Enable assume role with web identity using config.WithWebIdentityRoleCredentialOptions

.changelog/ade6f215447f4db38352c773474788a4.json

@@ -0,0 +1,8 @@
+{
+    "id": "ade6f215-447f-4db3-8352-c773474788a4",
+    "type": "bugfix",
+    "description": "Insert LoadOptions into cred chain switch to enable directly loading web identity role",
+    "modules": [
+        "config"
+    ]
+}

config/resolve_credentials.go

@@ -110,7 +110,11 @@ func resolveCredentialChain(ctx context.Context, cfg *aws.Config, configs config
 		return err
 	}
 
+	loadOptions := getLoadOptions(other)
+
 	switch {
+	case loadOptions.WebIdentityRoleCredentialOptions != nil:
+		err = assumeWebIdentity(ctx, cfg, "WebIdTokenFilePathPlaceHolder", "RoleARNFPlaceHolder", "RoleSessionNamePlaceHolder", configs)
 	case sharedProfileSet:
 		err = resolveCredsFromProfile(ctx, cfg, envConfig, sharedConfig, other)
 	case envConfig.Credentials.HasKeys():
@@ -182,6 +186,26 @@ func resolveCredsFromProfile(ctx context.Context, cfg *aws.Config, envConfig *En
 	return nil
 }
 
+func getLoadOptions(cfgs configs) (loadOptions *LoadOptions) {
+	for _, cfg := range cfgs {
+		switch c := cfg.(type) {
+		case LoadOptions:
+			if loadOptions == nil {
+				loadOptions = &c
+			}
+		case *LoadOptions:
+			if loadOptions == nil {
+				loadOptions = c
+			}
+		default:
+		}
+	}
+	if loadOptions == nil {
+		loadOptions = &LoadOptions{}
+	}
+	return
+}
+
 func resolveSSOCredentials(ctx context.Context, cfg *aws.Config, sharedConfig *SharedConfig, configs configs) error {
 	if err := sharedConfig.validateSSOConfiguration(); err != nil {
 		return err

config/resolve_web_identity_test.go

@@ -2,7 +2,9 @@ package config
 
 import (
 	"context"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
+	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
 	"github.com/aws/aws-sdk-go-v2/internal/awstesting"
 	"os"
 	"path/filepath"
@@ -56,4 +58,30 @@ func TestResolveWebIdentityWithOptions(t *testing.T) {
 			t.Fatalf("expected profile parsing error, got %v", err)
 		}
 	})
+
+	t.Run("token supplied directly from loadOptions", func(t *testing.T) {
+		restoreEnv := initConfigTestEnv()
+		defer awstesting.PopEnv(restoreEnv)
+
+		var tokenFile = filepath.Join("testdata", "wit.txt")
+		os.Setenv("AWS_REGION", "us-east-1")
+
+		config, err := LoadDefaultConfig(context.Background(),
+			WithEC2IMDSClientEnableState(imds.ClientDisabled),
+			WithWebIdentityRoleCredentialOptions(func(options *stscreds.WebIdentityRoleOptions) {
+				options.TokenRetriever = stscreds.IdentityTokenFile(tokenFile)
+				options.RoleARN = "test-arn"
+				options.RoleSessionName = "test-session"
+			}),
+		)
+
+		if err != nil {
+			t.Fatalf("expect no error, got %v", err)
+		}
+
+		target := stscreds.WebIdentityRoleProvider{}
+		if !aws.IsCredentialsProvider(config.Credentials, &target) {
+			t.Fatalf("expected type %T", target)
+		}
+	})
 }