn apply_timeout(builder: attohttpc::RequestBuilder) -> attohttpc::RequestBuilder {
     let timeout_ms = REQUEST_TIMEOUT_MS.load(Ordering::Relaxed);
     if timeout_ms > 0 {
-        builder = builder.timeout(Duration::from_millis(timeout_ms as u64));
+        return builder.timeout(Duration::from_millis(timeout_ms as u64));
     }
+    builder
+}
+
+/// Sends a GET request to `url` with a request timeout if one was set.
+#[cfg(feature = "http-credentials")]
+fn http_get(url: &str) -> attohttpc::Result<attohttpc::Response> {
+    let builder = apply_timeout(attohttpc::get(url));
 
     builder.send()
 }
@@ -297,6 +301,7 @@ impl Credentials {
         Credentials::from_sts_env("aws-creds")
             .or_else(|_| Credentials::from_env())
             .or_else(|_| Credentials::from_profile(profile))
+            .or_else(|_| Credentials::from_instance_metadata_v2())
             .or_else(|_| Credentials::from_instance_metadata())
             .map_err(|_| CredentialsError::NoCredentials)
     }
@@ -331,25 +336,28 @@ impl Credentials {
             match env::var("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") {
                 Ok(credentials_path) => {
                     // We are on ECS
-                    attohttpc::get(format!("http://169.254.170.2{}", credentials_path))
-                        .send()?
-                        .json()?
+                    apply_timeout(attohttpc::get(format!(
+                        "http://169.254.170.2{}",
+                        credentials_path
+                    )))
+                    .send()?
+                    .json()?
                 }
                 Err(_) => {
                     if !is_ec2() {
                         return Err(CredentialsError::NotEc2);
                     }
 
-                    let role = attohttpc::get(
+                    let role = apply_timeout(attohttpc::get(
                         "http://169.254.169.254/latest/meta-data/iam/security-credentials",
-                    )
+                    ))
                     .send()?
                     .text()?;
 
-                    attohttpc::get(format!(
+                    apply_timeout(attohttpc::get(format!(
                         "http://169.254.169.254/latest/meta-data/iam/security-credentials/{}",
                         role
-                    ))
+                    )))
                     .send()?
                     .json()?
                 }
@@ -364,6 +372,46 @@ impl Credentials {
         })
     }
 
+    #[cfg(feature = "http-credentials")]
+    pub fn from_instance_metadata_v2() -> Result<Credentials, CredentialsError> {
+        if !is_ec2() {
+            return Err(CredentialsError::NotEc2);
+        }
+
+        let token = apply_timeout(attohttpc::put("http://169.254.169.254/latest/api/token"))
+            .header("X-aws-ec2-metadata-token-ttl-seconds", "21600")
+            .send()?;
+        if !token.is_success() {
+            return Err(CredentialsError::UnexpectedStatusCode(
+                token.status().as_u16(),
+            ));
+        }
+        let token = token.text()?;
+
+        let role = apply_timeout(attohttpc::get(
+            "http://169.254.169.254/latest/meta-data/iam/security-credentials",
+        ))
+        .header("X-aws-ec2-metadata-token", &token)
+        .send()?
+        .text()?;
+
+        let resp: CredentialsFromInstanceMetadata = apply_timeout(attohttpc::get(format!(
+            "http://169.254.169.254/latest/meta-data/iam/security-credentials/{}",
+            role
+        )))
+        .header("X-aws-ec2-metadata-token", &token)
+        .send()?
+        .json()?;
+
+        Ok(Credentials {
+            access_key: Some(resp.access_key_id),
+            secret_key: Some(resp.secret_access_key),
+            security_token: Some(resp.token),
+            expiration: Some(resp.expiration),
+            session_token: None,
+        })
+    }
+
     pub fn from_profile(section: Option<&str>) -> Result<Credentials, CredentialsError> {
         let home_dir = home::home_dir().ok_or(CredentialsError::HomeDir)?;
         let profile = format!("{}/.aws/credentials", home_dir.display());

aws-creds/src/error.rs

@@ -29,4 +29,6 @@ pub enum CredentialsError {
     HomeDir,
     #[error("Could not get valid credentials from STS, ENV, Profile or Instance metadata")]
     NoCredentials,
+    #[error("unexpected status code: {0}")]
+    UnexpectedStatusCode(u16),
 }

s3/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rust-s3"
-version = "0.34.0"
+version = "0.35.0-alpha.1"
 authors = ["Drazen Urch"]
 description = "Rust library for working with AWS S3 and compatible object storage APIs"
 repository = "https://github.com/durch/rust-s3"
@@ -42,12 +42,12 @@ path = "../examples/gcs-tokio.rs"
 [dependencies]
 async-std = { version = "1", optional = true }
 async-trait = "0.1"
-attohttpc = { version = "0.26", optional = true, default-features = false }
-aws-creds = { version = "0.36", default-features = false }
-# aws-creds = { path = "../aws-creds", default-features = false }
-aws-region = "0.25.4"
-# aws-region = {path = "../aws-region"}
-base64 = "0.21"
+attohttpc = { version = "0.28", optional = true, default-features = false }
+# aws-creds = { version = "0.36", path = "../aws-creds", default-features = false }
+# aws-region = { version = "0.25.4", path = "../aws-region" }
+aws-region = "0.25"
+aws-creds = { version = "0.37", default-features = false }
+base64 = "0.22"
 cfg-if = "1"
 time = { version = "^0.3.6", features = ["formatting", "macros"] }
 futures = { version = "0.3", optional = true }
@@ -60,16 +60,21 @@ hyper = { version = "0.14", default-features = false, features = [
     "client",
     "http1",
     "stream",
+    "tcp",
 ], optional = true }
 hyper-tls = { version = "0.5.0", default-features = false, optional = true }
+hyper-rustls = { version = "0.24", default-features = false, optional = true }
+rustls = { version = "0.21", optional = true }
+tokio-rustls = { version = "0.24.1", optional = true }
+rustls-native-certs = { version = "0.6.3", optional = true }
 log = "0.4"
 maybe-async = { version = "0.2" }
 md5 = "0.7"
 percent-encoding = "2"
 serde = "1"
 serde_json = "1"
 serde_derive = "1"
-quick-xml = { version = "0.30", features = ["serialize"] }
+quick-xml = { version = "0.32", features = ["serialize"] }
 sha2 = "0.10"
 thiserror = "1"
 surf = { version = "2", optional = true, default-features = false, features = [
@@ -88,24 +93,28 @@ block_on_proc = { version = "0.2", optional = true }
 
 [features]
 default = ["tags", "use-tokio-native-tls", "fail-on-err"]
-use-tokio-native-tls = ["with-tokio", "aws-creds/native-tls"]
-with-tokio = [
-    "hyper",
-    "hyper-tls",
-    "tokio",
-    "tokio/fs",
-    "tokio-stream",
+use-tokio-native-tls = [
+    "with-tokio",
+    "aws-creds/native-tls",
     "tokio-native-tls",
+    "hyper-tls",
     "native-tls",
-    "futures",
 ]
+with-tokio = ["hyper", "tokio", "tokio/fs", "tokio-stream", "futures"]
 async-std-native-tls = ["with-async-std", "aws-creds/native-tls"]
 http-credentials = ["aws-creds/http-credentials"]
 with-async-std = ["async-std", "surf", "futures-io", "futures-util", "futures"]
 sync = ["attohttpc", "maybe-async/is_sync"]
 no-verify-ssl = []
 fail-on-err = []
-tokio-rustls-tls = ["with-tokio", "aws-creds/rustls-tls"]
+tokio-rustls-tls = [
+    "with-tokio",
+    "aws-creds/rustls-tls",
+    "tokio-rustls",
+    "hyper-rustls",
+    "rustls",
+    "rustls-native-certs",
+]
 sync-native-tls = ["sync", "aws-creds/native-tls", "attohttpc/tls"]
 sync-native-tls-vendored = [
     "sync",
@@ -120,5 +129,5 @@ tags = ["minidom"]
 tokio = { version = "1", features = ["rt", "rt-multi-thread", "macros", "fs"] }
 async-std = { version = "1", features = ["attributes"] }
 uuid = { version = "1", features = ["v4"] }
-env_logger = "0.10"
+env_logger = "0.11"
 anyhow = "1"

s3/src/bucket.rs

@@ -10,7 +10,7 @@ use crate::command::{Command, Multipart};
 use crate::creds::Credentials;
 use crate::region::Region;
 #[cfg(feature = "with-tokio")]
-use crate::request::tokio_backend::client;
+use crate::request::tokio_backend::{client, HttpsConnector};
 use crate::request::ResponseData;
 #[cfg(any(feature = "with-tokio", feature = "with-async-std"))]
 use crate::request::ResponseDataStream;
@@ -106,7 +106,7 @@ pub struct Bucket {
     path_style: bool,
     listobjects_v2: bool,
     #[cfg(feature = "with-tokio")]
-    http_client: Arc<hyper::Client<hyper_tls::HttpsConnector<hyper::client::HttpConnector>>>,
+    http_client: Arc<hyper::Client<HttpsConnector<hyper::client::HttpConnector>>>,
 }
 
 impl Bucket {
@@ -124,9 +124,7 @@ impl Bucket {
     }
 
     #[cfg(feature = "with-tokio")]
-    pub fn http_client(
-        &self,
-    ) -> Arc<hyper::Client<hyper_tls::HttpsConnector<hyper::client::HttpConnector>>> {
+    pub fn http_client(&self) -> Arc<hyper::Client<HttpsConnector<hyper::client::HttpConnector>>> {
         Arc::clone(&self.http_client)
     }
 }
@@ -259,6 +257,7 @@ impl Bucket {
         path: S,
         expiry_secs: u32,
         custom_headers: Option<HeaderMap>,
+        custom_queries: Option<HashMap<String, String>>,
     ) -> Result<String, S3Error> {
         validate_expiry(expiry_secs)?;
         let request = RequestImpl::new(
@@ -267,6 +266,7 @@ impl Bucket {
             Command::PresignPut {
                 expiry_secs,
                 custom_headers,
+                custom_queries,
             },
         )
         .await?;
@@ -908,13 +908,17 @@ impl Bucket {
     /// # }
     /// ```
     #[maybe_async::async_impl]
-    pub async fn get_object_range_to_writer<T: AsyncWrite + Send + Unpin, S: AsRef<str>>(
+    pub async fn get_object_range_to_writer<T, S>(
         &self,
         path: S,
         start: u64,
         end: Option<u64>,
         writer: &mut T,
-    ) -> Result<u16, S3Error> {
+    ) -> Result<u16, S3Error>
+    where
+        T: AsyncWrite + Send + Unpin + ?Sized,
+        S: AsRef<str>,
+    {
         if let Some(end) = end {
             assert!(start < end);
         }
@@ -925,7 +929,7 @@ impl Bucket {
     }
 
     #[maybe_async::sync_impl]
-    pub async fn get_object_range_to_writer<T: std::io::Write + Send, S: AsRef<str>>(
+    pub async fn get_object_range_to_writer<T: std::io::Write + Send + ?Sized, S: AsRef<str>>(
         &self,
         path: S,
         start: u64,
@@ -979,7 +983,7 @@ impl Bucket {
     /// # }
     /// ```
     #[maybe_async::async_impl]
-    pub async fn get_object_to_writer<T: AsyncWrite + Send + Unpin, S: AsRef<str>>(
+    pub async fn get_object_to_writer<T: AsyncWrite + Send + Unpin + ?Sized, S: AsRef<str>>(
         &self,
         path: S,
         writer: &mut T,
@@ -990,7 +994,7 @@ impl Bucket {
     }
 
     #[maybe_async::sync_impl]
-    pub fn get_object_to_writer<T: std::io::Write + Send, S: AsRef<str>>(
+    pub fn get_object_to_writer<T: std::io::Write + Send + ?Sized, S: AsRef<str>>(
         &self,
         path: S,
         writer: &mut T,
@@ -1098,7 +1102,7 @@ impl Bucket {
     /// # }
     /// ```
     #[maybe_async::async_impl]
-    pub async fn put_object_stream<R: AsyncRead + Unpin>(
+    pub async fn put_object_stream<R: AsyncRead + Unpin + ?Sized>(
         &self,
         reader: &mut R,
         s3_path: impl AsRef<str>,
@@ -1214,7 +1218,7 @@ impl Bucket {
     }
 
     #[maybe_async::async_impl]
-    async fn _put_object_stream_with_content_type<R: AsyncRead + Unpin>(
+    async fn _put_object_stream_with_content_type<R: AsyncRead + Unpin + ?Sized>(
         &self,
         reader: &mut R,
         s3_path: &str,
@@ -1316,7 +1320,7 @@ impl Bucket {
     }
 
     #[maybe_async::sync_impl]
-    fn _put_object_stream_with_content_type<R: Read>(
+    fn _put_object_stream_with_content_type<R: Read + ?Sized>(
         &self,
         reader: &mut R,
         s3_path: &str,
@@ -3062,7 +3066,7 @@ mod test {
         );
 
         let url = bucket
-            .presign_put(s3_path, 86400, Some(custom_headers))
+            .presign_put(s3_path, 86400, Some(custom_headers), None)
             .await
             .unwrap();