[v2] Implement opting out of S3 Express session auth via config variables.

[aemous]

Notes:

• Ports Implement opting out of S3 Express session auth via config variables boto/botocore#3631 to the vendored botocore.

Description of changes:

• Added support for opting out of S3 Express session authentication via the new AWS_S3_DISABLE_EXPRESS_SESSION_AUTH environment variable or the s3_disable_express_session_auth S3 shared configuration setting.
• Added new tests against the new configuration and functionality.

Description of tests:

• Successfully ran all unit and functional tests.
• Successfully ran build-and-validate workflow.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[ashovlin]

A profile like this is failing for me

[default]
cli_history=enabled
retry_mode=standard
output=json
region=us-east-1
s3 = 
    disable_s3_express_session_auth = true

with Value (DisableS3ExpressSessionAuth) is the wrong type. Must be <class 'bool'>..

Tried true, True, abc123.

[kdaily]

A profile like this is failing for me

[default]
cli_history=enabled
retry_mode=standard
output=json
region=us-east-1
s3 = 
    disable_s3_express_session_auth = true

with Value (DisableS3ExpressSessionAuth) is the wrong type. Must be <class 'bool'>..

Tried true, True, abc123.

Per the definition, shouldn't it be s3_disable_express_session_auth instead of disable_s3_express_session_auth?

https://github.com/aws/aws-cli/pull/10105/changes#diff-eb369da3f989b1a2325e07d20f4032ae04fd0abf1739793504240b214f325a3cR196

[default]
cli_history=enabled
retry_mode=standard
output=json
region=us-east-1
s3 = 
    s3_disable_express_session_auth = true

[ashovlin]

Is the environment variable plumbed into here? I'm not seeing it have any effect when testing, I still see the CreateSession call with

AWS_S3_DISABLE_EXPRESS_SESSION_AUTH=true aws s3api list-objects-v2 --bucket <express-bucket> --debug 2>&1 | grep "Making request"

[ashovlin]

In configprovider we expanded BOTOCORE_DEFAUT_SESSION_VARIABLES, should it be DEFAULT_S3_CONFIG_VARS instead?

[ashovlin]

A profile like this is failing for me

[default]
cli_history=enabled
retry_mode=standard
output=json
region=us-east-1
s3 = 
    disable_s3_express_session_auth = true

with Value (DisableS3ExpressSessionAuth) is the wrong type. Must be <class 'bool'>..
Tried true, True, abc123.

Per the definition, shouldn't it be s3_disable_express_session_auth instead of disable_s3_express_session_auth?

https://github.com/aws/aws-cli/pull/10105/changes#diff-eb369da3f989b1a2325e07d20f4032ae04fd0abf1739793504240b214f325a3cR196

[default]
cli_history=enabled
retry_mode=standard
output=json
region=us-east-1
s3 = 
    s3_disable_express_session_auth = true

Oops, mixed up the client config with the profile config, thanks!

But then why are we crashing for a wrong/non-existent key?

[ashovlin]

In configprovider we expanded BOTOCORE_DEFAUT_SESSION_VARIABLES, should it be DEFAULT_S3_CONFIG_VARS instead?

[kdaily]

But then why are we crashing for a wrong/non-existent key?

Huh, yeah something else is amiss.

[aemous]

In configprovider we expanded BOTOCORE_DEFAUT_SESSION_VARIABLES, should it be DEFAULT_S3_CONFIG_VARS instead?

From the docs and existing code, it looks like DEFAULT_S3_CONFIG_VARS is geared towards config settings that should be nested under the s3 key in the shared config file. For this reason, I think BOTOCORE_DEFAUT_SESSION_VARIABLES is a better choice.