More cleanups

alextwoods · alextwoods · commit bc4ac1ea0be0 · 2026-07-07T14:34:58.000-07:00
diff --git a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/AwsCredentialsProviderChain.java b/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/AwsCredentialsProviderChain.java
@@ -132,23 +132,24 @@ public AwsCredentials resolveCredentials() {
     }
 
     @Override
+    @SuppressWarnings("unchecked")
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
-        List<CompletableFuture<Void>> futures = new ArrayList<>();
-        for (IdentityProvider<? extends AwsCredentialsIdentity> provider : credentialsProviders) {
-            try {
-                @SuppressWarnings("unchecked")
-                IdentityProvider<AwsCredentialsIdentity> typedProvider =
-                    (IdentityProvider<AwsCredentialsIdentity>) provider;
-                CompletableFuture<Void> future = typedProvider.invalidate(identity);
-                futures.add(future.exceptionally(e -> {
+        CompletableFuture<?>[] futures = credentialsProviders.stream()
+            .map(provider -> {
+                try {
+                    return ((IdentityProvider<AwsCredentialsIdentity>) provider)
+                        .invalidate(identity)
+                        .exceptionally(e -> {
+                            log.debug(() -> "Failed to invalidate provider " + provider + ": " + e.getMessage(), e);
+                            return null;
+                        });
+                } catch (Exception e) {
                     log.debug(() -> "Failed to invalidate provider " + provider + ": " + e.getMessage(), e);
-                    return null;
-                }));
-            } catch (Exception e) {
-                log.debug(() -> "Failed to invalidate provider " + provider + ": " + e.getMessage(), e);
-            }
-        }
-        return CompletableFuture.allOf(futures.toArray(new CompletableFuture[0]));
+                    return CompletableFuture.<Void>completedFuture(null);
+                }
+            })
+            .toArray(CompletableFuture<?>[]::new);
+        return CompletableFuture.allOf(futures);
     }
 
     @Override
diff --git a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ContainerCredentialsProvider.java b/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ContainerCredentialsProvider.java
@@ -192,7 +192,7 @@ public AwsCredentials resolveCredentials() {
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
         return CredentialsInvalidationUtils.invalidateCredentialsCache(
-            identity, credentialsCache, cachedCreds -> (AwsCredentialsIdentity) cachedCreds);
+            identity, credentialsCache, AwsCredentialsIdentity::accessKeyId);
     }
 
     @Override
diff --git a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/InstanceProfileCredentialsProvider.java b/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/InstanceProfileCredentialsProvider.java
@@ -173,7 +173,7 @@ public AwsCredentials resolveCredentials() {
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
         return CredentialsInvalidationUtils.invalidateCredentialsCache(
-            identity, credentialsCache, cachedCreds -> (AwsCredentialsIdentity) cachedCreds);
+            identity, credentialsCache, AwsCredentialsIdentity::accessKeyId);
     }
 
     private RefreshResult<AwsCredentials> refreshCredentials() {
diff --git a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ProcessCredentialsProvider.java b/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ProcessCredentialsProvider.java
@@ -172,7 +172,7 @@ public AwsCredentials resolveCredentials() {
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
         return CredentialsInvalidationUtils.invalidateCredentialsCache(
-            identity, processCredentialCache, cachedCreds -> (AwsCredentialsIdentity) cachedCreds);
+            identity, processCredentialCache, AwsCredentialsIdentity::accessKeyId);
     }
 
     private RefreshResult<AwsCredentials> refreshCredentials() {
diff --git a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ProfileCredentialsProvider.java b/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ProfileCredentialsProvider.java
@@ -162,6 +162,7 @@ public void close() {
 
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
+        // Local copy to avoid TOCTOU race on the volatile field during concurrent profile reloads.
         AwsCredentialsProvider provider = credentialsProvider;
         if (provider != null) {
             return provider.invalidate(identity);
diff --git a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/WebIdentityTokenFileCredentialsProvider.java b/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/WebIdentityTokenFileCredentialsProvider.java
@@ -27,7 +27,6 @@
 import software.amazon.awssdk.core.SdkSystemSetting;
 import software.amazon.awssdk.core.useragent.BusinessMetricFeatureId;
 import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
-import software.amazon.awssdk.identity.spi.IdentityProvider;
 import software.amazon.awssdk.utils.IoUtils;
 import software.amazon.awssdk.utils.SdkAutoCloseable;
 import software.amazon.awssdk.utils.ToString;
@@ -168,11 +167,8 @@ public void close() {
 
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
-        if (credentialsProvider instanceof IdentityProvider) {
-            @SuppressWarnings("unchecked")
-            IdentityProvider<AwsCredentialsIdentity> provider =
-                (IdentityProvider<AwsCredentialsIdentity>) credentialsProvider;
-            return provider.invalidate(identity);
+        if (credentialsProvider != null) {
+            return credentialsProvider.invalidate(identity);
         }
         return CompletableFuture.completedFuture(null);
     }
diff --git a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/internal/CredentialsInvalidationUtils.java b/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/internal/CredentialsInvalidationUtils.java
@@ -35,38 +35,34 @@ private CredentialsInvalidationUtils() {
     }
 
     /**
-     * Invalidates the given cache if the rejected identity's access key ID matches the cached credential's access key ID.
+     * Invalidates the given cache if the rejected identity's access key ID matches the access key ID of the cached value.
      *
      * <p>This method encapsulates the common pattern used by caching credential providers:
      * <ol>
      *   <li>Extract the rejected access key ID from the identity</li>
-     *   <li>Compare it against the currently cached credentials</li>
+     *   <li>Use the {@code accessKeyIdExtractor} to get the access key ID from the currently cached value</li>
      *   <li>If they match, mark the cache for mandatory refresh</li>
      * </ol>
      *
+     * <p>For providers whose cache directly stores {@link AwsCredentialsIdentity} (or a subtype), pass
+     * {@code AwsCredentialsIdentity::accessKeyId} as the extractor. For providers that cache a wrapper type,
+     * provide an appropriate extraction function (e.g., {@code holder -> holder.sessionCredentials().accessKeyId()}).
+     *
      * @param identity The identity that was rejected by the service.
      * @param cache The cached supplier to invalidate.
-     * @param credentialsExtractor A function that extracts the {@link AwsCredentialsIdentity} from the cached value type.
-     *                             For providers that cache {@code AwsCredentials} directly, use {@code Function.identity()}.
-     *                             For providers that cache a holder object, provide the appropriate extraction function.
+     * @param accessKeyIdExtractor A function that extracts the access key ID from the cached value.
      * @param <T> The type of value stored in the cache.
      * @return A {@link CompletableFuture} that completes when the invalidation check is done, or completes exceptionally
      *         if an error occurs during the invalidation.
      */
     public static <T> CompletableFuture<Void> invalidateCredentialsCache(
             AwsCredentialsIdentity identity,
             CachedSupplier<T> cache,
-            Function<T, AwsCredentialsIdentity> credentialsExtractor) {
+            Function<T, String> accessKeyIdExtractor) {
 
         try {
             String rejectedAccessKeyId = identity.accessKeyId();
-            cache.invalidate(cachedValue -> {
-                AwsCredentialsIdentity cachedIdentity = credentialsExtractor.apply(cachedValue);
-                if (cachedIdentity == null) {
-                    return false;
-                }
-                return rejectedAccessKeyId.equals(cachedIdentity.accessKeyId());
-            });
+            cache.invalidate(cachedValue -> rejectedAccessKeyId.equals(accessKeyIdExtractor.apply(cachedValue)));
             return CompletableFuture.completedFuture(null);
         } catch (Exception e) {
             return CompletableFutureUtils.failedFuture(e);
diff --git a/core/auth/src/test/java/software/amazon/awssdk/auth/credentials/IdentityProviderInvalidateTest.java b/core/auth/src/test/java/software/amazon/awssdk/auth/credentials/IdentityProviderInvalidateTest.java
@@ -66,13 +66,12 @@ class IdentityProviderInvalidateTest {
     @BeforeEach
     void setup() {
         environmentVariableHelper.reset();
-        System.setProperty(SdkSystemSetting.AWS_EC2_METADATA_SERVICE_ENDPOINT.property(),
-                           "http://localhost:" + wireMockServer.getPort());
+        environmentVariableHelper.set(SdkSystemSetting.AWS_EC2_METADATA_SERVICE_ENDPOINT,
+                                      "http://localhost:" + wireMockServer.getPort());
     }
 
     @AfterAll
     static void teardown() {
-        System.clearProperty(SdkSystemSetting.AWS_EC2_METADATA_SERVICE_ENDPOINT.property());
         environmentVariableHelper.reset();
     }
 
diff --git a/core/aws-core/src/main/java/software/amazon/awssdk/awscore/exception/AwsServiceException.java b/core/aws-core/src/main/java/software/amazon/awssdk/awscore/exception/AwsServiceException.java
@@ -134,6 +134,19 @@ public boolean isThrottlingException() {
                        .orElse(false);
     }
 
+    /**
+     * Checks if the exception indicates an authentication error where the credentials were rejected,
+     * based on the AWS error code (e.g., {@code ExpiredToken}, {@code InvalidToken}, {@code AuthFailure}).
+     *
+     * @return true if the AWS error code indicates an authentication error, otherwise false.
+     */
+    @Override
+    public boolean isAuthenticationError() {
+        return Optional.ofNullable(awsErrorDetails)
+                       .map(a -> AwsErrorCode.isAuthenticationErrorCode(a.errorCode()))
+                       .orElse(false);
+    }
+
     /**
      * @return {@link Builder} instance to construct a new {@link AwsServiceException}.
      */
diff --git a/core/aws-core/src/main/java/software/amazon/awssdk/awscore/internal/AwsErrorCode.java b/core/aws-core/src/main/java/software/amazon/awssdk/awscore/internal/AwsErrorCode.java
@@ -31,6 +31,7 @@ public final class AwsErrorCode {
     public static final Set<String> THROTTLING_ERROR_CODES;
     public static final Set<String> DEFINITE_CLOCK_SKEW_ERROR_CODES;
     public static final Set<String> POSSIBLE_CLOCK_SKEW_ERROR_CODES;
+    public static final Set<String> AUTH_ERROR_CODES;
 
     static {
         Set<String> throttlingErrorCodes = new HashSet<>(9);
@@ -66,6 +67,12 @@ public final class AwsErrorCode {
         retryableErrorCodes.add("RequestTimeoutException");
         retryableErrorCodes.add("InternalError");
         RETRYABLE_ERROR_CODES = unmodifiableSet(retryableErrorCodes);
+
+        Set<String> authErrorCodes = new HashSet<>(3);
+        authErrorCodes.add("ExpiredToken");
+        authErrorCodes.add("InvalidToken");
+        authErrorCodes.add("AuthFailure");
+        AUTH_ERROR_CODES = unmodifiableSet(authErrorCodes);
     }
 
     private AwsErrorCode() {
@@ -86,4 +93,8 @@ public static boolean isPossibleClockSkewErrorCode(String errorCode) {
     public static boolean isRetryableErrorCode(String errorCode) {
         return RETRYABLE_ERROR_CODES.contains(errorCode);
     }
+
+    public static boolean isAuthenticationErrorCode(String errorCode) {
+        return AUTH_ERROR_CODES.contains(errorCode);
+    }
 }
diff --git a/core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/IdentityProvider.java b/core/identity-spi/src/main/java/software/amazon/awssdk/identity/spi/IdentityProvider.java
@@ -166,8 +166,7 @@ default CompletableFuture<? extends IdentityT> resolveIdentity() {
      * The next call to {@link #resolveIdentity} will attempt to fetch fresh credentials.</p>
      *
      * <p>Implementations MUST only invalidate if the currently-cached identity matches
-     * the rejected identity (e.g., same access key ID). Implementations MUST NOT discard
-     * cached credentials entirely, and MUST NOT clear or bypass any refresh backoff.</p>
+     * the rejected identity (e.g., same access key ID).</p>
      *
      * <p>The default implementation is a no-op, suitable for providers that do not cache.</p>
      *
diff --git a/core/sdk-core/src/main/java/software/amazon/awssdk/core/exception/SdkServiceException.java b/core/sdk-core/src/main/java/software/amazon/awssdk/core/exception/SdkServiceException.java
@@ -102,6 +102,20 @@ public boolean isRetryableException() {
         return false;
     }
 
+    /**
+     * Specifies whether an exception indicates an authentication or authorization error where the credentials
+     * used for the request were rejected by the service. Subclasses can override this to check service-specific
+     * error codes (e.g., {@code ExpiredToken}, {@code InvalidToken}, {@code AuthFailure}).
+     *
+     * <p>When this returns {@code true}, the SDK may invalidate cached credentials so that the next attempt
+     * resolves fresh ones.</p>
+     *
+     * @return true if the exception is classified as an authentication error, otherwise false.
+     */
+    public boolean isAuthenticationError() {
+        return false;
+    }
+
     /**
      * @return {@link Builder} instance to construct a new {@link SdkServiceException}.
      */
diff --git a/core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/pipeline/stages/utils/AuthErrorInvalidationHelper.java b/core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/pipeline/stages/utils/AuthErrorInvalidationHelper.java
@@ -15,9 +15,6 @@
 
 package software.amazon.awssdk.core.internal.http.pipeline.stages.utils;
 
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
 import software.amazon.awssdk.annotations.SdkInternalApi;
 import software.amazon.awssdk.core.SelectedAuthScheme;
 import software.amazon.awssdk.core.exception.SdkServiceException;
@@ -32,8 +29,9 @@
  * Utility that detects authentication error responses and triggers credential invalidation
  * on the identity provider that produced the rejected credentials.
  *
- * <p>When a service returns {@code ExpiredToken}, {@code InvalidToken}, or {@code AuthFailure},
- * this helper retrieves the {@link SelectedAuthScheme} from the execution context and calls
+ * <p>When a service returns an authentication error (as determined by
+ * {@link SdkServiceException#isAuthenticationError()}), this helper retrieves the
+ * {@link SelectedAuthScheme} from the execution context and calls
  * {@link IdentityProvider#invalidate} so the next retry attempt resolves fresh credentials.</p>
  *
  * <p>All exceptions from the invalidation path are caught and logged at debug level.
@@ -44,12 +42,6 @@ public final class AuthErrorInvalidationHelper {
 
     private static final Logger LOG = Logger.loggerFor(AuthErrorInvalidationHelper.class);
 
-    private static final Set<String> INVALIDATION_ERROR_CODES = new HashSet<>(Arrays.asList(
-        "ExpiredToken",
-        "InvalidToken",
-        "AuthFailure"
-    ));
-
     private AuthErrorInvalidationHelper() {
     }
 
@@ -67,9 +59,7 @@ public static void invalidateIfAuthError(Throwable exception, RequestExecutionCo
         }
 
         SdkServiceException serviceException = (SdkServiceException) exception;
-        String errorCode = extractErrorCode(serviceException);
-
-        if (errorCode == null || !INVALIDATION_ERROR_CODES.contains(errorCode)) {
+        if (!serviceException.isAuthenticationError()) {
             return;
         }
 
@@ -87,31 +77,6 @@ public static void invalidateIfAuthError(Throwable exception, RequestExecutionCo
         }
     }
 
-    /**
-     * Extracts the error code from an SdkServiceException. Since sdk-core does not depend on
-     * aws-core, this uses reflection to access awsErrorDetails().errorCode() which is defined
-     * on AwsServiceException.
-     */
-    private static String extractErrorCode(SdkServiceException serviceException) {
-        try {
-            java.lang.reflect.Method awsErrorDetailsMethod =
-                serviceException.getClass().getMethod("awsErrorDetails");
-            Object errorDetails = awsErrorDetailsMethod.invoke(serviceException);
-            if (errorDetails == null) {
-                return null;
-            }
-            java.lang.reflect.Method errorCodeMethod = errorDetails.getClass().getMethod("errorCode");
-            Object errorCode = errorCodeMethod.invoke(errorDetails);
-            return errorCode instanceof String ? (String) errorCode : null;
-        } catch (NoSuchMethodException e) {
-            // Exception type does not have awsErrorDetails() — not an AWS service exception
-            return null;
-        } catch (Exception e) {
-            LOG.debug(() -> "Failed to extract error code from exception: " + e.getMessage(), e);
-            return null;
-        }
-    }
-
     @SuppressWarnings("unchecked")
     private static <T extends Identity> void doInvalidate(SelectedAuthScheme<T> selectedAuthScheme) {
         T resolvedIdentity = CompletableFutureUtils.joinLikeSync(selectedAuthScheme.identity());
diff --git a/core/sdk-core/src/test/java/software/amazon/awssdk/core/internal/http/pipeline/stages/utils/AuthErrorInvalidationHelperTest.java b/core/sdk-core/src/test/java/software/amazon/awssdk/core/internal/http/pipeline/stages/utils/AuthErrorInvalidationHelperTest.java
@@ -20,6 +20,9 @@
 import static org.mockito.Mockito.mock;
 
 import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
@@ -211,9 +214,8 @@ private RequestExecutionContext contextWithNoAuthScheme() {
     }
 
     /**
-     * Creates an SdkServiceException subclass with an {@code awsErrorDetails()} method that returns
-     * an object with an {@code errorCode()} method. This works with the reflection-based approach
-     * in AuthErrorInvalidationHelper.
+     * Creates an SdkServiceException subclass that overrides {@code isAuthenticationError()} to
+     * return true for the known auth error codes.
      */
     private Throwable serviceExceptionWithErrorCode(String errorCode) {
         return new TestAwsServiceException(errorCode);
@@ -286,36 +288,24 @@ public CompletableFuture<Void> invalidate(TestIdentity identity) {
     }
 
     /**
-     * Simulates an AwsServiceException accessible via reflection. The AuthErrorInvalidationHelper
-     * uses reflection to call awsErrorDetails().errorCode() since sdk-core doesn't depend on aws-core.
-     * Any class with these methods will work via reflection.
+     * Simulates an AwsServiceException that reports authentication errors via the
+     * {@link SdkServiceException#isAuthenticationError()} virtual method.
      */
     private static class TestAwsServiceException extends SdkServiceException {
-        private final TestAwsErrorDetails awsErrorDetails;
+        private static final Set<String> AUTH_ERROR_CODES = new HashSet<>(Arrays.asList(
+            "ExpiredToken", "InvalidToken", "AuthFailure"
+        ));
 
-        TestAwsServiceException(String errorCode) {
-            super(SdkServiceException.builder().message("test exception").statusCode(401));
-            this.awsErrorDetails = new TestAwsErrorDetails(errorCode);
-        }
-
-        public TestAwsErrorDetails awsErrorDetails() {
-            return awsErrorDetails;
-        }
-    }
-
-    /**
-     * Simulates AwsErrorDetails. The reflection in AuthErrorInvalidationHelper calls
-     * awsErrorDetails().errorCode(), so this class just needs an errorCode() method.
-     */
-    private static class TestAwsErrorDetails {
         private final String errorCode;
 
-        TestAwsErrorDetails(String errorCode) {
+        TestAwsServiceException(String errorCode) {
+            super(SdkServiceException.builder().message("test exception").statusCode(401));
             this.errorCode = errorCode;
         }
 
-        public String errorCode() {
-            return errorCode;
+        @Override
+        public boolean isAuthenticationError() {
+            return AUTH_ERROR_CODES.contains(errorCode);
         }
     }
 }
diff --git a/services/sso/src/main/java/software/amazon/awssdk/services/sso/auth/SsoCredentialsProvider.java b/services/sso/src/main/java/software/amazon/awssdk/services/sso/auth/SsoCredentialsProvider.java
@@ -174,7 +174,7 @@ public AwsCredentials resolveCredentials() {
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
         return CredentialsInvalidationUtils.invalidateCredentialsCache(
-            identity, credentialCache, holder -> holder.sessionCredentials());
+            identity, credentialCache, holder -> holder.sessionCredentials().accessKeyId());
     }
 
     @Override
diff --git a/services/sts/src/main/java/software/amazon/awssdk/services/sts/auth/StsCredentialsProvider.java b/services/sts/src/main/java/software/amazon/awssdk/services/sts/auth/StsCredentialsProvider.java

Original file line number	Diff line number	Diff line change
`@@ -192,7 +192,7 @@ public AwsCredentials resolveCredentials() {`
`192`	`192`	`@Override`
`193`	`193`	`public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {`
`194`	`194`	`return CredentialsInvalidationUtils.invalidateCredentialsCache(`
`195`		`- identity, credentialsCache, cachedCreds -> (AwsCredentialsIdentity) cachedCreds);`
	`195`	`+ identity, credentialsCache, AwsCredentialsIdentity::accessKeyId);`
`196`	`196`	`}`
`197`	`197`
`198`	`198`	`@Override`
Original file line number	Diff line number	Diff line change
`@@ -173,7 +173,7 @@ public AwsCredentials resolveCredentials() {`
`173`	`173`	`@Override`
`174`	`174`	`public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {`
`175`	`175`	`return CredentialsInvalidationUtils.invalidateCredentialsCache(`
`176`		`- identity, credentialsCache, cachedCreds -> (AwsCredentialsIdentity) cachedCreds);`
	`176`	`+ identity, credentialsCache, AwsCredentialsIdentity::accessKeyId);`
`177`	`177`	`}`
`178`	`178`
`179`	`179`	`private RefreshResult<AwsCredentials> refreshCredentials() {`
Original file line number	Diff line number	Diff line change
`@@ -172,7 +172,7 @@ public AwsCredentials resolveCredentials() {`
`172`	`172`	`@Override`
`173`	`173`	`public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {`
`174`	`174`	`return CredentialsInvalidationUtils.invalidateCredentialsCache(`
`175`		`- identity, processCredentialCache, cachedCreds -> (AwsCredentialsIdentity) cachedCreds);`
	`175`	`+ identity, processCredentialCache, AwsCredentialsIdentity::accessKeyId);`
`176`	`176`	`}`
`177`	`177`
`178`	`178`	`private RefreshResult<AwsCredentials> refreshCredentials() {`
Original file line number	Diff line number	Diff line change
`@@ -66,13 +66,12 @@ class IdentityProviderInvalidateTest {`
`66`	`66`	`@BeforeEach`
`67`	`67`	`void setup() {`
`68`	`68`	`environmentVariableHelper.reset();`
`69`		`- System.setProperty(SdkSystemSetting.AWS_EC2_METADATA_SERVICE_ENDPOINT.property(),`
`70`		`- "http://localhost:" + wireMockServer.getPort());`
	`69`	`+ environmentVariableHelper.set(SdkSystemSetting.AWS_EC2_METADATA_SERVICE_ENDPOINT,`
	`70`	`+ "http://localhost:" + wireMockServer.getPort());`
`71`	`71`	`}`
`72`	`72`
`73`	`73`	`@AfterAll`
`74`	`74`	`static void teardown() {`
`75`		`- System.clearProperty(SdkSystemSetting.AWS_EC2_METADATA_SERVICE_ENDPOINT.property());`
`76`	`75`	`environmentVariableHelper.reset();`
`77`	`76`	`}`
`78`	`77`