Method _get_credentials

awscli/botocore/credentials.py:2302–2346

Get credentials by calling SSO get role credentials.

(self)

        return timestamp.strftime(self._UTC_DATE_FORMAT)

    def _get_credentials(self):
        """Get credentials by calling SSO get role credentials."""
        config = Config(
            signature_version=UNSIGNED,
            region_name=self._sso_region,
        )
        client = self._client_creator('sso', config=config)
        if self._token_provider:
            initial_token_data = self._token_provider.load_token()
            token = initial_token_data.get_frozen_token().token
        else:
            token_dict = self._token_loader(self._start_url)
            token = token_dict['accessToken']

            # raise an UnauthorizedSSOTokenError if the loaded legacy token
            # is expired to save a call to GetRoleCredentials with an
            # expired token.
            expiration = dateutil.parser.parse(token_dict['expiresAt'])
            remaining = total_seconds(expiration - self._time_fetcher())
            if remaining <= 0:
                raise UnauthorizedSSOTokenError()

        kwargs = {
            'roleName': self._role_name,
            'accountId': self._account_id,
            'accessToken': token,
        }
        try:
            register_feature_ids(self.feature_ids)
            response = client.get_role_credentials(**kwargs)
        except client.exceptions.UnauthorizedException:
            raise UnauthorizedSSOTokenError()
        credentials = response['roleCredentials']

        credentials = {
            'ProviderType': 'sso',
            'Credentials': {
                'AccessKeyId': credentials['accessKeyId'],
                'SecretAccessKey': credentials['secretAccessKey'],
                'SessionToken': credentials['sessionToken'],
                'Expiration': self._parse_timestamp(credentials['expiration']),
                'AccountId': self._account_id,
            },
        }
        return credentials


class SSOProvider(CredentialProvider):