MgG:dZddlZddlZddlZddlmZddlmZmZddl m Z m Z ddl m Z ddlmZddlmZmZmZmZmZmZmZmZmZmZmZmZmZmZdd lm Z m!Z!ejDe#Z$d Z%d iiZ&Gd d Z'Gdde'Z(Gdde)eZ*GddZ+y)zResolves regions and endpoints. This module implements endpoint resolution, including resolving endpoints for a given service and region and resolving the available endpoints for a service in a specific AWS partition. N)Enum)UNSIGNED xform_name)AUTH_TYPE_MAPSHAS_CRTCRT_SUPPORTED_AUTH_TYPES)EndpointProvider)EndpointProviderErrorEndpointVariantError!InvalidEndpointConfigurationErrorInvalidHostLabelErrorMissingDependencyException NoRegionErrorParamValidationError$UnknownEndpointResolutionBuiltInNameUnknownRegionErrorUnknownSignatureVersionError*UnsupportedS3AccesspointConfigurationErrorUnsupportedS3ConfigurationErrorUnsupportedS3ControlArnError&UnsupportedS3ControlConfigurationError)ensure_booleaninstance_cachez{service}.{region}.{dnsSuffix} endpointsc(eZdZdZddZdZ ddZy)BaseEndpointResolverz3Resolves regions and endpoints. Must be subclassed.Nct)a7Resolves an endpoint for a service and region combination. :type service_name: string :param service_name: Name of the service to resolve an endpoint for (e.g., s3) :type region_name: string :param region_name: Region/endpoint name to resolve (e.g., us-east-1) if no region is provided, the first found partition-wide endpoint will be used if available. :rtype: dict :return: Returns a dict containing the following keys: - partition: (string, required) Resolved partition name - endpointName: (string, required) Resolved endpoint name - hostname: (string, required) Hostname to use for this endpoint - sslCommonName: (string) sslCommonName to use for this endpoint. - credentialScope: (dict) Signature version 4 credential scope - region: (string) region name override when signing. - service: (string) service name override when signing. - signatureVersions: (list) A list of possible signature versions, including s3, v4, v2, and s3v4 - protocols: (list) A list of supported protocols (e.g., http, https) - ...: Other keys may be included as well based on the metadata NotImplementedError)self service_name region_names ^E:\wamp.anq\www\apps\calme\nutritwin\resources\nutritwin\Lib\site-packages\botocore/regions.pyconstruct_endpointz'BaseEndpointResolver.construct_endpoint7s 6"!ct)zLists the partitions available to the endpoint resolver. :return: Returns a list of partition names (e.g., ["aws", "aws-cn"]). r)r!s r$get_available_partitionsz-BaseEndpointResolver.get_available_partitionsTs "!r&ct)aLists the endpoint names of a particular partition. :type service_name: string :param service_name: Name of a service to list endpoint for (e.g., s3) :type partition_name: string :param partition_name: Name of the partition to limit endpoints to. (e.g., aws for the public AWS endpoints, aws-cn for AWS China endpoints, aws-us-gov for AWS GovCloud (US) Endpoints, etc. :type allow_non_regional: bool :param allow_non_regional: Set to True to include endpoints that are not regional endpoints (e.g., s3-external-1, fips-us-gov-west-1, etc). :return: Returns a list of endpoint names (e.g., ["us-east-1"]). r)r!r"partition_nameallow_non_regionals r$get_available_endpointsz,BaseEndpointResolver.get_available_endpoints[s &"!r&N)awsF)__name__ __module__ __qualname____doc__r%r(r,r&r$rr4s=":"FK"r&rceZdZdZddgZddZddZdZ ddZ dd Z dd Z d Z dd Z d Z dZdZdZdZdZdZy)EndpointResolverz7Resolves endpoints based on partition endpoint metadatazaws-isoz aws-iso-bc>d|vr td||_||_y)a :type endpoint_data: dict :param endpoint_data: A dict of partition data. :type uses_builtin_data: boolean :param uses_builtin_data: Whether the endpoint data originates in the package's data directory. partitionsz%Missing "partitions" in endpoint dataN) ValueError_endpoint_datauses_builtin_data)r! endpoint_datar:s r$__init__zEndpointResolver.__init__vs( } ,DE E+!2r&cd|jdD]}|d|k7r |d}||vr||dcSy)Nr7 partitionservicesr)r9)r!r"r*r>r?s r$get_service_endpoints_dataz+EndpointResolver.get_service_endpoints_datasL,,\:I%7 ,H8+L)+6 6 ;r&cZg}|jdD]}|j|d|S)Nr7r>)r9append)r!resultr>s r$r(z)EndpointResolver.get_available_partitionss2,,\:I MM)K0 1; r&Nc g}|jdD]o}|d|k7r |d}||vr||d}|D]M} | |dv} |r,| r*|j|| |} | s&|j| 8|s| s=|j| Oq|S)Nr7r>r?rregions)r9_retrieve_variant_datarB) r!r"r*r+endpoint_variant_tagsrCr>r?service_endpoints endpoint_nameis_regional_endpoint variant_datas r$r,z(EndpointResolver.get_available_endpointss,,\:I%7 ,H8+ ( 6{ C !2 '4 )8L'L$(-A#'#>#>)-8:O$L$ m4'+?MM-0"3;$ r&c|jdD]C}|d|k(s |r0|j|jd|}|s2d|vs7|dcS|dcSy)Nr7r>defaults dnsSuffix)r9rFget)r!r*rGr>variants r$get_partition_dns_suffixz)EndpointResolver.get_partition_dns_suffixso,,\:I%7("99! j13HG;'#9&{33$[11;r&c|dk(r|r|d}|T)r9_endpoint_for_partition!_UNSUPPORTED_DUALSTACK_PARTITIONS) r!r"r#r*use_dualstack_endpointuse_fips_endpointvalid_partitionr>rCs r$r%z#EndpointResolver.construct_endpoints D &#%K  %"O!00> [)^;&/O?*55# *%  ,,\:I%+&99:11&! F ;r&cv|jdD]}|j||s|dcSt|d)Nr7r>z,No partition found for provided region_name.)r# error_msg)r9 _region_matchr)r!r#r>s r$get_partition_for_regionz)EndpointResolver.get_partition_for_regionsG,,\:I!!)[9 --;!#D  r&c|d}|r"||jvrd|d}tdg||dj|t} |d| vr| d}n t ||| |||d} || d vr|j di| S|j ||s|r| jd} | jd d } | r1| s/tjd ||| | | d <|j di| Stjd|||j di| Sy)Nr>z4Dualstack endpoints are currently not supported for z partition dualstacktagsrZr?partitionEndpoint)r>r" service_datarIrVrWrisRegionalizedTz'Using partition endpoint for %s, %s: %srIz*Creating a regex based endpoint for %s, %sr3) rUr rODEFAULT_SERVICE_DATAr_resolver[LOGdebug) r!r>r"r#rVrWforce_partitionr*rZrbresolve_kwargspartition_endpointis_regionalizeds r$rTz(EndpointResolver._endpoint_for_partitionsm#;/ "$"H"HH&'z3 '[MYO O!,00 .   "l2*+>? #o%#(((&2 2   i 5!-!1!12E!F *../?FO!/ = &  3E/$t}}6~66 II<  !4==2>2 2%:Ir&cj||dvryd|vr'tj|dj|Sy)NrET regionRegexF)recompilematch)r!r>r#s r$r[zEndpointResolver._region_match:s< )I. . I %::i 67==kJ Jr&c|jdg}|D]0}t|dt|k(s|j}|cSy)Nvariantsr`)rOsetcopy)r!r;r`rrrPrCs r$rFz'EndpointResolver._retrieve_variant_dataAsC $$Z4G76?#s4y0   r&cVg}|r|jd|r|jd|S)Nr^fips)rB)r!rVrWr`s r$_create_tag_listz!EndpointResolver._create_tag_listHs* ! KK $  KK  r&cli}|||fD])}|j||}|s|j||+|Sr-)rF _merge_keys)r!r`r;service_defaultspartition_defaultsrCrrrPs r$_resolve_variantz!EndpointResolver._resolve_variantPsI&(8:LMH11(DAG  &1N r&c|jdij|i}|jdrtjd||jdi}|jdi} |j||} | rA|j | ||| } | ik(rd|d|} t | | |j || n|} d| vr|d| d<|d | d <|| d <|j || |j | | |j|| d ||| d| d <d | vr|j|| d ||| d| d <| S) Nr deprecatedz3Client is configured with the deprecated endpoint: rMzEndpoint does not exist for z in region r_rNr> endpointNamehostname sslCommonName)rOrfwarningrwr|r ry_expand_template) r!r>r"rbrIrVrWr;rzr{r`rCrZs r$rezEndpointResolver._resolveZs%((b9== 2    \ * KKEm_U (++J;&]]:r:$$%;=NO **m%57IF|2<.A!!.1+ JJ   ]F 3"F f $"+K"8F; ' 4{!.~ )62 +V4!22  :    ;   z f $&*&;&;'{# 'F? # r&c,|D]}||vs||||<yr-r3)r! from_datarCkeys r$ryzEndpointResolver._merge_keyss!C& 'ns r&c*|j|||S)N)serviceregionrN)format)r!r>templater"rIrNs r$rz!EndpointResolver._expand_templates! )  r&)F)r.)r.FNr-)NNFF)r/r0r1r2rUr<r@r(r,rQr%r\rTr[rFrwr|reryrr3r&r$r5r5qsA)2K(@% 37 " :59 $$ 0d ?3B?B-  r&r5c@eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd Zy)EndpointResolverBuiltinsz AWS::Regionz AWS::UseFIPSzAWS::UseDualStackzAWS::STS::UseGlobalEndpointzAWS::S3::UseGlobalEndpointzAWS::S3::AcceleratezAWS::S3::ForcePathStylezAWS::S3::UseArnRegionzAWS::S3Control::UseArnRegionz'AWS::S3::DisableMultiRegionAccessPointsz SDK::EndpointzAWS::Auth::AccountIdz AWS::Auth::AccountIdEndpointModeN)r/r0r1 AWS_REGION AWS_USE_FIPSAWS_USE_DUALSTACKAWS_STS_USE_GLOBAL_ENDPOINTAWS_S3_USE_GLOBAL_ENDPOINTAWS_S3_ACCELERATEAWS_S3_FORCE_PATH_STYLEAWS_S3_USE_ARN_REGIONAWS_S3CONTROL_USE_ARN_REGIONAWS_S3_DISABLE_MRAP SDK_ENDPOINT ACCOUNT_IDACCOUNT_ID_ENDPOINT_MODEr3r&r$rrsZJ"L,#@">-74$B C"L'JAr&rceZdZdZ ddZdZdZdZdZdZ d Z d Z e d Z e d Ze d ZdZdZdZdZdZy)EndpointRulesetResolverz5Resolves endpoints using a service's endpoint rulesetNc t|||_|jjj|_||_||_||_||_||_ ||_ i|_ y)N) ruleset_datapartition_data) r _providerruleset parameters_param_definitions_service_model _builtins_client_context_event_emitter_use_ssl_requested_auth_scheme_instance_cache) r!endpoint_ruleset_datar service_modelbuiltinsclient_context event_emitteruse_sslrequested_auth_schemes r$r<z EndpointRulesetResolver.__init__sf*.) #'.."8"8"C"C+!-+ &;#!r&c \|i}|i}|j|||}tjd| |jjd i|}tjd|j|js=|jjdr"|jd|jdd}|j|jjD cic] \}} || d c} } }|S#t $r}|j ||}|||d}~wwxYwcc} }w) zAInvokes the provider with params defined in the service's rulesetNz+Calling endpoint provider with parameters: zEndpoint provider result: zhttps://zhttp://)urlr)headersr3) _get_provider_paramsrfrgrresolve_endpointr #ruleset_error_to_botocore_exceptionrr startswith_replaceritems) r!operation_model call_argsrequest_contextprovider_paramsprovider_resultexbotocore_exceptionrvals r$r%z*EndpointRulesetResolver.construct_endpointsd  I  " O33 Y  9/9J K  1=dnn==!O ./B/B.CDE}}!4!4!?!? !K-66o11!"5677O*22,;,C,C,I,I,K,KSSV ,K3  3% 1!%!I!IO" ")(b0 1(sC?$D( ? D%D  D%ci}|j|||}|jjD]L\}}|j|||}|)|j|j |j|}|H|||<N|S)aResolve a value for each parameter defined in the service's ruleset The resolution order for parameter values is: 1. Operation-specific static context values from the service definition 2. Operation-specific dynamic context values from API parameters 3. Client-specific context parameters 4. Built-in values such as region, FIPS usage, ... ) param_namerr) builtin_namer)_get_customized_builtinsrr_resolve_param_from_contextbuiltin_resolve_param_as_builtin) r!rrrrcustomized_builtinsr param_def param_vals r$rz,EndpointRulesetResolver._get_provider_paramss#;; Y &*%<%<%B%B%D !J 88% /#9I  Y%6%6%B ::!*!2!20; $.7 +&Er&c~|j||}||S|j|||}||S|j|Sr-)&_resolve_param_as_static_context_param'_resolve_param_as_dynamic_context_param&_resolve_param_as_client_context_param)r!rrrstaticdynamics r$rz3EndpointRulesetResolver._resolve_param_from_context8s[<<    M>>    N:::FFr&cF|j|}|j|Sr-)_get_static_context_paramsrO)r!rrstatic_ctx_paramss r$rz>EndpointRulesetResolver._resolve_param_as_static_context_paramGs&!;;OL $$Z00r&cZ|j|}||vr||}|j|Syr-)_get_dynamic_context_paramsrO)r!rrrdynamic_ctx_params member_names r$rz?EndpointRulesetResolver._resolve_param_as_dynamic_context_paramMs<"==oN + +,Z8K==- - ,r&cl|j}||vr ||}|jj|Syr-)_get_client_context_paramsrrO)r!rclient_ctx_paramsclient_ctx_varnames r$rz>EndpointRulesetResolver._resolve_param_as_client_context_paramUsB ;;= * *!2:!> ''++,>? ? +r&c||tjjvr t||j |S)N)name)r __members__valuesrrO)r!rrs r$rz1EndpointRulesetResolver._resolve_param_as_builtin[s4 7CCJJL L6LI I||L))r&cj|jDcic]}|j|jc}Scc}w)z=Mapping of param names to static param value for an operation)static_context_parametersrvaluer!rparams r$rz2EndpointRulesetResolver._get_static_context_params`s< )BB B JJ #B   0cj|jDcic]}|j|jc}Scc}w)z7Mapping of param names to member names for an operation)context_parametersrrrs r$rz3EndpointRulesetResolver._get_dynamic_context_paramshs> );; ; JJ)) );   rc|jjDcic]"}|jt|j$c}Scc}w)z7Mapping of param names to client configuration variable)rclient_context_parametersrr)r!rs r$rz2EndpointRulesetResolver._get_client_context_paramspsG ,,FF F JJ 5::. .F   s'Ac|jjj}tj|j}|j j d||||||S)Nzbefore-endpoint-resolution.)rmodelparamscontext)r service_id hyphenizertrremit)r!rrrrrs r$rz0EndpointRulesetResolver._get_customized_builtinsxsh((33==? "ii7   )* 6(!# ! #"r&c t|trt|dk(r tdtj ddj |Dcgc]}d|jddc}jjtk(rdifS|Dcgc]}i|dj|di}}j tfd |D\}}n td |D\}}i}d|vr |d|d<n,d|vr(t|ddkDrdj |d|d<d|vr|j#|dd|vrt%|d|d<tj d|d||||fScc}wcc}w#t$rdifcYSwxYw#t$r\d }|Dcgc]}|d ncc}w}}tstd |D}|r td t!dj |wxYw)aConvert an Endpoint's authSchemes property to a signing_context dict :type auth_schemes: list :param auth_schemes: A list of dictionaries taken from the ``authSchemes`` property of an Endpoint object returned by ``EndpointProvider``. :rtype: str, dict :return: Tuple of auth type string (to be used in ``request_context['auth_type']``) and signing context dict (for use in ``request_context['signing']``). rz&auth_schemes must be a non-empty list.z_Selecting from endpoint provider's list of auth schemes: %s. User selected auth scheme is: "%s"z, "rnoneNc3xK|]1}jj|drj|f3ywrN)._does_botocore_authname_match_ruleset_authnamer).0sr!s r$ zFEndpointRulesetResolver.auth_schemes_to_signing_ctx..sA$)JJ33QvY00!4)s7:c3@K|]}|dtvr |d|fywr)r)rrs r$rzFEndpointRulesetResolver.auth_schemes_to_signing_ctx..s,$)yN2vYN)sFc3,K|] }|tvywr-r)rschemes r$rzFEndpointRulesetResolver.auth_schemes_to_signing_ctx..s+&7F"::&7szbThis operation requires an additional dependency. Use pip install botocore[crt] before proceeding.msg)signature_version signingRegionrsigningRegionSet, signingName) signing_namedisableDoubleEncodingz?Selected auth type "%s" as "%s" with signing context params: %s) isinstancelistlen TypeErrorrfrgjoinrOrr_strip_sig_prefixnext StopIterationranyrrupdater)r! auth_schemesrrrfixable_with_crtauth_type_optionssigning_contexts` r$auth_schemes_to_signing_ctxz3EndpointRulesetResolver.auth_schemes_to_signing_ctxs,-\1Ba1GDE E  1 II\B\155=/+\B C  ' '    & &( 22: ' & Gv Fvt55fVnE F&    & & 2  $$)$  f #$)$  f6 f $(.(?OH % 6 )6,-.2,/HH-.-) F "  " "}0E " F "f ,7E./8O3 4 M 6N    _$$]C ! Rx  ! $) 8D$E 1QvY $E!$E'*+&7+($ $4L 7*.))4E*F% s7 E=!FF F FFG?) F65A G?c2|jdr|ddS|S)z6Normalize auth type names by removing any "sig" prefixsigN)r)r! auth_names r$rz)EndpointRulesetResolver._strip_sig_prefixs ) 4 4U ;y}JJr&c|j|}|jdd}|dk7r|jdr|dd}||k(S)a\ Whether a valid string provided as signature_version parameter for client construction refers to the same auth methods as a string returned by the endpoint ruleset provider. This accounts for: * The ruleset prefixes auth names with "sig" * The s3 and s3control rulesets don't distinguish between v4[a] and s3v4[a] signers * The v2, v3, and HMAC v1 based signers (s3, s3-*) are botocore legacy features and do not exist in the rulesets * Only characters up to the first dash are considered Example matches: * v4, sigv4 * v4, v4 * s3v4, sigv4 * s3v7, sigv7 (hypothetical example) * s3v4a, sigv4a * s3v4-query, sigv4 Example mismatches: * v4a, sigv4 * s3, sigv4 * s3-presign-post, sigv4 -rrSN)rsplitr)r!botonamersnames r$rzFEndpointRulesetResolver._does_botocore_authname_match_ruleset_authnamesR4''/>>#&q) t  3 3D 9|H!!r&c|jjd}|y|jdr! |jdd}t |S|j j}|dk(r|dk(s|d k(r t| S|jd sU|jd sD|jd s3|jds"|jds|jdr t| S|jjdr t|S|dk(rn|jdr|jd}t||S|jds|jdr t| S|dk(r t|S|dk(r.|jdr t| S|dk(r t| Sy#t$r|}YwxYw)zAttempts to translate ruleset errors to pre-existing botocore exception types by string matching exception strings. rNzInvalid region in ARN: `)labelrSz/S3 Object Lambda does not support S3 Acceleratez#Accelerate cannot be used with FIPSrzS3 Outposts does not supportzS3 MRAP does not supportz!S3 Object Lambda does not supportzAccess Points do not supportzInvalid configuration:z#Client was configured for partitionz invalid arn:)report s3controlz Invalid ARN:Bucket)arnrz!AccountId is required but not seteventszUInvalid Configuration: FIPS is not supported with EventBridge multi-region endpoints.z&EndpointId must be a valid host label.)kwargsrOrr IndexErrorrrr"rrlowerrrrr )r!ruleset_exceptionrrr%r"r)s r$rz;EndpointRulesetResolver.ruleset_error_to_botocore_exceptions &&**51 ;  >>3 4  #q))u5 5**77 4 HH??63??=>>>"<=>>"EF>>"@A>>":;>>"GHAcJJyy{%%n5+377 ; &~~n-jj*3EE~~673>>5<>#FF99+377 8 #~~69SAA>>8SAAQ  sG GG)TN)r/r0r1r2r<r%rrrrrrrrrrrrrrrr3r&r$rrs?""00dB G1 .@ *        #a%FK"@5r&r),r2rtloggingrnenumrbotocorerr botocore.authrr botocore.crtr botocore.endpoint_providerr botocore.exceptionsr r r rrrrrrrrrrrbotocore.utilsrr getLoggerr/rfDEFAULT_URI_TEMPLATErdrr5strrrr3r&r$r:s  )117 :g!7#R(:":"zt +t n BsDBDyyr&