From 1534f1aa6a246973dc4023b47330f929d4e479c1 Mon Sep 17 00:00:00 2001
From: Chris Eager <chris@signal.org>
Date: Thu, 25 May 2023 16:57:15 -0500
Subject: [PATCH] Add web identity token AWS SDK credentials provider

---
 .../textsecuregcm/WhisperServerService.java           | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
index c95921e98..61ecf4a93 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
@@ -232,6 +232,7 @@ import org.whispersystems.websocket.setup.WebSocketEnvironment;
 import reactor.core.scheduler.Scheduler;
 import reactor.core.scheduler.Schedulers;
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProviderChain;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
 import software.amazon.awssdk.regions.Region;
 import software.amazon.awssdk.services.dynamodb.DynamoDbAsyncClient;
@@ -244,8 +245,10 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
 
   public static final String SECRETS_BUNDLE_FILE_NAME_PROPERTY = "secrets.bundle.filename";
 
-  private static final software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider AWSSDK_INSTANCE_PROFILE_CREDENTIALS_PROVIDER =
-      software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider.create();
+  private static final software.amazon.awssdk.auth.credentials.AwsCredentialsProvider AWSSDK_CREDENTIALS_PROVIDER =
+      AwsCredentialsProviderChain.of(
+          software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider.create(),
+          software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider.create());
 
 
   @Override
@@ -326,11 +329,11 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
 
     DynamoDbAsyncClient dynamoDbAsyncClient = DynamoDbFromConfig.asyncClient(
         config.getDynamoDbClientConfiguration(),
-        AWSSDK_INSTANCE_PROFILE_CREDENTIALS_PROVIDER);
+        AWSSDK_CREDENTIALS_PROVIDER);
 
     DynamoDbClient dynamoDbClient = DynamoDbFromConfig.client(
         config.getDynamoDbClientConfiguration(),
-        AWSSDK_INSTANCE_PROFILE_CREDENTIALS_PROVIDER);
+        AWSSDK_CREDENTIALS_PROVIDER);
 
     AmazonDynamoDB deletedAccountsLockDynamoDbClient = AmazonDynamoDBClientBuilder.standard()
         .withRegion(config.getDynamoDbClientConfiguration().getRegion())