Skip to main content
← Back to list
01Issue
FeatureShippedExtensionsPublic
Assigneesstack72

Relationships

#1804 AWS credential handling is duplicated across five implementations — the #803 preflight and the #226/#228 SSO hints reached only one of them

Opened by keeb · 8/24/2026· Shipped 8/25/2026

Audit of swamp-club-extensions on 2026-08-24, following triage of #1248.

Finding

No AWS-touching package configures a credential provider. Every one constructs a bare SDK client and inherits @aws-sdk/credential-provider-node from its bundled @aws-sdk/client-* (all pinned 3.1090.0). A repo-wide grep for credential-providers, fromNodeProviderChain, fromSSO, fromIni, defaultProvider and AWS_SDK_LOAD_CONFIG returns zero hits.

That part is fine: SSO resolves everywhere by inheritance. What is not fine is that everything built on top of credential resolution was hand-copied, and reached only some packages.

s3-datastore has all three: the #803 preflight (s3_client.ts:614, with a 3s cap at :74), the off-EC2 IMDS skip (:347-353), and the SSO-expiry error hint (:152-219).

aws-sm vault has only the error hint (aws_sm_errors.ts:83-155), and it is a hand copy of the s3 one rather than a shared module. No preflight, no IMDS skip.

The 289 @swamp/aws/ packages* have none of the three.

So one expired SSO token produces three different behaviours: the datastore fails in about 3s naming the profile to re-login, the vault stalls on IMDS and then explains itself, and an EC2 model stalls and surfaces a raw SDK error.

#226 and #228 are the same fix shipped twice by hand. There was never a third copy for the generated family, and no mechanism that would have produced one.

Scope of a fix

Five independent hand-written implementations, plus one generated family:

  • datastore/s3/extensions/datastores/_lib/s3_client.ts
  • vault/aws-sm/extensions/vaults/aws_sm.ts and aws_sm_errors.ts
  • codegen/aws/enrichments/cfn-stackset, bedrock-knowledgebase and rds-dbcluster, each with its own createClient
  • workflows/s3-bootstrap/extensions/models/_lib/provisioner_impl.ts
  • model/aws/<289 packages>/extensions/models/_lib/aws.ts, regenerable from codegen/aws/libGenerator.ts via deno task generate:aws

Proposal: extract preflight, IMDS skip and error classification into one module that the hand-written implementations import and the codegen template emits, so the next fix in this class lands once instead of five times.

The generated family has already drifted

md5sum over model/aws/*/extensions/models/_lib/aws.ts gives 289 copies in 2 variants: 280 on one hash, and 9 stale ones —

artifact, backupsearch, cognitosync, controlcatalog, partnercentral, savingsplans, states, thinclient, usernotifications

Regeneration is not reaching all of them. Worth fixing in the same pass, because the extraction above depends on regeneration being complete.

Also worth carrying

The generated family hand-parses ~/.aws/config for region only (model/aws/*/extensions/models/_lib/aws.ts:53-56, from codegen/aws/libGenerator.ts:42-45). That parser does not read sso-session blocks and does not follow source_profile, so an SSO profile with no explicit region setting silently gets us-east-1.

Documentation for all of this is tracked in #1248.

Upstream repository: https://github.com/systeminit/swamp-extensions

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 1 MOREASSIGNED+ 5 MOREREVIEW+ 4 MOREPR_MERGED+ 2 MORESESSION_SUMMARIZED

Shipped

8/25/2026, 12:35:58 AM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack728/24/2026, 9:24:25 PM

Sign in to post a ripple.