stacklok / toolhive / 21831437508

62%

push

github

Add AWS STS token exchange for OIDC-to-AWS credential conversion (#3659)

* Add AWS STS token exchange for OIDC-to-AWS credential conversion

This implements the Exchanger component that converts OIDC identity tokens
into temporary AWS credentials using STS AssumeRoleWithWebIdentity. The
exchanger uses regional STS endpoints for lower latency and maps STS API
errors to package-level sentinel errors for consistent error handling.

Related: #3567

* Address PR review feedback for AWS STS token exchanger

- Use anonymous credentials for STS client since AssumeRoleWithWebIdentity
  does not require pre-existing AWS credentials
- Remove manual BaseEndpoint override and let the SDK resolve regional
  endpoints natively
- Replace raw STS error wrapping with sentinel errors to prevent leaking
  sensitive information (account IDs, role ARNs, token fragments)
- Convert bare fmt.Errorf validation errors to sentinel errors for
  consistency with the rest of the package
- Add nil check on STS output at the interface boundary

47 of 72 new or added lines in 1 file covered. (65.28%)

42348 of 69014 relevant lines covered (61.36%)

76.88 hits per line