[master] AWS SESSION TOKEN returned

changelog/64533.added.md

@@ -0,0 +1 @@
+Add support for AWS session tokens in salt-cloud EC2 provider. When a ``token`` key is present in the provider configuration, it is now forwarded as the security token in AWS API calls.

salt/utils/aws.py

@@ -144,7 +144,11 @@ def creds(provider):
 
         ret_credentials = __AccessKeyId__, __SecretAccessKey__, __Token__
     else:
-        ret_credentials = provider["id"], provider["key"], ""
+        ret_credentials = (
+            provider["id"],
+            provider["key"],
+            provider.get("token") or "",
+        )
 
     if provider.get("role_arn") is not None:
         provider_shadow = provider.copy()

tests/pytests/unit/utils/test_aws.py

@@ -208,3 +208,44 @@ def handle_get_metadata_mock(path, **args):
             )
             assert mock_get_metadata.call_count == 0
             assert result == assumed_creds_ret
+
+
+def test_creds_static_with_session_token():
+    """
+    When a provider has static id/key plus a token, creds() must return
+    the token as the third element of the tuple.
+    """
+    provider = {
+        "id": "AKIAIOSFODNN7EXAMPLE",
+        "key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+        "token": "AQoDYXdzEJr//my-session-token",
+    }
+    result = aws.creds(provider)
+    assert result == (provider["id"], provider["key"], provider["token"])
+
+
+def test_creds_static_without_session_token():
+    """
+    When a provider has static id/key and no token, creds() must return
+    an empty string as the third element for backward compatibility.
+    """
+    provider = {
+        "id": "AKIAIOSFODNN7EXAMPLE",
+        "key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    }
+    result = aws.creds(provider)
+    assert result == (provider["id"], provider["key"], "")
+
+
+def test_creds_static_with_none_token():
+    """
+    When a provider has token=None, creds() must return an empty string
+    as the third element (same as no token).
+    """
+    provider = {
+        "id": "AKIAIOSFODNN7EXAMPLE",
+        "key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+        "token": None,
+    }
+    result = aws.creds(provider)
+    assert result == (provider["id"], provider["key"], "")