Skip to content

Commit 9ad1c24

Browse files
committed
Restrict bedrock bearer auth by trait
1 parent 6ddd29d commit 9ad1c24

2 files changed

Lines changed: 22 additions & 2 deletions

File tree

awscli/botocore/handlers.py

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1252,7 +1252,10 @@ def _set_auth_scheme_preference_signer(context, signing_name, **kwargs):
12521252
# is allowed for this service. This can override earlier resolution if the
12531253
# config object didn't explicitly set a signature version.
12541254
if _should_prefer_bearer_auth(
1255-
has_in_code_configuration, signing_name, resolved_signature_version
1255+
has_in_code_configuration,
1256+
signing_name,
1257+
resolved_signature_version,
1258+
auth_options,
12561259
):
12571260
register_feature_id('BEARER_SERVICE_ENV_VARS')
12581261
resolved_signature_version = 'bearer'
@@ -1263,11 +1266,17 @@ def _set_auth_scheme_preference_signer(context, signing_name, **kwargs):
12631266

12641267

12651268
def _should_prefer_bearer_auth(
1266-
has_in_code_configuration, signing_name, resolved_signature_version
1269+
has_in_code_configuration,
1270+
signing_name,
1271+
resolved_signature_version,
1272+
auth_options,
12671273
):
12681274
if signing_name not in get_bearer_auth_supported_services():
12691275
return False
12701276

1277+
if not auth_options or 'smithy.api#httpBearerAuth' not in auth_options:
1278+
return False
1279+
12711280
has_token = get_token_from_environment(signing_name) is not None
12721281

12731282
# Prefer 'bearer' if a bearer token is available, and either:

tests/unit/botocore/test_handlers.py

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1981,6 +1981,17 @@ def test_set_auth_scheme_preference_signer(
19811981
"test_token",
19821982
None,
19831983
),
1984+
# Case 6: Service has 'bedrock' signing name but does not support bearer auth.
1985+
(
1986+
"bedrock",
1987+
{
1988+
"signature_version": "v4",
1989+
"auth_scheme_preference": ClientConfigString("httpBearerAuth"),
1990+
},
1991+
["aws.auth#sigv4"],
1992+
"test_token",
1993+
None,
1994+
),
19841995
],
19851996
)
19861997
def test_set_auth_scheme_preference_signer_with_bearer_token(

0 commit comments

Comments
 (0)