feat: Update STS web identity credentials provider & add integration test

[sichanyoo]

Issue #

#1189
#1194

Description of changes

• Updates the SDK wrapper for STS web identity credentials provider following CRT changes here: https://github.com/awslabs/aws-crt-swift/pull/199/files
• Add the integration test for STS web identity credentials provider that uses STS, IAM, and Cognito.

Integration test structure overview:

1. Create a temporary role with assume role policy that accepts unauthenticated OIDC tokens made by Cognito
2. Create a Cognito identity pool, then fetch Cognito ID from it, then fetch OIDC token from it using Cognito ID
3. Save the fetched OIDC token to a file
4. Construct STS web identity credentials provider using the role and the file path to cached token
5. Call STS::getCallerIdentity using a STS client that has just the STS web identity credentials provider configured
6. Confirm request succeeded by checking response fields (not nil & not empty string)
7. Clean up role policy, role, Cognito identity pool, and token file after the test

New/existing dependencies impact assessment, if applicable

Conventional Commits

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[dayaffe]

We might want to use FileManager.default.temporaryDirectory instead of NSHomeDirectory()

[sichanyoo]

Changed as suggested.

[dayaffe]

Can we move helpers and role information to a separate file so that this file is easier to read

[sichanyoo]

I'd rather keep stuff for this integration test confined to one file. I'll go ahead and refactor stuff into more helper methods and locate them all at bottom of file for better readability.

[dayaffe]

We shouldn't introduce anything non-deterministic in our integration tests if we can help it. A better approach would be to poll IAM to see if the role was created successfully.

Example using getRole:

func isRoleReady(iamClient: IAMClient, roleName: String) async -> Bool {
    do {
        let response = try await iamClient.getRole(input: GetRoleInput(roleName: roleName))
        return response.role != nil
    } catch {
        return false
    }
}

Then you can setup a function that calls isRoleReady every X seconds using Task.sleep until a configured timeout (if after X seconds/minutes the role is still not there, throw an error).

[sichanyoo]

It definitely would be ideal to have some polling mechanism like the one you suggested instead of a fixed wait behavior, but getRole doesn't serve our purpose here (nor does any other IAM API). That's because changes to IAM entities become available to IAM API immediately BUT it takes time for that info to propagate everywhere. With 7 second wait it reliably passed every time on local machine, so I made it 10 just to be safe. Here's a relevant stackoverflow discussion if you'd like to read more about it.

[jbelkins]

Also see if there is a waiter defined on the service for the resource you are waiting on.

Check the Kinesis integration test: it uses a predefined waiter and manual waiting in two stages of the test to ensure conditions are met before proceeding.

[sichanyoo]

Tried the waiters and they don't serve the polling purpose in this instance for the same reasons explained above, as expected. Unless IAM provides some sort of API where it shows IAM identity's propagation status, I don't think it's possible to poll this info.

[jbelkins]

Okay, we can try this live in CI for a while, but we'll have to revisit this test if it causes spurious failures in practice.

With the size & complexity of our test suite, we can't afford even a small number of flaky tests.

[dayaffe]

Make use of Swift's multi-line comments instead of ...

[sichanyoo]

Changed as suggested.

[dayaffe]

Overall looks good! just a comment to use getRole instead of sleeping to make the test deterministic and some clean up

[jbelkins]

Xcode has a "mark" comment directive that can be used to delineate sections of code, and the marks you create show up in the list of symbols in the dropdown above the editor.

See: https://www.avanderlee.com/xcode/xcode-mark-line-comment/

[sichanyoo]

Changed as suggested.

[jbelkins]

Swift convention is that enum cases should be lowerCamelCase.

[sichanyoo]

Changed as suggested.

[jbelkins]

Also see if there is a waiter defined on the service for the resource you are waiting on.

Check the Kinesis integration test: it uses a predefined waiter and manual waiting in two stages of the test to ensure conditions are met before proceeding.

[jbelkins]

Approved, but note my comment on the time delay issue.