Upgrade AWS SDK

pom.xml

@@ -44,7 +44,7 @@
         <!-- Using the latest version of geotools (e.g, 20) seems to cause issues with the shapefile
         plugin where the_geom for each feature is null. -->
         <geotools.version>20.1</geotools.version>
-        <awsjavasdk.version>1.12.720</awsjavasdk.version>
+        <awsjavasdk.version>2.51.3</awsjavasdk.version>
     </properties>
     <build>
         <resources>
@@ -220,6 +220,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.client5</groupId>
+                <artifactId>httpclient5</artifactId>
+                <version>5.6.2</version>
+                <type>jar</type>
+                <scope>runtime</scope>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>
@@ -284,7 +291,6 @@
         </dependency>
         <!-- Used for loading/fetching/validating/writing GTFS entities. gtfs-lib also provides access to:
          - commons-io - generic utilities
-         - AWS S3 SDK - putting/getting objects into/out of S3.
          -->
         <dependency>
             <groupId>com.github.ibi-group</groupId>
@@ -447,30 +453,51 @@
             <version>2.4.0</version>
         </dependency>
         <!-- AWS individual module imports -->
+        <!-- AWS signin, sso, and ssooidc enable local development using federated access (aws sso login). -->
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>signin</artifactId>
+            <version>${awsjavasdk.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>sso</artifactId>
+            <version>${awsjavasdk.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>ssooidc</artifactId>
+            <version>${awsjavasdk.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>s3-transfer-manager</artifactId>
+            <version>${awsjavasdk.version}</version>
+        </dependency>
         <dependency>
-            <groupId>com.amazonaws</groupId>
-            <artifactId>aws-java-sdk-s3</artifactId>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>s3</artifactId>
             <version>${awsjavasdk.version}</version>
         </dependency>
         <dependency>
-            <groupId>com.amazonaws</groupId>
-            <artifactId>aws-java-sdk-ec2</artifactId>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>ec2</artifactId>
             <version>${awsjavasdk.version}</version>
         </dependency>
         <dependency>
-            <groupId>com.amazonaws</groupId>
-            <artifactId>aws-java-sdk-iam</artifactId>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>iam</artifactId>
             <version>${awsjavasdk.version}</version>
         </dependency>
         <dependency>
-            <groupId>com.amazonaws</groupId>
-            <artifactId>aws-java-sdk-elasticloadbalancingv2</artifactId>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>elasticloadbalancingv2</artifactId>
             <version>${awsjavasdk.version}</version>
         </dependency>
         <!-- AWS STS allows Data Tools to assume other roles in order to deploy OTP to other AWS accounts. -->
         <dependency>
-            <groupId>com.amazonaws</groupId>
-            <artifactId>aws-java-sdk-sts</artifactId>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>sts</artifactId>
             <version>${awsjavasdk.version}</version>
         </dependency>
         <dependency>

src/main/java/com/conveyal/datatools/common/utils/SparkUtils.java

@@ -1,6 +1,5 @@
 package com.conveyal.datatools.common.utils;
 
-import com.amazonaws.AmazonServiceException;
 import com.conveyal.datatools.common.utils.aws.CheckedAWSException;
 import com.conveyal.datatools.common.utils.aws.S3Utils;
 import com.conveyal.datatools.manager.auth.Auth0UserProfile;
@@ -15,6 +14,7 @@
 import org.eclipse.jetty.http.HttpStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import software.amazon.awssdk.awscore.exception.AwsServiceException;
 import spark.HaltException;
 import spark.Request;
 import spark.Response;
@@ -311,7 +311,7 @@ public static String uploadMultipartRequestBodyToS3(Request req, String uploadTy
         }
         try {
             return S3Utils.uploadObject(uploadType + "/" + key + "_" + uploadedFileName, tempFile);
-        } catch (AmazonServiceException | CheckedAWSException e) {
+        } catch (AwsServiceException | CheckedAWSException e) {
             logMessageAndHalt(req, 500, "Error uploading file to S3", e);
             return null;
         } finally {

src/main/java/com/conveyal/datatools/common/utils/aws/AWSClientManager.java

@@ -1,14 +1,13 @@
 package com.conveyal.datatools.common.utils.aws;
 
-import com.amazonaws.AmazonServiceException;
-import com.amazonaws.auth.AWSCredentialsProvider;
-import com.amazonaws.auth.AWSSessionCredentials;
-import com.amazonaws.auth.AWSStaticCredentialsProvider;
-import com.amazonaws.auth.BasicSessionCredentials;
-import com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider;
 import com.conveyal.datatools.common.utils.ExpiringAsset;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.AwsSessionCredentials;
+import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
+import software.amazon.awssdk.awscore.exception.AwsServiceException;
+import software.amazon.awssdk.services.sts.auth.StsAssumeRoleCredentialsProvider;
 
 import java.util.HashMap;
 
@@ -26,7 +25,7 @@ public abstract class AWSClientManager<T> {
     private static final Logger LOG = LoggerFactory.getLogger(AWSClientManager.class);
 
     private static final long DEFAULT_EXPIRING_AWS_ASSET_VALID_DURATION_MILLIS = 800 * 1000;
-    private static final HashMap<String, ExpiringAsset<AWSStaticCredentialsProvider>> crendentialsProvidersByRole =
+    private static final HashMap<String, ExpiringAsset<StaticCredentialsProvider>> crendentialsProvidersByRole =
         new HashMap<>();
 
     protected final T defaultClient;
@@ -43,37 +42,32 @@ public AWSClientManager (T defaultClient) {
      * https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html). The credentials can be
      * then used for creating a temporary client.
      */
-    private static ExpiringAsset<AWSStaticCredentialsProvider> getCredentialsForRole(
+    private static ExpiringAsset<StaticCredentialsProvider> getCredentialsForRole(
         String role
     ) throws CheckedAWSException {
         String roleSessionName = "data-tools-session";
         // check if an active credentials provider exists for this role
-        ExpiringAsset<AWSStaticCredentialsProvider> session = crendentialsProvidersByRole.get(role);
+        ExpiringAsset<StaticCredentialsProvider> session = crendentialsProvidersByRole.get(role);
         if (session != null && session.isActive()) {
             LOG.debug("Returning active role-based session credentials");
             return session;
         }
         // either a session hasn't been created or an existing one has expired. Create a new session.
-        STSAssumeRoleSessionCredentialsProvider sessionProvider = new STSAssumeRoleSessionCredentialsProvider
-            .Builder(
-                role,
-                roleSessionName
+        StsAssumeRoleCredentialsProvider sessionProvider = StsAssumeRoleCredentialsProvider
+            .builder()
+            .refreshRequest(r ->
+                    r.roleSessionName(roleSessionName)
+                    .roleArn(role)
             )
             .build();
-        AWSSessionCredentials credentials;
-        try {
-            credentials = sessionProvider.getCredentials();
-        } catch (AmazonServiceException e) {
+        AwsSessionCredentials credentials;
+        try (sessionProvider) {
+            credentials = (AwsSessionCredentials) sessionProvider.resolveCredentials();
+        } catch (AwsServiceException e) {
             throw new CheckedAWSException("Failed to obtain AWS credentials");
         }
         LOG.info("Successfully created role-based session credentials");
-        AWSStaticCredentialsProvider credentialsProvider = new AWSStaticCredentialsProvider(
-            new BasicSessionCredentials(
-                credentials.getAWSAccessKeyId(),
-                credentials.getAWSSecretKey(),
-                credentials.getSessionToken()
-            )
-        );
+        StaticCredentialsProvider credentialsProvider = StaticCredentialsProvider.create(AwsSessionCredentials.create(credentials.accessKeyId(), credentials.secretAccessKey(), credentials.sessionToken()));
         session = new ExpiringAsset<>(credentialsProvider, DEFAULT_EXPIRING_AWS_ASSET_VALID_DURATION_MILLIS);
         // store the credentials provider in a lookup by role for future use
         crendentialsProvidersByRole.put(role, session);
@@ -89,7 +83,7 @@ private static ExpiringAsset<AWSStaticCredentialsProvider> getCredentialsForRole
      * An abstract method where the implementation will create a client with the specified role and region.
      */
     protected abstract T buildCredentialedClientForRoleAndRegion(
-        AWSCredentialsProvider credentials, String region, String role
+        AwsCredentialsProvider credentials, String region, String role
     ) throws CheckedAWSException;
 
     /**
@@ -127,7 +121,7 @@ public T getClient(String role, String region) throws CheckedAWSException {
         }
 
         // Either a new client hasn't been created or it has expired. Create a new client and cache it.
-        ExpiringAsset<AWSStaticCredentialsProvider> session = getCredentialsForRole(role);
+        ExpiringAsset<StaticCredentialsProvider> session = getCredentialsForRole(role);
         T credentialedClientForRoleAndRegion = buildCredentialedClientForRoleAndRegion(session.asset, region, role);
         LOG.info("Successfully created role-based {} client", getClientClassName());
         clientsByRoleAndRegion.put(

src/main/java/com/conveyal/datatools/common/utils/aws/CheckedAWSException.java

@@ -1,6 +1,6 @@
 package com.conveyal.datatools.common.utils.aws;
 
-import com.amazonaws.AmazonServiceException;
+import software.amazon.awssdk.awscore.exception.AwsServiceException;
 
 /**
  * A helper exception class that does not extend the RunTimeException class in order to make the compiler properly
@@ -14,7 +14,7 @@ public CheckedAWSException(String message) {
         originalException = null;
     }
 
-    public CheckedAWSException(AmazonServiceException e) {
+    public CheckedAWSException(AwsServiceException e) {
         super(e.getMessage());
         originalException = e;
     }