STSAssumeRoleSessionCredentialsProvider with external ID

[jnewbigin]

I am successfully using:
AWSCredentialsProvider = STSAssumeRoleSessionCredentialsProvider|arn:aws:iam::<account_id>:role/<role_name>|<session_name>

However I am now required to add an external id for the assume role.

STSAssumeRoleSessionCredentialsProvider does support this but there does not seem to be a way to pass it in via the AWSCredentialsProviderPropertyValueDecoder.

I am not a java expert so it may be that it is not obvious exactly how to do that.

Question 2:
If I must write my own custom provider to get this functionality, must I also use the com.amazonaws.auth. namespace in order for AWSCredentialsProviderPropertyValueDecoder to find it?

[jnewbigin]

I found the answer to Q2 by my self.
* 3. Customer provides a custom credentials provider with full name of provider

[jnewbigin]

I managed to get my requirement working by adding this class

package com.au.zzz;

import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.auth.AWSSessionCredentials;
import com.amazonaws.auth.AWSSessionCredentialsProvider;
import com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider;
import com.amazonaws.auth.DefaultAWSCredentialsProviderChain;

public class ZZZCredentialsProvider implements AWSSessionCredentialsProvider {
        private STSAssumeRoleSessionCredentialsProvider provider;

        public ZZZCredentialsProvider(String roleArn, String roleSessionName, String roleExternalId) {
                provider = new STSAssumeRoleSessionCredentialsProvider.Builder(roleArn, roleSessionName).withExternalId(roleExternalId).build();
        }

        public AWSSessionCredentials getCredentials() {
                return provider.getCredentials();
        }

        public void refresh() {
        }
}

And then properties
AWSCredentialsProvider = com.au.zzz.ZZZCredentialsProvider|arn:aws:iam::<account_id>:role/<role_name>|<session_name>|<external_id>

[jnewbigin]

If AWSCredentialsProviderPropertyValueDecoder had some mechanism to use the Builder pattern rather than string constructors then we would not need to write custom java code.

[pfifer]

Thanks for reporting this.

We are currently working on the MultiLang Daemon for the 2.x release, and will be looking at making credentials creation easier.

[stair-aws]

(Please disregard the unintentional spam from force-pushing.)

Starting w/ KCL 2.5.2, you no longer need to author your own Java class(es) to set an external id. This can now be done by appending an optional nested property of |externalId=<externalId>. You can read more about this documented feature here: https://github.com/awslabs/amazon-kinesis-client/blob/master/docs/multilang/configuring-credential-providers.md