3
3
"""Workload‑identity attestation helpers.
4
4
5
5
This module builds the attestation token that the Snowflake Python connector
6
- sends when Authenticating with * Workload Identity Federation* (WIF).
7
- It supports AWS, Azure, GCP and generic OIDC environments ** without** pulling
8
- in heavy SDKs such as * botocore* – we only need a small presigned STS request
6
+ sends when Authenticating with Workload Identity Federation (WIF).
7
+ It supports AWS, Azure, GCP and generic OIDC environments without pulling
8
+ in heavy SDKs such as botocore – we only need a small presigned STS request
9
9
for AWS and a couple of metadata‑server calls for Azure / GCP.
10
10
"""
11
11
@@ -66,7 +66,7 @@ def from_string(provider: str) -> AttestationProvider:
66
66
@dataclass
67
67
class WorkloadIdentityAttestation :
68
68
provider : AttestationProvider
69
- credential : str # ** base64** JSON blob – provider‑specific
69
+ credential : str # base64 JSON blob – provider‑specific
70
70
user_identifier_components : dict [str , Any ]
71
71
72
72
@@ -136,7 +136,7 @@ def _partition_from_region(region: str) -> AWSPartition:
136
136
137
137
def _sts_host_from_region (region : str ) -> str | None :
138
138
"""
139
- Construct the STS endpoint hostname for * region* according to the
139
+ Construct the STS endpoint hostname for region according to the
140
140
regionalised-STS rules published by AWS.:contentReference[oaicite:2]{index=2}
141
141
142
142
References:
@@ -173,8 +173,8 @@ def _try_get_arn_from_env_vars() -> str | None:
173
173
def try_compose_aws_user_identifier (region : str | None = None ) -> dict [str , str ]:
174
174
"""Return an identifier for the running AWS workload.
175
175
176
- Always includes the AWS * region* ; adds an *arn* key only if one is already
177
- discoverable via common environment variables. Returns **{}** only if
176
+ Always includes the AWS region; adds an *arn* key only if one is already
177
+ discoverable via common environment variables. Returns {} only if
178
178
the region cannot be determined."""
179
179
region = region or get_region ()
180
180
if not region :
@@ -189,7 +189,7 @@ def try_compose_aws_user_identifier(region: str | None = None) -> dict[str, str]
189
189
190
190
191
191
def create_aws_attestation () -> WorkloadIdentityAttestation | None :
192
- """Return AWS attestation or * None* if we're not on AWS / creds missing."""
192
+ """Return AWS attestation or None if we're not on AWS / creds missing."""
193
193
194
194
creds = load_default_credentials ()
195
195
if not creds :
0 commit comments