feat: write cached auth files with 600 POSIX perms (#1877)

* feat: write cached auth files with `600` POSIX perms

* fix changelog message emoji (☝️ very important!!!)

* improve changelog message

* bump smithy-kotlin version

* retrigger CI

* update opt-out setting name

* update option names, remove profile config key

* api dump

* lint

Author: ianbotsf

.changes/dda6fb55-d53c-48d6-8aa8-11ec3a7d8732.json

@@ -0,0 +1,5 @@
+{
+    "id": "dda6fb55-d53c-48d6-8aa8-11ec3a7d8732",
+    "type": "feature",
+    "description": "⚠️ **IMPORTANT**: Write cached auth files for SSO and AWS Login credentials providers with `600` permissions on POSIX OSes"
+}

aws-runtime/aws-config/api/aws-config.api

@@ -141,6 +141,15 @@ public final class aws/sdk/kotlin/runtime/auth/credentials/ProviderConfiguration
 	public synthetic fun <init> (Ljava/lang/String;Ljava/lang/Throwable;ILkotlin/jvm/internal/DefaultConstructorMarker;)V
 }
 
+public final class aws/sdk/kotlin/runtime/auth/credentials/RestrictFilePermissions : java/lang/Enum {
+	public static final field UNRESTRICTED Laws/sdk/kotlin/runtime/auth/credentials/RestrictFilePermissions;
+	public static final field USER_READ_WRITE Laws/sdk/kotlin/runtime/auth/credentials/RestrictFilePermissions;
+	public static fun getEntries ()Lkotlin/enums/EnumEntries;
+	public final fun getPosixOctal ()Ljava/lang/String;
+	public static fun valueOf (Ljava/lang/String;)Laws/sdk/kotlin/runtime/auth/credentials/RestrictFilePermissions;
+	public static fun values ()[Laws/sdk/kotlin/runtime/auth/credentials/RestrictFilePermissions;
+}
+
 public final class aws/sdk/kotlin/runtime/auth/credentials/SsoCredentialsProvider : aws/smithy/kotlin/runtime/auth/awscredentials/CredentialsProvider {
 	public fun <init> (Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Laws/smithy/kotlin/runtime/http/engine/HttpClientEngine;Laws/smithy/kotlin/runtime/util/PlatformProvider;Laws/smithy/kotlin/runtime/time/Clock;)V
 	public synthetic fun <init> (Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Laws/smithy/kotlin/runtime/http/engine/HttpClientEngine;Laws/smithy/kotlin/runtime/util/PlatformProvider;Laws/smithy/kotlin/runtime/time/Clock;ILkotlin/jvm/internal/DefaultConstructorMarker;)V
@@ -315,6 +324,7 @@ public final class aws/sdk/kotlin/runtime/config/AwsSdkSetting {
 	public final fun getAwsRequestChecksumCalculation ()Laws/smithy/kotlin/runtime/config/EnvironmentSetting;
 	public final fun getAwsRequestMinCompressionSizeBytes ()Laws/smithy/kotlin/runtime/config/EnvironmentSetting;
 	public final fun getAwsResponseChecksumValidation ()Laws/smithy/kotlin/runtime/config/EnvironmentSetting;
+	public final fun getAwsRestrictFilePermissions ()Laws/smithy/kotlin/runtime/config/EnvironmentSetting;
 	public final fun getAwsRetryMode ()Laws/smithy/kotlin/runtime/config/EnvironmentSetting;
 	public final fun getAwsRoleArn ()Laws/smithy/kotlin/runtime/config/EnvironmentSetting;
 	public final fun getAwsRoleSessionName ()Laws/smithy/kotlin/runtime/config/EnvironmentSetting;

aws-runtime/aws-config/common/src/aws/sdk/kotlin/runtime/auth/credentials/LoginTokenProvider.kt

@@ -12,11 +12,13 @@ import aws.sdk.kotlin.runtime.auth.credentials.internal.signin.createOAuth2Token
 import aws.sdk.kotlin.runtime.auth.credentials.internal.signin.model.AccessDeniedException
 import aws.sdk.kotlin.runtime.auth.credentials.internal.signin.model.OAuth2ErrorCode
 import aws.sdk.kotlin.runtime.auth.credentials.internal.signin.withConfig
+import aws.sdk.kotlin.runtime.config.AwsSdkSetting
 import aws.sdk.kotlin.runtime.config.profile.normalizePath
 import aws.smithy.kotlin.runtime.auth.awscredentials.Credentials
 import aws.smithy.kotlin.runtime.auth.awscredentials.CredentialsProvider
 import aws.smithy.kotlin.runtime.client.ProtocolRequestInterceptorContext
 import aws.smithy.kotlin.runtime.collections.Attributes
+import aws.smithy.kotlin.runtime.config.resolve
 import aws.smithy.kotlin.runtime.hashing.ecdsaSecp256r1Rs
 import aws.smithy.kotlin.runtime.hashing.sha256
 import aws.smithy.kotlin.runtime.http.engine.HttpClientEngine
@@ -39,6 +41,7 @@ import aws.smithy.kotlin.runtime.time.TimestampFormat
 import aws.smithy.kotlin.runtime.util.PlatformProvider
 import aws.smithy.kotlin.runtime.util.SingleFlightGroup
 import aws.smithy.kotlin.runtime.util.Uuid
+import aws.smithy.kotlin.runtime.util.WriteType
 import kotlin.coroutines.coroutineContext
 import kotlin.io.encoding.Base64
 import kotlin.io.encoding.Base64.Default.UrlSafe
@@ -99,6 +102,9 @@ internal class LoginTokenProvider(
     // debounce concurrent requests for a token
     private val sfg = SingleFlightGroup<LoginToken>()
 
+    private val tokenFilePermissions = AwsSdkSetting.AwsRestrictFilePermissions.resolve(platformProvider)
+        ?: RestrictFilePermissions.USER_READ_WRITE
+
     override suspend fun resolve(attributes: Attributes): Credentials {
         val token = sfg.singleFlight { getToken(attributes) }
 
@@ -149,7 +155,12 @@ internal class LoginTokenProvider(
         val filepath = normalizePath(platformProvider.filepath(cacheDirectory, cacheKey), platformProvider)
         val contents = serializeLoginToken(refreshed)
         try {
-            platformProvider.writeFile(filepath, contents)
+            platformProvider.write(
+                filepath,
+                contents,
+                WriteType.OVERWRITE,
+                permissions = tokenFilePermissions.posixOctal,
+            )
         } catch (ex: Exception) {
             coroutineContext.debug<LoginTokenProvider>(ex) { "failed to write refreshed token back to disk at $filepath" }
             throw ex

aws-runtime/aws-config/common/src/aws/sdk/kotlin/runtime/auth/credentials/RestrictFilePermissions.kt

@@ -0,0 +1,29 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package aws.sdk.kotlin.runtime.auth.credentials
+
+import aws.sdk.kotlin.runtime.InternalSdkApi
+
+/**
+ * Identifies a set of restricted permissions to apply when writing cached auth files (e.g., during cache token refresh
+ * for SSO or AWS Login credentials). These values have no effect on Windows.
+ */
+@InternalSdkApi
+public enum class RestrictFilePermissions(public val posixOctal: String?) {
+    /**
+     * Specifies POSIX permissions `600`—the user has read/write permissions, everyone else has no permissions
+     */
+    USER_READ_WRITE("600"),
+
+    /**
+     * Specifies no restrictions for new files in the given directory. This typically means that OS-default permissions
+     * will be applied.
+     *
+     * On POSIX-compliant OSes (e.g., Linux and Mac), this is defined by [`umask`](https://en.wikipedia.org/wiki/Umask).
+     * Most modern OSes default to a umask of `022`, which results in default permissions `644`—the user has read/write
+     * permissions, everyone else has read permission only.
+     */
+    UNRESTRICTED(null),
+}

aws-runtime/aws-config/common/src/aws/sdk/kotlin/runtime/auth/credentials/SsoTokenProvider.kt

@@ -9,9 +9,11 @@ import aws.sdk.kotlin.runtime.ConfigurationException
 import aws.sdk.kotlin.runtime.auth.credentials.internal.ssooidc.SsoOidcClient
 import aws.sdk.kotlin.runtime.auth.credentials.internal.ssooidc.createToken
 import aws.sdk.kotlin.runtime.auth.credentials.internal.ssooidc.model.CreateTokenResponse
+import aws.sdk.kotlin.runtime.config.AwsSdkSetting
 import aws.sdk.kotlin.runtime.config.profile.normalizePath
 import aws.smithy.kotlin.runtime.collections.Attributes
 import aws.smithy.kotlin.runtime.collections.emptyAttributes
+import aws.smithy.kotlin.runtime.config.resolve
 import aws.smithy.kotlin.runtime.hashing.sha1
 import aws.smithy.kotlin.runtime.http.auth.BearerToken
 import aws.smithy.kotlin.runtime.http.auth.BearerTokenProvider
@@ -27,6 +29,7 @@ import aws.smithy.kotlin.runtime.time.Instant
 import aws.smithy.kotlin.runtime.time.TimestampFormat
 import aws.smithy.kotlin.runtime.util.PlatformProvider
 import aws.smithy.kotlin.runtime.util.SingleFlightGroup
+import aws.smithy.kotlin.runtime.util.WriteType
 import kotlin.coroutines.coroutineContext
 import kotlin.time.Duration
 import kotlin.time.Duration.Companion.seconds
@@ -57,6 +60,7 @@ private const val OIDC_GRANT_TYPE_REFRESH = "refresh_token"
  * @param httpClient the [HttpClientEngine] instance to use to make requests. NOTE: This engine's resources and lifetime
  * are NOT managed by the provider. Caller is responsible for closing.
  * @param platformProvider the platform provider to use
+ * @param profile The active AWS profile
  * @param clock the source of time for the provider
  */
 public class SsoTokenProvider(
@@ -68,10 +72,12 @@ public class SsoTokenProvider(
     public val platformProvider: PlatformProvider = PlatformProvider.System,
     private val clock: Clock = Clock.System,
 ) : BearerTokenProvider {
-
     // debounce concurrent requests for a token
     private val sfg = SingleFlightGroup<SsoToken>()
 
+    private val tokenFilePermissions = AwsSdkSetting.AwsRestrictFilePermissions.resolve(platformProvider)
+        ?: RestrictFilePermissions.USER_READ_WRITE
+
     override suspend fun resolve(attributes: Attributes): BearerToken = sfg.singleFlight {
         getToken(attributes)
     }
@@ -92,6 +98,7 @@ public class SsoTokenProvider(
             coroutineContext.debug<SsoTokenProvider> { "cached token is not refreshable but still valid until ${it.expiration} for sso-session: $ssoSessionName" }
         } ?: throwTokenExpired()
     }
+
     private suspend fun attemptRefresh(oldToken: SsoToken): SsoToken {
         coroutineContext.debug<SsoTokenProvider> { "attempting to refresh token for sso-session: $ssoSessionName" }
         val result = runCatching { refreshToken(oldToken) }
@@ -112,7 +119,13 @@ public class SsoTokenProvider(
         val filepath = normalizePath(platformProvider.filepath("~", ".aws", "sso", "cache", cacheKey), platformProvider)
         try {
             val contents = serializeSsoToken(refreshed)
-            platformProvider.writeFile(filepath, contents)
+
+            platformProvider.write(
+                filepath,
+                contents,
+                WriteType.OVERWRITE,
+                permissions = tokenFilePermissions.posixOctal,
+            )
         } catch (ex: Exception) {
             coroutineContext.debug<SsoTokenProvider>(ex) { "failed to write refreshed token back to disk at $filepath" }
         }

aws-runtime/aws-config/common/src/aws/sdk/kotlin/runtime/config/AwsSdkSetting.kt

@@ -6,6 +6,10 @@
 package aws.sdk.kotlin.runtime.config
 
 import aws.sdk.kotlin.runtime.InternalSdkApi
+import aws.sdk.kotlin.runtime.auth.credentials.RestrictFilePermissions
+import aws.sdk.kotlin.runtime.config.AwsSdkSetting.AwsAccessKeyId
+import aws.sdk.kotlin.runtime.config.AwsSdkSetting.AwsContainerCredentialsRelativeUri
+import aws.sdk.kotlin.runtime.config.AwsSdkSetting.AwsSecretAccessKey
 import aws.sdk.kotlin.runtime.config.endpoints.AccountIdEndpointMode
 import aws.sdk.kotlin.runtime.http.AWS_APP_ID_ENV
 import aws.sdk.kotlin.runtime.http.AWS_APP_ID_PROP
@@ -238,6 +242,15 @@ public object AwsSdkSetting {
      */
     public val AwsAuthSchemePreference: EnvironmentSetting<String> = strEnvSetting("aws.authSchemePreference", "AWS_AUTH_SCHEME_PREFERENCE")
 
+    /**
+     * Configures the file permission restrictions used when creating cached authentication token files (e.g., for the
+     * SSO token provider or Login token provider)
+     */
+    public val AwsRestrictFilePermissions: EnvironmentSetting<RestrictFilePermissions> = enumEnvSetting<RestrictFilePermissions>(
+        "aws.restrictFilePermissions",
+        "AWS_RESTRICT_FILE_PERMISSIONS",
+    )
+
     /**
      * Enables the new retry behavior. When set, takes precedence over
      * the `SMITHY_NEW_RETRIES_2026` environment variable defined in smithy-kotlin.

aws-runtime/aws-config/common/test/aws/sdk/kotlin/runtime/auth/credentials/SsoTokenProviderTest.kt

@@ -13,6 +13,7 @@ import aws.smithy.kotlin.runtime.httptest.TestConnection
 import aws.smithy.kotlin.runtime.httptest.buildTestConnection
 import aws.smithy.kotlin.runtime.time.Instant
 import aws.smithy.kotlin.runtime.time.ManualClock
+import aws.smithy.kotlin.runtime.util.MapFilesystem
 import aws.smithy.kotlin.runtime.util.TestPlatformProvider
 import io.kotest.matchers.string.shouldContain
 import kotlinx.coroutines.test.runTest
@@ -117,6 +118,16 @@ class SsoTokenProviderTest {
                         val expected = deserializeSsoToken(testCase.expectedTokenWritebackContent.encodeToByteArray())
                         assertEquals(expected, written, "[idx=$idx]: $testCase")
                     }
+
+                    if (testCase.refreshResponse != null) {
+                        val fs = testPlatform.fs as MapFilesystem
+                        val actualPermissions = fs.getFilePermissions(cachePath)
+                        assertEquals(
+                            "600",
+                            actualPermissions,
+                            """Expected `600` permissions on $cachePath for test "${testCase.name}"""",
+                        )
+                    }
                 }
             }
     }