Ensure master credentials are refreshed before refreshing temporary c…

…redentials (#1389) * Ensure master credentials are refreshed before refreshing temporary credentials * Add changelog entry
aws · Mar 10, 2017 · 373a148 · 373a148
1 parent fb2fef7
commit 373a148
Show file tree

Hide file tree

Showing 4 changed files with 38 additions and 15 deletions.
diff --git a/.changes/next-release/bugfix-TemporaryCredentials-685384e2.json b/.changes/next-release/bugfix-TemporaryCredentials-685384e2.json
@@ -0,0 +1,5 @@
+{
+  "type": "bugfix",
+  "category": "TemporaryCredentials",
+  "description": "Ensure master credentials are not expired before using them to refresh temporary credentials"
+}
diff --git a/lib/credentials.d.ts b/lib/credentials.d.ts
@@ -36,26 +36,26 @@ export class Credentials {
     /**
      * AWS access key ID.
      */
-    accessKeyId: string
+    accessKeyId: string;
     /**
      * Whether the credentials have been expired and require a refresh.
      * Used in conjunction with expireTime.
      */
-    expired: boolean
+    expired: boolean;
     /**
      * Time when credentials should be considered expired.
      * Used in conjunction with expired.
      */
-    expireTime: Date
-    static expiryWindow: number
+    expireTime: Date;
+    static expiryWindow: number;
     /**
      * AWS secret access key.
      */
-    secretAccessKey: string
+    secretAccessKey: string;
     /**
      * AWS session token.
      */
-    sessionToken: string
+    sessionToken: string;
 }
 
 interface CredentialsOptions {
@@ -71,4 +71,4 @@ interface CredentialsOptions {
      * AWS session token.
      */
     sessionToken?: string
-}
+}
diff --git a/lib/credentials/temporary_credentials.js b/lib/credentials/temporary_credentials.js
@@ -83,14 +83,16 @@ AWS.TemporaryCredentials = AWS.util.inherit(AWS.Credentials, {
     self.createClients();
     if (!callback) callback = function(err) { if (err) throw err; };
 
-    self.service.config.credentials = self.masterCredentials;
-    var operation = self.params.RoleArn ?
-      self.service.assumeRole : self.service.getSessionToken;
-    operation.call(self.service, function (err, data) {
-      if (!err) {
-        self.service.credentialsFrom(data, self);
-      }
-      callback(err);
+    self.masterCredentials.get(function() {
+      self.service.config.credentials = self.masterCredentials;
+      var operation = self.params.RoleArn ?
+        self.service.assumeRole : self.service.getSessionToken;
+      operation.call(self.service, function (err, data) {
+        if (!err) {
+          self.service.credentialsFrom(data, self);
+        }
+        callback(err);
+      });
     });
   },
 
@@ -102,6 +104,10 @@ AWS.TemporaryCredentials = AWS.util.inherit(AWS.Credentials, {
     while (this.masterCredentials.masterCredentials) {
       this.masterCredentials = this.masterCredentials.masterCredentials;
     }
+
+    if (typeof this.masterCredentials.get !== 'function') {
+      this.masterCredentials = new AWS.Credentials(this.masterCredentials);
+    }
   },
 
   /**

diff --git a/test/credentials.spec.coffee b/test/credentials.spec.coffee
@@ -664,6 +664,18 @@ describe 'AWS.TemporaryCredentials', ->
           creds.refresh ->
             expect(spy.calls.length).to.equal(4)
 
+    it 'should refresh expired master credentials when refreshing self', ->
+      masterCreds = new AWS.Credentials('akid', 'secret')
+      masterCreds.expired = true;
+      refreshSpy = helpers.spyOn(masterCreds, 'refresh')
+
+      creds = new AWS.TemporaryCredentials({RoleArn: 'ARN'}, masterCreds);
+      creds.createClients()
+      mockSTS(new Date(AWS.util.date.getDate().getTime() + 100000),
+        RoleArn: 'ARN', RoleSessionName: 'temporary-credentials')
+      creds.refresh(->)
+      expect(refreshSpy.calls.length).to.equal(1)
+
 describe 'AWS.WebIdentityCredentials', ->
   creds = null