Add business metrics support for STS and Profile credential providers #6426

S-Saranya1 · 2025-09-16T18:22:02Z

Adds business metric tracking for credentials

Motivation and Context

Keeping track of how users are providing credentials to SDKs and which credentials providers are being used.

Modifications

This PR adds business metrics support for these credential providers:

CREDENTIALS_STS_ASSUME_ROLE("i") - StsAssumeRoleCredentialsProvider
CREDENTIALS_STS_ASSUME_ROLE_SAML("j") - StsAssumeRoleWithSamlCredentialsProvider
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID("k") - StsAssumeRoleWithWebIdentityCredentialsProvider
CREDENTIALS_STS_FEDERATION_TOKEN("l") - StsGetFederationTokenCredentialsProvider
CREDENTIALS_STS_SESSION_TOKEN("m") - StsGetSessionTokenCredentialsProvider
CREDENTIALS_PROFILE("n")- ProfileCredentialsProvider
CREDENTIALS_PROFILE_SOURCE_PROFILE("o") - ProfileCredentialsProvider + other providers
CREDENTIALS_PROFILE_NAMED_PROVIDER("p") - ProfileCredentialsProvider + InstanceProfile or ContainerCredentialsProvider
CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN("q") - ProfileCredentialsProvider + StsAssumeRoleWithWebIdentityCredentialsProvider
CREDENTIALS_SSO("s") - SsoCredentialsProvider
CREDENTIALS_PROFILE_SSO("r") - ProfileCredentialsProvider + SsoCredentialsProvider
CREDENTIALS_PROFILE_SSO_LEGACY("t") - ProfileCredentialsProvider + SsoCredentialsProvider
CREDENTIALS_PROFILE_PROCESS("v") - ProfileCredentialsProvider + ProcessCredentialsProvider

Key Technical Changes

Source Propagation: Introduces source parameter on credential provider builders to track credential provider chains
- Example: Profile AssumeRole with environment variables → User-Agent contains m/n,g,i (profile + env vars + assume role)
Provider Name Updates: Changes existing providerName() methods to return business metric codes instead of full class names
Chain Tracking: Supports credential scenarios like:
- Profile with credential_source = Ec2InstanceMetadata
- Fallback chains when primary providers fail

Example User-Agent Output

Simple environment variables: m/g
Profile AssumeRole chain: m/n,o,i
Failed AssumeRole fallback: m/g (only successful provider shown)

Testing

Added unit tests for profile-based STS credential scenarios including AssumeRole with source_profile, credential_source configurations, and failure fallback scenarios.

Screenshots (if appropriate)

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)

Checklist

I have read the CONTRIBUTING document
Local run of mvn install succeeds
My code follows the code style of this project
My change requires a change to the Javadoc documentation
I have updated the Javadoc documentation accordingly
I have added tests to cover my changes
All new and existing tests passed
I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

I confirm that this pull request can be released under the Apache 2 license

sonarqubecloud · 2025-09-18T17:13:53Z

Quality Gate failed

Failed conditions
65.2% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

zoewangg · 2025-09-18T16:29:55Z

.../src/main/java/software/amazon/awssdk/auth/credentials/internal/ProfileCredentialsUtils.java

                                         .build();
    }

    /**
     * Create the SSO credentials provider based on the related profile properties.
     */
    private AwsCredentialsProvider ssoProfileCredentialsProvider() {
-        validateRequiredPropertiesForSsoCredentialsProvider();
+        boolean isLegacy = validateRequiredPropertiesForSsoCredentialsProvider();


Don't we throw exception if it's invalid in validateRequiredPropertiesForSsoCredentialsProvider?

zoewangg · 2025-09-18T22:03:27Z

...ain/java/software/amazon/awssdk/auth/credentials/ChildProfileCredentialsProviderFactory.java

+     * previous credentials providers that are chained with this one.
+     * @return The credentials provider with permissions derived from the source credentials provider and profile.
+     */
+    AwsCredentialsProvider create(AwsCredentialsProvider sourceCredentialsProvider, Profile profile, String source);


Can we create a wrapper object for those parameters? I'm trying to avoid the situation where we need to add a fourth parameter in the future and have to create another constructor.

Something like

AwsCredentialsProvider create(XXX input) //naming to be determined

Also, we should throw unsupportedoperation exception here otherwise it'd may break customers

zoewangg · 2025-09-18T22:09:07Z

services/sso/src/main/java/software/amazon/awssdk/services/sso/auth/SsoCredentialsProvider.java

+        if (!StringUtils.isEmpty(this.source)) {
+            providerName = String.format("%s,%s", this.source, providerName);
+        }


nit: can we move this logic to ctor so that we just compute this once and not every time? Also, can we use plain string concatenation since String.format is a bit expensive? String.format is okay for exceptional messages/logging statement because the impact is minimal (doesn't affect every request), it seems unnecessary here.

Same for other places

zoewangg · 2025-09-18T22:11:43Z

...a/software/amazon/awssdk/services/sts/internal/AssumeRoleWithWebIdentityRequestSupplier.java

@@ -48,6 +49,10 @@ public AssumeRoleWithWebIdentityRequest get() {
        return request.toBuilder().webIdentityToken(getToken(webIdentityTokenFile)).build();
    }

+    public String source() {


If it's nullable, we should use Optional<String>

zoewangg · 2025-09-18T22:44:39Z

...src/main/java/software/amazon/awssdk/services/sts/auth/StsAssumeRoleCredentialsProvider.java

@@ -145,6 +155,15 @@ public Builder refreshRequest(Consumer<AssumeRoleRequest.Builder> assumeRoleRequ
            return refreshRequest(AssumeRoleRequest.builder().applyMutation(assumeRoleRequest).build());
        }

+        /**
+         * An optional string list of {@link BusinessMetricFeatureId} denoting previous credentials providers


BusinessMetricFeatureId is a protected API and it's not intended for users to use directly. Can we update the javadoc to mention this method is primarily intended for use by AWS SDK internal components?

Same for other places

zoewangg · 2025-09-18T22:48:06Z

...ava/software/amazon/awssdk/services/sts/auth/StsWebIdentityTokenFileCredentialsProvider.java

+        AwsCredentials awsCredentials = credentialsProvider.resolveCredentials();
+        if (awsCredentials instanceof AwsSessionCredentials) {
+            AwsSessionCredentials sessionCredentials = (AwsSessionCredentials) awsCredentials;
+            Optional<String> providerName = awsCredentials.providerName();
+            if (providerName.isPresent()) {
+                return sessionCredentials.copy(s -> s.providerName(providerName.get() + "," + PROVIDER_NAME));
+            }
+            return sessionCredentials;
+        }
+        return awsCredentials;
    }


Question: is there any reason we have special handling for this class? It seems for other providers, we just update the providerName method to include source

zoewangg · 2025-09-18T22:49:35Z

...ts/src/it/java/software/amazon/awssdk/auth/source/ProfileAssumeRoleFailureUserAgentTest.java

+            assertThat(userAgent).doesNotContain("o");
+            assertThat(userAgent).doesNotContain("n");
+
+        } catch (Exception e) {


We probably should not silently swallow exception. Same for other places

Feature IDs implementation for STS credentials

685e7ac

S-Saranya1 force-pushed the somepal/Credentials-featureID-implementation branch from 077e209 to 685e7ac Compare September 16, 2025 18:26

S-Saranya1 marked this pull request as ready for review September 16, 2025 18:28

S-Saranya1 requested a review from a team as a code owner September 16, 2025 18:28

S-Saranya1 changed the title ~~Somepal/credentials feature id implementation~~ Feature IDs implementation for STS credentials Sep 16, 2025

S-Saranya1 changed the title ~~Feature IDs implementation for STS credentials~~ Add business metrics support for STS and Profile credential providers Sep 16, 2025

Add business metric for SSO Creds

c16d58a

zoewangg reviewed Sep 18, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add business metrics support for STS and Profile credential providers #6426

Add business metrics support for STS and Profile credential providers #6426

S-Saranya1 commented Sep 16, 2025 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Sep 18, 2025

Uh oh!

zoewangg Sep 18, 2025

Uh oh!

zoewangg Sep 18, 2025

Uh oh!

zoewangg Sep 18, 2025

Uh oh!

zoewangg Sep 18, 2025

Uh oh!

zoewangg Sep 18, 2025

Uh oh!

zoewangg Sep 18, 2025

Uh oh!

zoewangg Sep 18, 2025

Uh oh!

Uh oh!

Add business metrics support for STS and Profile credential providers #6426

Are you sure you want to change the base?

Add business metrics support for STS and Profile credential providers #6426

Conversation

S-Saranya1 commented Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

Modifications

Example User-Agent Output

Testing

Screenshots (if appropriate)

Types of changes

Checklist

License

Uh oh!

sonarqubecloud bot commented Sep 18, 2025

Quality Gate failed

Uh oh!

zoewangg Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

S-Saranya1 commented Sep 16, 2025 •

edited

Loading