Skip to content

Allow selecting AWS SDK TLS features #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dertin wants to merge 7 commits into
base: main
Choose a base branch
from
+29 −3
Open

Allow selecting AWS SDK TLS features #197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0196549
Allow selecting AWS SDK TLS features
dertin Apr 30, 2026
5a23064
Merge branch 'main' into fix/caching-client-tls-features
simonmarty May 11, 2026
3934127
Update Cargo.toml
simonmarty May 11, 2026
8ea33e4
Merge branch 'main' into fix/caching-client-tls-features
simonmarty May 14, 2026
c1a8d01
Merge branch 'main' into fix/caching-client-tls-features
dertin Jun 24, 2026
7b96434
Merge branch 'main' into fix/caching-client-tls-features
simonmarty Jul 7, 2026
9b40629
Merge branch 'main' into fix/caching-client-tls-features
reyhankoyun Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions aws_secretsmanager_caching/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,20 @@ repository = "https://github.com/aws/aws-workload-credentials-provider"
readme = "README.md"

[features]
default = ["rustls", "default-https-client", "rt-tokio", "credentials-process", "sso"]
credentials-process = ["aws-config/credentials-process"]
default-https-client = [
"aws-config/default-https-client",
"aws-sdk-secretsmanager/default-https-client",
]
rt-tokio = ["aws-config/rt-tokio", "aws-sdk-secretsmanager/rt-tokio"]
rustls = ["aws-sdk-secretsmanager/rustls"]

@secrets-manager-ai-code-review secrets-manager-ai-code-review Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Naming nit: this feature (rustls) shares its name with the non-optional rustls crate dependency below (rustls = "0.23"). Cargo tolerates this, but it makes fips = ["rustls/fips"] (which targets the crate) and rustls = ["aws-sdk-secretsmanager/rustls"] (the feature) read as if they're related when they're not. A distinct name such as sdk-rustls or legacy-tls would make intent clearer and avoid the collision. Non-blocking.

sso = ["aws-config/sso"]
fips = ["rustls/fips"]

@secrets-manager-ai-code-review secrets-manager-ai-code-review Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fips no longer pulls an HTTP/TLS client on its own.

Before this PR, aws-sdk-secretsmanager/aws-config carried their default features (which included a TLS transport), so a build that only enabled fips still had a working HTTP client. Now that both SDK deps are default-features = false, fips = ["rustls/fips"] only turns on the fips feature of the standalone rustls 0.23 crate — it does not enable default-https-client, rt-tokio, or the SDK rustls feature.

So a downstream build like:

aws_secretsmanager_caching = { version = "2", default-features = false, features = ["fips"] }

compiles but has no SDK HTTP client and will fail at runtime when it tries to make a call. Two questions worth confirming:

  1. Does the standalone rustls 0.23 crate's FIPS provider actually get wired into the SDK's TLS path? Per the PR description the SDK rustls feature resolves the legacy aws-smithy-runtime/tls-rustls (rustls 0.21) stack — a different major version — so it's not obvious rustls/fips on 0.23 affects the transport the SDK uses.
  2. If fips is meant to be usable standalone, consider making it self-sufficient, e.g. fips = ["rustls/fips", "rustls"] (and/or "default-https-client"), plus a README note that FIPS requires the legacy rustls feature.

test-util = []

[dependencies]
aws-sdk-secretsmanager = "1"
aws-sdk-secretsmanager = { version = "1", default-features = false }
aws-smithy-runtime-api = "1"
aws-smithy-types = "1"
serde_json = "1"
Expand All @@ -22,14 +31,18 @@ serde = { version = "1", features = ["derive"] }
thiserror = "2"
tokio = { version = "1", features = ["rt-multi-thread", "sync"] }
linked-hash-map = "0.5.6"
aws-config = "1"
aws-config = { version = "1", default-features = false }
rustls = "0.23"
log = "0.4.29"

[dev-dependencies]
aws-smithy-mocks = "0.2"
aws-smithy-runtime = { version = "1", features = ["test-util", "wire-mock"] }
aws-sdk-secretsmanager = { version = "1", features = ["test-util"] }
aws-sdk-secretsmanager = { version = "1", default-features = false, features = [
"test-util",
"default-https-client",
"rt-tokio",
] }
tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync", "test-util"] }
http = "0"
tokio-test = "0.4.4"
Expand Down
13 changes: 13 additions & 0 deletions aws_secretsmanager_caching/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,19 @@ cargo add tokio -F rt-multi-thread,net,macros
cargo add aws_secretsmanager_caching
```

By default, this crate enables the same AWS SDK features as the AWS SDK service client defaults.
Applications that want to select the SDK HTTP client explicitly can disable default features and
enable the required AWS SDK features:

```toml
aws_secretsmanager_caching = { version = "2", default-features = false, features = [
"default-https-client",
"rt-tokio",
"credentials-process",
"sso",
] }
Comment on lines +31 to +38

@secrets-manager-ai-code-review secrets-manager-ai-code-review Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The documented opt-out example uses version = "2", but the crate is currently at 2.1.0 and this new feature wiring only exists from the release that ships this PR. A caret "2" requirement will happily resolve to an older 2.x that lacks these features, and default-features = false there would leave the user with no SDK features at all. Consider pinning the example to the minimum version that introduces these features (e.g. "2.2"), matching whatever version you bump to for this change.

Also, version in the [package] section (line 3) is still 2.1.0 — a feature-adding change like this should bump the minor version so downstreams can require it.

```

```rust
use aws_secretsmanager_caching::SecretsManagerCachingClient;
use std::num::NonZeroUsize;
Expand Down
Loading