This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 3a3479946b78 CAMEL-26042: camel-aws2-sts - do not copy the temporary
secret key and session token into message headers (#29281)
3a3479946b78 is described below
commit 3a3479946b789069f281db83af9c62f28b1d5546
Author: Claus Ibsen <[email protected]>
AuthorDate: Fri Nov 6 08:28:01 2026 +0100
CAMEL-26042: camel-aws2-sts - do not copy the temporary secret key and
session token into message headers (#29281)
The assumeRole, getSessionToken and getFederationToken operations no longer
copy the temporary secret access key and session token into message headers;
they stay in the Credentials body. The header constants are deprecated.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
.../apache/camel/catalog/components/aws2-sts.json | 4 +-
.../camel/catalog/docs/aws2-sts-component.adoc | 11 ++++
.../apache/camel/component/aws2/sts/aws2-sts.json | 4 +-
.../src/main/docs/aws2-sts-component.adoc | 11 ++++
.../camel/component/aws2/sts/STS2Constants.java | 18 ++++++-
.../camel/component/aws2/sts/STS2Producer.java | 9 ++--
.../component/aws2/sts/AmazonSTSClientMock.java | 15 ++++--
.../camel/component/aws2/sts/STS2ProducerTest.java | 58 ++++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 10 ++++
.../endpoint/dsl/STS2EndpointBuilderFactory.java | 10 +++-
10 files changed, 133 insertions(+), 17 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json
index 7c8f668b5c00..36b27b636612 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/aws2-sts.json
@@ -50,8 +50,8 @@
"CamelAwsStsFederatedName": { "index": 3, "kind": "header", "displayName":
"", "group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The name of the federated user.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#FEDERATED_NAME" },
"CamelAwsStsAssumeRoleDurationSeconds": { "index": 4, "kind": "header",
"displayName": "", "group": "producer", "label": "", "required": false,
"javaType": "Integer", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The duration, in seconds, of the role
session. It could go from 900 seconds, to 1 to 12 hours (dependent on
administrator settings. The default if not specified is 3600 seconds.",
"constantName": "org.apache.camel.component. [...]
"CamelAwsStsAccessKeyId": { "index": 5, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The temporary access key ID.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#ACCESS_KEY_ID" },
- "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "",
"group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole
getSessionToken getFederationToken", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The temporary secret access key.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#SECRET_KEY_ID" },
- "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The temporary session token.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#SESSION_TOKEN" },
+ "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "",
"group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole
getSessionToken getFederationToken", "required": false, "javaType": "String",
"deprecated": true, "deprecationNote": "The producer no longer sets this
header. Take the secret access key from the body, such as
${body.credentials().secretAccessKey()}.", "autowired": false, "secret": false,
"description": "The temporary secret access k [...]
+ "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"String", "deprecated": true, "deprecationNote": "The producer no longer sets
this header. Take the session token from the body, such as
${body.credentials().sessionToken()}.", "autowired": false, "secret": false,
"description": "The temporary session token. Depr [...]
"CamelAwsStsExpiration": { "index": 8, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"java.time.Instant", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The expiration date and time of the
credentials.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#EXPIRATION" },
"CamelAwsStsAssumedRoleArn": { "index": 9, "kind": "header",
"displayName": "", "group": "assumeRole", "label": "assumeRole", "required":
false, "javaType": "String", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "description": "The Amazon Resource Name
(ARN) of the assumed role.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#ASSUMED_ROLE_ARN" }
},
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc
index a50c8648328b..6fde69e131ac 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/aws2-sts-component.adoc
@@ -81,6 +81,17 @@ Camel-AWS STS component provides the following operation on
the producer side:
- getSessionToken
- getFederationToken
+=== The temporary credentials
+
+The body of the message is the response of the AWS SDK, such as an
`AssumeRoleResponse`, and its `credentials()` hold
+the temporary credentials.
+
+The producer also sets the `CamelAwsStsAccessKeyId` and
`CamelAwsStsExpiration` headers, and for `assumeRole` the
+`CamelAwsStsAssumedRoleArn` header. It does not set headers with the secret
access key and the session token: take them
+from the body, such as `${body.credentials().secretAccessKey()}` and
`${body.credentials().sessionToken()}` with the
+xref:languages:simple-language.adoc[Simple] language. To keep them for later
steps of the route, store them in a
+variable rather than in a header, as message headers are logged, traced and
sent on by many producers.
+
== Examples
=== Producer Examples
diff --git
a/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json
b/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json
index 7c8f668b5c00..36b27b636612 100644
---
a/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json
+++
b/components/camel-aws/camel-aws2-sts/src/generated/resources/META-INF/org/apache/camel/component/aws2/sts/aws2-sts.json
@@ -50,8 +50,8 @@
"CamelAwsStsFederatedName": { "index": 3, "kind": "header", "displayName":
"", "group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The name of the federated user.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#FEDERATED_NAME" },
"CamelAwsStsAssumeRoleDurationSeconds": { "index": 4, "kind": "header",
"displayName": "", "group": "producer", "label": "", "required": false,
"javaType": "Integer", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The duration, in seconds, of the role
session. It could go from 900 seconds, to 1 to 12 hours (dependent on
administrator settings. The default if not specified is 3600 seconds.",
"constantName": "org.apache.camel.component. [...]
"CamelAwsStsAccessKeyId": { "index": 5, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The temporary access key ID.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#ACCESS_KEY_ID" },
- "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "",
"group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole
getSessionToken getFederationToken", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The temporary secret access key.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#SECRET_KEY_ID" },
- "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The temporary session token.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#SESSION_TOKEN" },
+ "CamelAwsStsSecretKey": { "index": 6, "kind": "header", "displayName": "",
"group": "assumeRole getSessionToken getFederationToken", "label": "assumeRole
getSessionToken getFederationToken", "required": false, "javaType": "String",
"deprecated": true, "deprecationNote": "The producer no longer sets this
header. Take the secret access key from the body, such as
${body.credentials().secretAccessKey()}.", "autowired": false, "secret": false,
"description": "The temporary secret access k [...]
+ "CamelAwsStsSessionToken": { "index": 7, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"String", "deprecated": true, "deprecationNote": "The producer no longer sets
this header. Take the session token from the body, such as
${body.credentials().sessionToken()}.", "autowired": false, "secret": false,
"description": "The temporary session token. Depr [...]
"CamelAwsStsExpiration": { "index": 8, "kind": "header", "displayName":
"", "group": "assumeRole getSessionToken getFederationToken", "label":
"assumeRole getSessionToken getFederationToken", "required": false, "javaType":
"java.time.Instant", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The expiration date and time of the
credentials.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#EXPIRATION" },
"CamelAwsStsAssumedRoleArn": { "index": 9, "kind": "header",
"displayName": "", "group": "assumeRole", "label": "assumeRole", "required":
false, "javaType": "String", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "description": "The Amazon Resource Name
(ARN) of the assumed role.", "constantName":
"org.apache.camel.component.aws2.sts.STS2Constants#ASSUMED_ROLE_ARN" }
},
diff --git
a/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc
b/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc
index a50c8648328b..6fde69e131ac 100644
--- a/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc
+++ b/components/camel-aws/camel-aws2-sts/src/main/docs/aws2-sts-component.adoc
@@ -81,6 +81,17 @@ Camel-AWS STS component provides the following operation on
the producer side:
- getSessionToken
- getFederationToken
+=== The temporary credentials
+
+The body of the message is the response of the AWS SDK, such as an
`AssumeRoleResponse`, and its `credentials()` hold
+the temporary credentials.
+
+The producer also sets the `CamelAwsStsAccessKeyId` and
`CamelAwsStsExpiration` headers, and for `assumeRole` the
+`CamelAwsStsAssumedRoleArn` header. It does not set headers with the secret
access key and the session token: take them
+from the body, such as `${body.credentials().secretAccessKey()}` and
`${body.credentials().sessionToken()}` with the
+xref:languages:simple-language.adoc[Simple] language. To keep them for later
steps of the route, store them in a
+variable rather than in a header, as message headers are logged, traced and
sent on by many producers.
+
== Examples
=== Producer Examples
diff --git
a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java
b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java
index 4dd8f30655d8..6f052ae3e55a 100644
---
a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java
+++
b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Constants.java
@@ -37,11 +37,25 @@ public interface STS2Constants {
@Metadata(label = "assumeRole getSessionToken getFederationToken",
description = "The temporary access key ID.", javaType =
"String")
String ACCESS_KEY_ID = "CamelAwsStsAccessKeyId";
+ /**
+ * @deprecated the producer no longer sets this header. Take the secret
access key from the body, such as
+ * {@code ${body.credentials().secretAccessKey()}}.
+ */
@Metadata(label = "assumeRole getSessionToken getFederationToken",
- description = "The temporary secret access key.", javaType =
"String")
+ description = "The temporary secret access key.", javaType =
"String",
+ deprecationNote = "The producer no longer sets this header. Take
the secret access key from the body,"
+ + " such as
${body.credentials().secretAccessKey()}.")
+ @Deprecated
String SECRET_KEY_ID = "CamelAwsStsSecretKey";
+ /**
+ * @deprecated the producer no longer sets this header. Take the session
token from the body, such as
+ * {@code ${body.credentials().sessionToken()}}.
+ */
@Metadata(label = "assumeRole getSessionToken getFederationToken",
- description = "The temporary session token.", javaType =
"String")
+ description = "The temporary session token.", javaType =
"String",
+ deprecationNote = "The producer no longer sets this header. Take
the session token from the body, such"
+ + " as ${body.credentials().sessionToken()}.")
+ @Deprecated
String SESSION_TOKEN = "CamelAwsStsSessionToken";
@Metadata(label = "assumeRole getSessionToken getFederationToken",
description = "The expiration date and time of the
credentials.", javaType = "java.time.Instant")
diff --git
a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java
b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java
index b795028b1e6e..78faf42b4eb9 100644
---
a/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java
+++
b/components/camel-aws/camel-aws2-sts/src/main/java/org/apache/camel/component/aws2/sts/STS2Producer.java
@@ -137,9 +137,8 @@ public class STS2Producer extends DefaultProducer {
Message message = getMessageForResponse(exchange);
message.setBody(result);
if (ObjectHelper.isNotEmpty(result.credentials())) {
+ // the secret access key and the session token are only in the
body, not in headers
message.setHeader(STS2Constants.ACCESS_KEY_ID,
result.credentials().accessKeyId());
- message.setHeader(STS2Constants.SECRET_KEY_ID,
result.credentials().secretAccessKey());
- message.setHeader(STS2Constants.SESSION_TOKEN,
result.credentials().sessionToken());
message.setHeader(STS2Constants.EXPIRATION,
result.credentials().expiration());
}
if (ObjectHelper.isNotEmpty(result.assumedRoleUser())) {
@@ -177,9 +176,8 @@ public class STS2Producer extends DefaultProducer {
Message message = getMessageForResponse(exchange);
message.setBody(result);
if (ObjectHelper.isNotEmpty(result.credentials())) {
+ // the secret access key and the session token are only in the
body, not in headers
message.setHeader(STS2Constants.ACCESS_KEY_ID,
result.credentials().accessKeyId());
- message.setHeader(STS2Constants.SECRET_KEY_ID,
result.credentials().secretAccessKey());
- message.setHeader(STS2Constants.SESSION_TOKEN,
result.credentials().sessionToken());
message.setHeader(STS2Constants.EXPIRATION,
result.credentials().expiration());
}
}
@@ -220,9 +218,8 @@ public class STS2Producer extends DefaultProducer {
Message message = getMessageForResponse(exchange);
message.setBody(result);
if (ObjectHelper.isNotEmpty(result.credentials())) {
+ // the secret access key and the session token are only in the
body, not in headers
message.setHeader(STS2Constants.ACCESS_KEY_ID,
result.credentials().accessKeyId());
- message.setHeader(STS2Constants.SECRET_KEY_ID,
result.credentials().secretAccessKey());
- message.setHeader(STS2Constants.SESSION_TOKEN,
result.credentials().sessionToken());
message.setHeader(STS2Constants.EXPIRATION,
result.credentials().expiration());
}
}
diff --git
a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java
b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java
index 2ac6d4247cbf..832f25717772 100644
---
a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java
+++
b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/AmazonSTSClientMock.java
@@ -16,6 +16,8 @@
*/
package org.apache.camel.component.aws2.sts;
+import java.time.Instant;
+
import software.amazon.awssdk.services.sts.StsClient;
import software.amazon.awssdk.services.sts.StsServiceClientConfiguration;
import software.amazon.awssdk.services.sts.model.AssumeRoleRequest;
@@ -29,18 +31,24 @@ import
software.amazon.awssdk.services.sts.model.GetSessionTokenResponse;
public class AmazonSTSClientMock implements StsClient {
+ static final Instant EXPIRATION = Instant.parse("2026-01-01T00:00:00Z");
+
public AmazonSTSClientMock() {
}
@Override
public AssumeRoleResponse assumeRole(AssumeRoleRequest assumeRoleRequest) {
- return
AssumeRoleResponse.builder().assumedRoleUser(AssumedRoleUser.builder().arn("arn").build()).build();
+ return
AssumeRoleResponse.builder().assumedRoleUser(AssumedRoleUser.builder().arn("arn").build())
+
.credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test")
+ .expiration(EXPIRATION).build())
+ .build();
}
@Override
public GetSessionTokenResponse getSessionToken(GetSessionTokenRequest
getSessionTokenRequest) {
return GetSessionTokenResponse.builder()
-
.credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test").build())
+
.credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test")
+ .expiration(EXPIRATION).build())
.build();
}
@@ -52,7 +60,8 @@ public class AmazonSTSClientMock implements StsClient {
@Override
public GetFederationTokenResponse
getFederationToken(GetFederationTokenRequest getFederationTokenRequest) {
return GetFederationTokenResponse.builder()
-
.credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test").build())
+
.credentials(Credentials.builder().accessKeyId("xxx").secretAccessKey("yyy").sessionToken("test")
+ .expiration(EXPIRATION).build())
.build();
}
diff --git
a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java
b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java
index edd458bd86c8..88eb7de7ae4d 100644
---
a/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java
+++
b/components/camel-aws/camel-aws2-sts/src/test/java/org/apache/camel/component/aws2/sts/STS2ProducerTest.java
@@ -28,6 +28,7 @@ import
software.amazon.awssdk.services.sts.model.AssumeRoleResponse;
import software.amazon.awssdk.services.sts.model.GetFederationTokenResponse;
import software.amazon.awssdk.services.sts.model.GetSessionTokenResponse;
+import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;
import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -121,6 +122,60 @@ public class STS2ProducerTest extends CamelTestSupport {
.hasRootCauseMessage("getFederationToken operation requires
GetFederationTokenRequest in POJO mode");
}
+ @Test
+ void assumeRoleDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() {
+ Exchange exchange = template.request("direct:assumeRole", e -> {
+ e.getIn().setHeader(STS2Constants.ROLE_ARN, "arn");
+ e.getIn().setHeader(STS2Constants.ROLE_SESSION_NAME, "sessionarn");
+ });
+
+ assertCredentialHeaders(exchange);
+
assertThat(exchange.getMessage().getHeader(STS2Constants.ASSUMED_ROLE_ARN)).isEqualTo("arn");
+ AssumeRoleResponse body =
exchange.getMessage().getBody(AssumeRoleResponse.class);
+ assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy");
+ assertThat(body.credentials().sessionToken()).isEqualTo("test");
+ }
+
+ @Test
+ void getSessionTokenDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders() {
+ Exchange exchange = template.request("direct:getSessionToken", e -> {
+ });
+
+ assertCredentialHeaders(exchange);
+ GetSessionTokenResponse body =
exchange.getMessage().getBody(GetSessionTokenResponse.class);
+ assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy");
+ assertThat(body.credentials().sessionToken()).isEqualTo("test");
+ }
+
+ @Test
+ void getFederationTokenDoesNotCopyTheSecretKeyAndSessionTokenIntoHeaders()
{
+ Exchange exchange = template.request("direct:getFederationToken",
+ e -> e.getIn().setHeader(STS2Constants.FEDERATED_NAME,
"federation-account"));
+
+ assertCredentialHeaders(exchange);
+ GetFederationTokenResponse body =
exchange.getMessage().getBody(GetFederationTokenResponse.class);
+ assertThat(body.credentials().secretAccessKey()).isEqualTo("yyy");
+ assertThat(body.credentials().sessionToken()).isEqualTo("test");
+ }
+
+ @Test
+ void theSecretKeyAndSessionTokenCanBeTakenFromTheBody() {
+ Exchange exchange =
template.request("direct:assumeRoleCredentialsFromBody", e -> {
+ e.getIn().setHeader(STS2Constants.ROLE_ARN, "arn");
+ e.getIn().setHeader(STS2Constants.ROLE_SESSION_NAME, "sessionarn");
+ });
+
+ assertThat(exchange.getMessage().getBody(String.class)).isEqualTo("yyy
test");
+ }
+
+ private static void assertCredentialHeaders(Exchange exchange) {
+ assertThat(exchange.getException()).isNull();
+ assertThat(exchange.getMessage().getHeaders())
+ .containsEntry(STS2Constants.ACCESS_KEY_ID, "xxx")
+ .containsEntry(STS2Constants.EXPIRATION,
AmazonSTSClientMock.EXPIRATION)
+ .doesNotContainKeys("CamelAwsStsSecretKey",
"CamelAwsStsSessionToken");
+ }
+
@Override
protected RouteBuilder createRouteBuilder() {
return new RouteBuilder() {
@@ -138,6 +193,9 @@ public class STS2ProducerTest extends CamelTestSupport {
.to("aws2-sts://test?stsClient=#amazonStsClient&operation=getSessionToken&pojoRequest=true");
from("direct:getFederationTokenPojo")
.to("aws2-sts://test?stsClient=#amazonStsClient&operation=getFederationToken&pojoRequest=true");
+ from("direct:assumeRoleCredentialsFromBody")
+
.to("aws2-sts://test?stsClient=#amazonStsClient&operation=assumeRole")
+
.setBody(simple("${body.credentials().secretAccessKey()}
${body.credentials().sessionToken()}"));
}
};
}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index fc2bfb3456eb..738d11cc4611 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -1110,6 +1110,16 @@ will be removed in a later release. The image generation
and embedding models do
operations fail for such a model, and with a text model they are the same as
`invokeTextModelStreaming`. Use
`invokeImageModel`, `invokeEmbeddingsModel` or `invokeTextModelStreaming`
instead.
+=== camel-aws2-sts - the secret access key and the session token are no longer
copied into headers
+
+The `assumeRole`, `getSessionToken` and `getFederationToken` operations of
`aws2-sts` no longer set the
+`CamelAwsStsSecretKey` and `CamelAwsStsSessionToken` headers. The body is the
response of the AWS SDK, such as an
+`AssumeRoleResponse`, and its `credentials()` hold them: use
`${body.credentials().secretAccessKey()}` and
+`${body.credentials().sessionToken()}` instead of the headers. The
`CamelAwsStsAccessKeyId`, `CamelAwsStsExpiration` and
+`CamelAwsStsAssumedRoleArn` headers are still set.
+
+The `STS2Constants.SECRET_KEY_ID` and `STS2Constants.SESSION_TOKEN` constants
are deprecated.
+
=== camel-weather - the CamelWeatherLocation header is the location that is
queried
The latitude and longitude of the current geolocation (a location of
`current`, or no location) are no longer written
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java
index c36966db185d..46f8225da822 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/STS2EndpointBuilderFactory.java
@@ -621,7 +621,9 @@ public interface STS2EndpointBuilderFactory {
return "CamelAwsStsAccessKeyId";
}
/**
- * The temporary secret access key.
+ * The temporary secret access key. Deprecation note: The producer no
+ * longer sets this header. Take the secret access key from the body,
+ * such as ${body.credentials().secretAccessKey()}.
*
* The option is a: {@code String} type.
*
@@ -629,11 +631,14 @@ public interface STS2EndpointBuilderFactory {
*
* @return the name of the header {@code AwsStsSecretKey}.
*/
+ @Deprecated
public String awsStsSecretKey() {
return "CamelAwsStsSecretKey";
}
/**
- * The temporary session token.
+ * The temporary session token. Deprecation note: The producer no
longer
+ * sets this header. Take the session token from the body, such as
+ * ${body.credentials().sessionToken()}.
*
* The option is a: {@code String} type.
*
@@ -641,6 +646,7 @@ public interface STS2EndpointBuilderFactory {
*
* @return the name of the header {@code AwsStsSessionToken}.
*/
+ @Deprecated
public String awsStsSessionToken() {
return "CamelAwsStsSessionToken";
}
