Skip to content

bugfix: wrap non-RuntimeException failures in AssumeRoleCredentialProvider - #3372

Open
lazerg wants to merge 1 commit into
aws:masterfrom
lazerg:bugfix-assume-role-non-runtime-exception
Open

lazerg wants to merge 1 commit into
aws:masterfrom
lazerg:bugfix-assume-role-non-runtime-exception

Conversation

@lazerg

@lazerg lazerg commented Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

Issue #, if available:
closes #3370

Description of changes:
The rejection callback in AssumeRoleCredentialProvider was typed to RuntimeException, so when the STS call failed with any other exception, PHP threw a TypeError from the callback and the original exception was lost. The callback now accepts Throwable and wraps every failure in the same CredentialsException, with the original kept as the previous exception. I wrapped the other failures instead of rethrowing them unchanged, because the CredentialProvider docblock says providers reject with a CredentialsException, and EcsCredentialProvider already wraps any rejection reason the same way.

Generated by AI tools, and reviewed by @lazerg.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@lazerg
lazerg requested a review from a team as a code owner October 10, 2026 14:41
@stobrien89

Copy link
Copy Markdown
Member

Hi @lazerg,

Thanks for bringing this to our attention and thank you for the fix. We'll wait until after today's release to merge this, but the changes look good to me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AssumeRoleCredentialProvider replaces non-RuntimeException failures with TypeError

2 participants