Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix to refresh sts token at 80% of TTL for issue #2031 #2035

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

fix to refresh sts token at 80% of TTL for issue #2031 #2035

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fd0377a
fix in _handle_sts_session to refresh sts token at 80% of TTL for iss…
chenxghub Jun 23, 2024
59a7ea4
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Jun 23, 2024
5974800
Update SQS.py
chenxg283 Jun 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions kombu/transport/SQS.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@
import socket
import string
import uuid
from datetime import datetime
from datetime import datetime, timedelta, timezone
from queue import Empty

from botocore.client import Config
Expand Down Expand Up @@ -734,23 +734,23 @@ def sqs(self, queue=None):
return c

def _handle_sts_session(self, queue, q):
if not hasattr(self, 'sts_expiration'): # STS token - token init
datetime_now_utc = datetime.now(timezone.utc).replace(
tzinfo=None
)
sts_token_timeout = self.transport_options.get(
'sts_token_timeout', 900
)
# STS token is generated only if it is not present or
# the time reaches 80% of the token TTL
if (not hasattr(self, 'sts_expiration')) or (
self.sts_expiration.replace(tzinfo=None)
- timedelta(seconds=int(sts_token_timeout * 0.2))
< datetime_now_utc
):
sts_creds = self.generate_sts_session_token(
self.transport_options.get('sts_role_arn'),
self.transport_options.get('sts_token_timeout', 900))
self.sts_expiration = sts_creds['Expiration']
c = self._predefined_queue_clients[queue] = self.new_sqs_client(
region=q.get('region', self.region),
access_key_id=sts_creds['AccessKeyId'],
secret_access_key=sts_creds['SecretAccessKey'],
session_token=sts_creds['SessionToken'],
sts_token_timeout,
)
return c
# STS token - refresh if expired
elif self.sts_expiration.replace(tzinfo=None) < datetime.utcnow():
sts_creds = self.generate_sts_session_token(
self.transport_options.get('sts_role_arn'),
self.transport_options.get('sts_token_timeout', 900))
self.sts_expiration = sts_creds['Expiration']
c = self._predefined_queue_clients[queue] = self.new_sqs_client(
region=q.get('region', self.region),
Expand All @@ -759,7 +759,7 @@ def _handle_sts_session(self, queue, q):
session_token=sts_creds['SessionToken'],
)
return c
else: # STS token - ruse existing
else: # STS token still valid - reuse existing
return self._predefined_queue_clients[queue]

def generate_sts_session_token(self, role_arn, token_expiry_seconds):
Expand Down