Honor AWS_CA_BUNDLE/ca_bundle for container credentials endpoint

[synfinatic]

Problem

A custom CA bundle configured via AWS_CA_BUNDLE (or the ca_bundle profile
setting) is silently ignored when botocore fetches credentials from
AWS_CONTAINER_CREDENTIALS_FULL_URI. This makes it impossible to serve
container credentials over HTTPS from a locally-trusted (private/self-signed)
CA — the request fails TLS verification even though AWS_CA_BUNDLE points at
a bundle that includes the issuing CA.

Tracked upstream as aws/aws-sdk#9016 (cross-SDK, opened 2024-07-08, no
movement).

Root cause

• create_credential_resolver (botocore/credentials.py) constructs
  ContainerProvider() with no arguments, so it builds its own
  ContainerMetadataFetcher.
• ContainerMetadataFetcher.__init__ (botocore/utils.py) defaults to
  URLLib3Session(timeout=self.TIMEOUT_SECONDS) with no verify argument.
• URLLib3Session defaults verify=True, and get_cert_path(True) returns
  certifi.where() — no environment variable or config setting is consulted.
• Meanwhile configprovider.py already maps
  'ca_bundle': ('ca_bundle', 'AWS_CA_BUNDLE', None, None), and
  create_credential_resolver already has session in scope and already
  calls session.get_config_variable(...) for other settings (e.g.
  metadata_service_timeout) — this setting was just never read.

Reproduction

With a local HTTPS server on https://localhost:PORT presenting a certificate
signed by a private CA, and:

export AWS_CONTAINER_CREDENTIALS_FULL_URI=https://localhost:PORT/creds
export AWS_CA_BUNDLE=/path/to/private-ca-cert.pem

import botocore.session
session = botocore.session.Session()
session.get_credentials()  # SSLError: CERTIFICATE_VERIFY_FAILED

fails today with SSLError: SSL validation failed ... [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate, even though AWS_CA_BUNDLE names a bundle that includes
the CA that signed the server's certificate. After this change the same code
succeeds.

Fix

• create_credential_resolver now reads
  ca_bundle = session.get_config_variable('ca_bundle') and passes it to a
  ContainerMetadataFetcher(verify=ca_bundle), following the same pattern
  already used for InstanceMetadataProvider's fetcher.
• ContainerMetadataFetcher.__init__ gains a verify=None parameter. When no
  session is injected, the default URLLib3Session is built with
  verify=verify if verify is not None else True — so unconfigured behavior
  (True → certifi/default trust store) is unchanged, and a configured
  ca_bundle path is passed straight through. If a session is injected (the
  existing test seam), verify has no effect.

Default behavior is unchanged; this only takes effect when ca_bundle /
AWS_CA_BUNDLE is explicitly configured.

Testing

• Added unit tests in tests/unit/test_credentials.py covering that
  create_credential_resolver wires an unconfigured session to
  verify=True, and a configured one to the bundle path.
• Added unit tests in tests/unit/test_utils.py covering
  ContainerMetadataFetcher's new verify param directly: default session
  verification, custom bundle passthrough, and that an injected session
  ignores verify (preserving the existing injection point).
• Ran the full unit + functional suite locally (60,925 passed, 126 skipped).
• Manually verified end-to-end against a local HTTPS server signed by a
  private CA: fails with CERTIFICATE_VERIFY_FAILED before this change,
  succeeds via session.get_credentials() with AWS_CA_BUNDLE set after.

Fixes aws/aws-sdk#9016

Generated by AI tools, and reviewed by Aaron Turner.