safe-global / safe-client-gateway / 30081593925

88%

Build Type

push

github

Committed by web-flow

Commit Message

fix: give KMS field encryption its own web identity token file env var (#3298)

AwsKmsService resolved IRSA credentials via AWS_WEB_IDENTITY_TOKEN_FILE, the same env var used by SES and the billing webhook signer, so enabling IRSA for one AWS integration silently made the KMS client assume that integration's role too. Field encryption's KMS client now reads a
dedicated KMS_AWS_WEB_IDENTITY_TOKEN_FILE, and resolveAwsCredentials correctly passes the token file path into the AWS SDK instead of relying on it re-reading the ambient env var.

Coverage Stats

3783 of 4518 branches covered (83.73%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

9785 of 10838 relevant lines covered (90.28%)

510.75 hits per line