fix: ensure AWS credentials are resolved fresh on each request

[abstraktor]

In our product, we're having a long-living BlobStoreContext and BlobStore instance. We're facing the issue that credentials expire after a while without being refreshed. This PR attempts to fix that (I have no means though to test it right now).

Do you think, this could fix the issue we are facing?

Analysis

In AWSCredentialsProvider.java:

public Credentials getCredentials() {
if (this.awsCredentials == null) {
this.awsCredentials = resolveAwsCredentials(); // ⚠️ Called ONCE and cached
}
// ... returns the cached credentials
}

The bug: awsCredentials is resolved once and then cached in an instance field. When temporary credentials expire (typically after 1 hour for IAM roles, 15 minutes for some STS tokens), jclouds keeps using the expired ones.

What SHOULD Happen (According to the Code Comments)
The code has this comment:

// Note: No need to manually refresh credentials, AWS SDK v2 handles credential refresh automatically
// via the credentials provider chain
This is misleading! The AWS SDK DefaultCredentialsProvider DOES auto-refresh, but **only if you call `.resolveCredentials()` each time**. By caching the result, jclouds bypasses the refresh mechanism.

However, this is misleading! The AWS SDK DefaultCredentialsProvider DOES auto-refresh, but only if you call .resolveCredentials() each time. By caching the result, jclouds bypasses the refresh mechanism.

Fix

Modified common/aws/src/main/java/org/jclouds/aws/credentials/AWSCredentialsProvider.java:

1. Removed credential caching - Deleted the awsCredentials instance field that was caching credentials
2. Updated getCredentials() method - Now calls resolveAwsCredentials() on every request instead of caching the result
3. Removed misleading comment - The comment claiming AWS SDK handles refresh automatically was correct but misleading, as it only works when not caching credentials

Added regression test in common/aws/src/test/java/org/jclouds/aws/credentials/AWSCredentialsProviderTest.java:

• testCredentialsAreNotCachedIndefinitely() - Verifies that credentials are resolved fresh on each call rather than being cached
• Uses a testable subclass to track credential resolution calls without requiring real AWS credentials

[stephaneberle9]

Thanks a lot for this contribution. This addresses and fixes a critical issue.

Before merging it, we'd need to get over this test failure: https://github.com/stephaneberle9/jclouds/actions/runs/21396283792/job/61843076287?pr=3

Maybe just a missing dependency in the test project?

[abstraktor]

Should be fixed now. It seems to test providers/aws-s3 to be usable without AWS SDK. This usage seems to have worked beforehand by relying on the compiler to tolerate referencing missing classes in some places. My changes seems to have exceeded this tolerance…