feat(auth): AWS sourced external accounts by alvarowolfx · Pull Request #4790 · googleapis/google-cloud-rust

alvarowolfx · 2026-02-24T17:06:47Z

Towards #3644

codecov · 2026-02-24T17:23:09Z

Codecov Report

❌ Patch coverage is 90.10417% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.90%. Comparing base (b7e90c7) to head (134f14a).
⚠️ Report is 15 commits behind head on main.

Files with missing lines	Patch %	Lines
...redentials/external_account_sources/aws_sourced.rs	90.60%	17 Missing ⚠️
src/auth/src/credentials/external_account.rs	81.81%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4790      +/-   ##
==========================================
- Coverage   95.03%   94.90%   -0.14%     
==========================================
  Files         199      200       +1     
  Lines        7772     7961     +189     
==========================================
+ Hits         7386     7555     +169     
- Misses        386      406      +20

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

alvarowolfx · 2026-02-24T19:45:36Z

Successfully tested using our internal go/3pi-sdk-testing process.

use google_cloud_auth::credentials::Builder;
use google_cloud_storage::client::StorageControl;

const BUCKET_ID: &str = "REDACTED";

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    println!("Building Credentials...");
    // Will use ADC with the environment variable set
    let creds = Builder::default().build()?;
    println!("Credentials built: {:?}", creds);

    let client = StorageControl::builder()
        .with_credentials(creds)
        .build()
        .await?;
    let bucket = client
        .get_bucket()
        .set_name(format!("projects/_/buckets/{BUCKET_ID}"))
        .send()
        .await?;
    println!("successfully obtained bucket metadata {bucket:?}");

    Ok(())
}

output:

[REDACTED rust]$ export GOOGLE_APPLICATION_CREDENTIALS=/home/ec2-user/aws-credentials.json
[REDACTED rust]$ ./external_account 
Building Credentials...
Credentials built: Credentials { inner: AccessTokenCredentials { inner: ExternalAccountCredentials { token_provider: TokenCache { rx_token: Receiver { shared: Shared { value: RwLock(PhantomData<std::sync::poison::rwlock::RwLock<core::option::Option<core::result::Result<(google_cloud_auth::token::Token, google_cloud_auth::credentials::EntityTag), google_cloud_gax::error::credentials::CredentialsError>>>>, RwLock { data: None }), version: Version(0), is_closed: false, ref_count_rx: 1 }, version: Version(0) } }, quota_project_id: None } } }

successfully obtained bucket metadata Bucket { name: "projects/_/buckets/REDACTED", bucket_id: "REDACTED ", etag: "CAg=", project: "projects/REDACTED", metageneration: 8, location: "US", location_type: "multi-region", storage_class: "STANDARD", rpo: "DEFAULT", acl: [], default_object_acl: [], lifecycle: None, create_time: Some(Timestamp { seconds: 1600382470, nanos: 633000000 }), cors: [], update_time: Some(Timestamp { seconds: 1719936392, nanos: 166000000 }), default_event_based_hold: false, labels: {}, website: None, versioning: None, logging: None, owner: None, encryption: None, billing: None, retention_policy: None, iam_config: Some(IamConfig { uniform_bucket_level_access: Some(UniformBucketLevelAccess { enabled: false, lock_time: None }), public_access_prevention: "inherited" }), satisfies_pzs: false, custom_placement_config: None, autoclass: None, hierarchical_namespace: None, soft_delete_policy: Some(SoftDeletePolicy { retention_duration: Some(Duration { seconds: 604800, nanos: 0 }), effective_time: Some(Timestamp { seconds: 1709280000, nanos: 0 }) }), object_retention: None, ip_filter: None }

coryan

Pretty good, a few nits and suggestions. Try to refactor the code making HTTP requests so the error handling is all in one place.

coryan · 2026-02-24T20:04:11Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

+    value: String,
+}
+
+const MSG: &str = "failed to fetch AWS credentials for subject token";


nit: move above with the other constants?

coryan · 2026-02-24T20:04:58Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeMap;
+


nit: remove the blank line.

coryan · 2026-02-24T20:07:31Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

+    let sts_url = if sts_url.starts_with("http") {
+        sts_url
+    } else {
+        format!("https://{sts_url}")
+    };
+    let url = url::Url::parse(&sts_url)


If you are already going to use url::Url::parse() shouldn't that be able to handle the missing scheme?

coryan · 2026-02-24T20:16:38Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

+fn parse_region_from_zone(zone: &str) -> Option<String> {
+    let zone = zone.trim();
+    if zone.is_empty() {
+        return None;
+    }
+    if let Some(last_char) = zone.chars().last() {
+        if last_char.is_ascii_alphabetic() && zone.len() > 1 {
+            let potential_region = &zone[..zone.len() - 1];
+            if potential_region
+                .chars()
+                .last()
+                .is_some_and(|c| c.is_ascii_digit())
+            {
+                return Some(potential_region.to_string());
+            }
+        }
+    }
+    Some(zone.to_string())
+}


Consider:

Suggested change

fn parse_region_from_zone(zone: &str) -> Option<String> {

let zone = zone.trim();

if zone.is_empty() {

return None;

}

if let Some(last_char) = zone.chars().last() {

if last_char.is_ascii_alphabetic() && zone.len() > 1 {

let potential_region = &zone[..zone.len() - 1];

if potential_region

.chars()

.last()

.is_some_and(|c| c.is_ascii_digit())

{

return Some(potential_region.to_string());

}

}

}

Some(zone.to_string())

}

fn parse_region_from_zone(zone: &str) -> Option<&str> {

let zone = zone.trim();

let parts: Vec<&str> = id.split('-').collect();

match &parts[..] {

[geo, region, letter] if !letter.is_empty() && !geo.is_empty() => Some(region),

_ => None,

}

}

If you push me, we can save the memory allocation using:

fn parse_region_from_zone(zone: &str) -> Option<&str> { let zone = zone.trim(); let parts = id.split('-'); match (parts.next(), parts.next(), parts.next(), parts.next()) { (Some(geo), Some(region), Some(z), None] if !z.is_empty() && !geo.is_empty() => Some(region), _ => None, } }

Ah, I see in the tests that AWS zones can have four parts: just add a branch to the match case.

coryan · 2026-02-24T20:19:29Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

+            if !response.status().is_success() {
+                return Err(errors::from_http_response(
+                    response,
+                    "could not resolve AWS role name",
+                )
+                .await);
+            }


This block repeats at least 3 times. Time to refactor to a function?

coryan · 2026-02-24T20:20:07Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

+            if !response.status().is_success() {
+                return Err(
+                    errors::from_http_response(response, "could not resolve AWS region").await,
+                );
+            }


This is a prior repeat...

coryan · 2026-02-24T20:20:29Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

+            if !response.status().is_success() {
+                return Err(errors::from_http_response(
+                    response,
+                    "could not resolve AWS credentials",
+                )
+                .await);
+            }


Here is another...

coryan · 2026-02-24T20:30:51Z

src/auth/Cargo.toml

+hmac.workspace        = true
+hex                   = { workspace = true, features = ["std"] }
+url.workspace         = true
+sha2.workspace        = true


nit: insert these in alphabetical order.

coryan · 2026-02-24T20:31:25Z

src/auth/src/credentials/external_account_sources/aws_sourced.rs

@@ -0,0 +1,770 @@
+// Copyright 2025 Google LLC


alvarowolfx added 2 commits February 24, 2026 17:03

feat(auth): AWS sourced external accounts

226e489

fix: fmt all the things

134f14a

alvarowolfx marked this pull request as ready for review February 24, 2026 19:56

alvarowolfx requested review from a team as code owners February 24, 2026 19:56

alvarowolfx requested a review from sai-sunder-s February 24, 2026 19:58

coryan requested changes Feb 24, 2026

View reviewed changes

Comments

Conversation

alvarowolfx commented Feb 24, 2026

Uh oh!

codecov bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

alvarowolfx commented Feb 24, 2026

Uh oh!

coryan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Feb 24, 2026 •

edited

Loading