symfony · fabpot · Jan 19, 2022 · Jan 18, 2022
diff --git a/src/Symfony/Component/Messenger/Bridge/AmazonSqs/CHANGELOG.md b/src/Symfony/Component/Messenger/Bridge/AmazonSqs/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========

+6.1
+---
+
+ * Added `session_token` option to support short-lived AWS credentials
+
 5.3
 ---


diff --git a/src/Symfony/Component/Messenger/Bridge/AmazonSqs/Tests/Transport/ConnectionTest.php b/src/Symfony/Component/Messenger/Bridge/AmazonSqs/Tests/Transport/ConnectionTest.php
@@ -56,6 +56,24 @@ public function testConfigureWithCredentials()
        );
    }

+    public function testConfigureWithTemporaryCredentials()
+    {
+        $awsKey = 'some_aws_access_key_value';
+        $awsSecret = 'some_aws_secret_value';
+        $sessionToken = 'some_aws_sessionToken';
+        $region = 'eu-west-1';
+        $httpClient = $this->createMock(HttpClientInterface::class);
+        $this->assertEquals(
+            new Connection(['queue_name' => 'queue'], new SqsClient(['region' => $region, 'accessKeyId' => $awsKey, 'accessKeySecret' => $awsSecret, 'sessionToken' => $sessionToken], null, $httpClient)),
+            Connection::fromDsn('sqs://default/queue', [
+                'access_key' => $awsKey,
+                'secret_key' => $awsSecret,
+                'session_token' => $sessionToken,
+                'region' => $region,
+            ], $httpClient)
+        );
+    }
+
    public function testFromInvalidDsn()
    {
        $this->expectException(\InvalidArgumentException::class);

diff --git a/src/Symfony/Component/Messenger/Bridge/AmazonSqs/Transport/Connection.php b/src/Symfony/Component/Messenger/Bridge/AmazonSqs/Transport/Connection.php
@@ -41,6 +41,7 @@ class Connection
        'auto_setup' => true,
        'access_key' => null,
        'secret_key' => null,
+        'session_token' => null,
        'endpoint' => 'https://sqs.eu-west-1.amazonaws.com',
        'region' => 'eu-west-1',
        'queue_name' => 'messages',
@@ -89,6 +90,7 @@ public function __destruct()
     * * account: identifier of the AWS account
     * * access_key: AWS access key
     * * secret_key: AWS secret key
+     * * session_token: AWS session token (required only when using temporary credentials)
     * * buffer_size: number of messages to prefetch (Default: 9)
     * * wait_time: long polling duration in seconds (Default: 20)
     * * poll_timeout: amount of seconds the transport should wait for new message
@@ -135,6 +137,9 @@ public static function fromDsn(string $dsn, array $options = [], HttpClientInter
            'accessKeyId' => urldecode($parsedUrl['user'] ?? '') ?: $options['access_key'] ?? self::DEFAULT_OPTIONS['access_key'],
            'accessKeySecret' => urldecode($parsedUrl['pass'] ?? '') ?: $options['secret_key'] ?? self::DEFAULT_OPTIONS['secret_key'],
        ];
+        if (null !== $options['session_token']) {
+            $clientConfiguration['sessionToken'] = $options['session_token'];
+        }
        if (isset($options['debug'])) {
            $clientConfiguration['debug'] = $options['debug'];
        }