@@ -127,7 +127,7 @@ clone git github.com/tinylib/msgp 75ee40d2601edf122ef667e2a07d600d4c44490c

 clone git gopkg.in/fsnotify.v1 v1.2.11

 # awslogs deps

-clone git github.com/aws/aws-sdk-go v1.1.30

+clone git github.com/aws/aws-sdk-go v1.4.22

 clone git github.com/go-ini/ini 060d7da055ba6ec5ea7a31f116332fe5efa04ce0

 clone git github.com/jmespath/go-jmespath 0b12d6b521d83fc7f755e7cfc1b1fbdd35a01a74

@@ -44,7 +44,7 @@ type Error interface {

 // BatchError is a batch of errors which also wraps lower level errors with

 // code, message, and original errors. Calling Error() will include all errors

-// that occured in the batch.

+// that occurred in the batch.

 //

 // Deprecated: Replaced with BatchedErrors. Only defined for backwards

 // compatibility.

@@ -64,7 +64,7 @@ type BatchError interface {

 // BatchedErrors is a batch of errors which also wraps lower level errors with

 // code, message, and original errors. Calling Error() will include all errors

-// that occured in the batch.

+// that occurred in the batch.

 //

 // Replaces BatchError

 type BatchedErrors interface {

@@ -98,7 +98,7 @@ func (b baseError) OrigErr() error {

 			return NewBatchError(err.Code(), err.Message(), b.errs[1:])

 		}

 		return NewBatchError("BatchedErrors",

-			"multiple errors occured", b.errs)

+			"multiple errors occurred", b.errs)

 	}

 }

@@ -3,6 +3,7 @@ package awsutil

 import (

 	"io"

 	"reflect"

+	"time"

 )

 // Copy deeply copies a src structure to dst. Useful for copying request and

@@ -49,7 +50,14 @@ func rcopy(dst, src reflect.Value, root bool) {

 		} else {

 			e := src.Type().Elem()

 			if dst.CanSet() && !src.IsNil() {

-				dst.Set(reflect.New(e))

+				if _, ok := src.Interface().(*time.Time); !ok {

+					dst.Set(reflect.New(e))

+				} else {

+					tempValue := reflect.New(e)

+					tempValue.Elem().Set(src.Elem())

+					// Sets time.Time's unexported values

+					dst.Set(tempValue)

+				}

 			}

 			if src.Elem().IsValid() {

 				// Keep the current root state since the depth hasn't changed

@@ -106,8 +106,8 @@ func rValuesAtPath(v interface{}, path string, createPath, caseSensitive, nilTer

 		if indexStar || index != nil {

 			nextvals = []reflect.Value{}

-			for _, value := range values {

-				value := reflect.Indirect(value)

+			for _, valItem := range values {

+				value := reflect.Indirect(valItem)

 				if value.Kind() != reflect.Slice {

 					continue

 				}

@@ -2,7 +2,6 @@ package client

 import (

 	"fmt"

-	"io/ioutil"

 	"net/http/httputil"

 	"github.com/aws/aws-sdk-go/aws"

@@ -87,16 +86,24 @@ const logReqMsg = `DEBUG: Request %s/%s Details:

 %s

 -----------------------------------------------------`

+const logReqErrMsg = `DEBUG ERROR: Request %s/%s:

+---[ REQUEST DUMP ERROR ]-----------------------------

+%s

+-----------------------------------------------------`

+

 func logRequest(r *request.Request) {

 	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)

-	dumpedBody, _ := httputil.DumpRequestOut(r.HTTPRequest, logBody)

+	dumpedBody, err := httputil.DumpRequestOut(r.HTTPRequest, logBody)

+	if err != nil {

+		r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg, r.ClientInfo.ServiceName, r.Operation.Name, err))

+		return

+	}

 	if logBody {

 		// Reset the request body because dumpRequest will re-wrap the r.HTTPRequest's

 		// Body as a NoOpCloser and will not be reset after read by the HTTP

 		// client reader.

-		r.Body.Seek(r.BodyStart, 0)

-		r.HTTPRequest.Body = ioutil.NopCloser(r.Body)

+		r.ResetBody()

 	}

 	r.Config.Logger.Log(fmt.Sprintf(logReqMsg, r.ClientInfo.ServiceName, r.Operation.Name, string(dumpedBody)))

@@ -107,11 +114,21 @@ const logRespMsg = `DEBUG: Response %s/%s Details:

 %s

 -----------------------------------------------------`

+const logRespErrMsg = `DEBUG ERROR: Response %s/%s:

+---[ RESPONSE DUMP ERROR ]-----------------------------

+%s

+-----------------------------------------------------`

+

 func logResponse(r *request.Request) {

 	var msg = "no response data"

 	if r.HTTPResponse != nil {

 		logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)

-		dumpedBody, _ := httputil.DumpResponse(r.HTTPResponse, logBody)

+		dumpedBody, err := httputil.DumpResponse(r.HTTPResponse, logBody)

+		if err != nil {

+			r.Config.Logger.Log(fmt.Sprintf(logRespErrMsg, r.ClientInfo.ServiceName, r.Operation.Name, err))

+			return

+		}

+

 		msg = string(dumpedBody)

 	} else if r.Error != nil {

 		msg = r.Error.Error()

@@ -7,24 +7,36 @@ import (

 	"github.com/aws/aws-sdk-go/aws/credentials"

 )

-// UseServiceDefaultRetries instructs the config to use the service's own default

-// number of retries. This will be the default action if Config.MaxRetries

-// is nil also.

+// UseServiceDefaultRetries instructs the config to use the service's own

+// default number of retries. This will be the default action if

+// Config.MaxRetries is nil also.

 const UseServiceDefaultRetries = -1

-// RequestRetryer is an alias for a type that implements the request.Retryer interface.

+// RequestRetryer is an alias for a type that implements the request.Retryer

+// interface.

 type RequestRetryer interface{}

 // A Config provides service configuration for service clients. By default,

-// all clients will use the {defaults.DefaultConfig} structure.

+// all clients will use the defaults.DefaultConfig tructure.

+//

+//     // Create Session with MaxRetry configuration to be shared by multiple

+//     // service clients.

+//     sess, err := session.NewSession(&aws.Config{

+//         MaxRetries: aws.Int(3),

+//     })

+//

+//     // Create S3 service client with a specific Region.

+//     svc := s3.New(sess, &aws.Config{

+//         Region: aws.String("us-west-2"),

+//     })

 type Config struct {

 	// Enables verbose error printing of all credential chain errors.

-	// Should be used when wanting to see all errors while attempting to retreive

-	// credentials.

+	// Should be used when wanting to see all errors while attempting to

+	// retrieve credentials.

 	CredentialsChainVerboseErrors *bool

-	// The credentials object to use when signing requests. Defaults to

-	// a chain of credential providers to search for credentials in environment

+	// The credentials object to use when signing requests. Defaults to a

+	// chain of credential providers to search for credentials in environment

 	// variables, shared credential file, and EC2 Instance Roles.

 	Credentials *credentials.Credentials

@@ -63,11 +75,12 @@ type Config struct {

 	Logger Logger

 	// The maximum number of times that a request will be retried for failures.

-	// Defaults to -1, which defers the max retry setting to the service specific

-	// configuration.

+	// Defaults to -1, which defers the max retry setting to the service

+	// specific configuration.

 	MaxRetries *int

-	// Retryer guides how HTTP requests should be retried in case of recoverable failures.

+	// Retryer guides how HTTP requests should be retried in case of

+	// recoverable failures.

 	//

 	// When nil or the value does not implement the request.Retryer interface,

 	// the request.DefaultRetryer will be used.

@@ -82,8 +95,8 @@ type Config struct {

 	//

 	Retryer RequestRetryer

-	// Disables semantic parameter validation, which validates input for missing

-	// required fields and/or other semantic request input errors.

+	// Disables semantic parameter validation, which validates input for

+	// missing required fields and/or other semantic request input errors.

 	DisableParamValidation *bool

 	// Disables the computation of request and response checksums, e.g.,

@@ -91,8 +104,8 @@ type Config struct {

 	DisableComputeChecksums *bool

 	// Set this to `true` to force the request to use path-style addressing,

-	// i.e., `http://s3.amazonaws.com/BUCKET/KEY`. By default, the S3 client will

-	// use virtual hosted bucket addressing when possible

+	// i.e., `http://s3.amazonaws.com/BUCKET/KEY`. By default, the S3 client

+	// will use virtual hosted bucket addressing when possible

 	// (`http://BUCKET.s3.amazonaws.com/KEY`).

 	//

 	// @note This configuration option is specific to the Amazon S3 service.

@@ -109,44 +122,81 @@ type Config struct {

 	// http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html

 	//

 	// 100-Continue is only enabled for Go 1.6 and above. See `http.Transport`'s

-	// `ExpectContinueTimeout` for information on adjusting the continue wait timeout.

-	// https://golang.org/pkg/net/http/#Transport

+	// `ExpectContinueTimeout` for information on adjusting the continue wait

+	// timeout. https://golang.org/pkg/net/http/#Transport

 	//

-	// You should use this flag to disble 100-Continue if you experiance issues

-	// with proxies or thrid party S3 compatible services.

+	// You should use this flag to disble 100-Continue if you experience issues

+	// with proxies or third party S3 compatible services.

 	S3Disable100Continue *bool

-	// Set this to `true` to enable S3 Accelerate feature. For all operations compatible

-	// with S3 Accelerate will use the accelerate endpoint for requests. Requests not compatible

-	// will fall back to normal S3 requests.

+	// Set this to `true` to enable S3 Accelerate feature. For all operations

+	// compatible with S3 Accelerate will use the accelerate endpoint for

+	// requests. Requests not compatible will fall back to normal S3 requests.

 	//

-	// The bucket must be enable for accelerate to be used with S3 client with accelerate

-	// enabled. If the bucket is not enabled for accelerate an error will be returned.

-	// The bucket name must be DNS compatible to also work with accelerate.

+	// The bucket must be enable for accelerate to be used with S3 client with

+	// accelerate enabled. If the bucket is not enabled for accelerate an error

+	// will be returned. The bucket name must be DNS compatible to also work

+	// with accelerate.

 	S3UseAccelerate *bool

 	// Set this to `true` to disable the EC2Metadata client from overriding the

-	// default http.Client's Timeout. This is helpful if you do not want the EC2Metadata

-	// client to create a new http.Client. This options is only meaningful if you're not

-	// already using a custom HTTP client with the SDK. Enabled by default.

+	// default http.Client's Timeout. This is helpful if you do not want the

+	// EC2Metadata client to create a new http.Client. This options is only

+	// meaningful if you're not already using a custom HTTP client with the

+	// SDK. Enabled by default.

 	//

-	// Must be set and provided to the session.New() in order to disable the EC2Metadata

-	// overriding the timeout for default credentials chain.

+	// Must be set and provided to the session.NewSession() in order to disable

+	// the EC2Metadata overriding the timeout for default credentials chain.

 	//

 	// Example:

-	//    sess := session.New(aws.NewConfig().WithEC2MetadataDiableTimeoutOverride(true))

+	//    sess, err := session.NewSession(aws.NewConfig().WithEC2MetadataDiableTimeoutOverride(true))

+	//

 	//    svc := s3.New(sess)

 	//

 	EC2MetadataDisableTimeoutOverride *bool

+	// Instructs the endpiont to be generated for a service client to

+	// be the dual stack endpoint. The dual stack endpoint will support

+	// both IPv4 and IPv6 addressing.

+	//

+	// Setting this for a service which does not support dual stack will fail

+	// to make requets. It is not recommended to set this value on the session

+	// as it will apply to all service clients created with the session. Even

+	// services which don't support dual stack endpoints.

+	//

+	// If the Endpoint config value is also provided the UseDualStack flag

+	// will be ignored.

+	//

+	// Only supported with.

+	//

+	//     sess, err := session.NewSession()

+	//

+	//     svc := s3.New(sess, &aws.Config{

+	//         UseDualStack: aws.Bool(true),

+	//     })

+	UseDualStack *bool

+

+	// SleepDelay is an override for the func the SDK will call when sleeping

+	// during the lifecycle of a request. Specifically this will be used for

+	// request delays. This value should only be used for testing. To adjust

+	// the delay of a request see the aws/client.DefaultRetryer and

+	// aws/request.Retryer.

 	SleepDelay func(time.Duration)

 }

-// NewConfig returns a new Config pointer that can be chained with builder methods to

-// set multiple configuration values inline without using pointers.

+// NewConfig returns a new Config pointer that can be chained with builder

+// methods to set multiple configuration values inline without using pointers.

 //

-//     svc := s3.New(aws.NewConfig().WithRegion("us-west-2").WithMaxRetries(10))

+//     // Create Session with MaxRetry configuration to be shared by multiple

+//     // service clients.

+//     sess, err := session.NewSession(aws.NewConfig().

+//         WithMaxRetries(3),

+//     )

 //

+//     // Create S3 service client with a specific Region.

+//     svc := s3.New(sess, aws.NewConfig().

+//         WithRegion("us-west-2"),

+//     )

 func NewConfig() *Config {

 	return &Config{}

 }

@@ -249,6 +299,13 @@ func (c *Config) WithS3UseAccelerate(enable bool) *Config {

 	return c

 }

+// WithUseDualStack sets a config UseDualStack value returning a Config

+// pointer for chaining.

+func (c *Config) WithUseDualStack(enable bool) *Config {

+	c.UseDualStack = &enable

+	return c

+}

+

 // WithEC2MetadataDisableTimeoutOverride sets a config EC2MetadataDisableTimeoutOverride value

 // returning a Config pointer for chaining.

 func (c *Config) WithEC2MetadataDisableTimeoutOverride(enable bool) *Config {

@@ -335,6 +392,10 @@ func mergeInConfig(dst *Config, other *Config) {

 		dst.S3UseAccelerate = other.S3UseAccelerate

 	}

+	if other.UseDualStack != nil {

+		dst.UseDualStack = other.UseDualStack

+	}

+

 	if other.EC2MetadataDisableTimeoutOverride != nil {

 		dst.EC2MetadataDisableTimeoutOverride = other.EC2MetadataDisableTimeoutOverride

 	}

@@ -2,7 +2,7 @@ package aws

 import "time"

-// String returns a pointer to of the string value passed in.

+// String returns a pointer to the string value passed in.

 func String(v string) *string {

 	return &v

 }

@@ -61,7 +61,7 @@ func StringValueMap(src map[string]*string) map[string]string {

 	return dst

 }

-// Bool returns a pointer to of the bool value passed in.

+// Bool returns a pointer to the bool value passed in.

 func Bool(v bool) *bool {

 	return &v

 }

@@ -120,7 +120,7 @@ func BoolValueMap(src map[string]*bool) map[string]bool {

 	return dst

 }

-// Int returns a pointer to of the int value passed in.

+// Int returns a pointer to the int value passed in.

 func Int(v int) *int {

 	return &v

 }

@@ -179,7 +179,7 @@ func IntValueMap(src map[string]*int) map[string]int {

 	return dst

 }

-// Int64 returns a pointer to of the int64 value passed in.

+// Int64 returns a pointer to the int64 value passed in.

 func Int64(v int64) *int64 {

 	return &v

 }

@@ -238,7 +238,7 @@ func Int64ValueMap(src map[string]*int64) map[string]int64 {

 	return dst

 }

-// Float64 returns a pointer to of the float64 value passed in.

+// Float64 returns a pointer to the float64 value passed in.

 func Float64(v float64) *float64 {

 	return &v

 }

@@ -297,7 +297,7 @@ func Float64ValueMap(src map[string]*float64) map[string]float64 {

 	return dst

 }

-// Time returns a pointer to of the time.Time value passed in.

+// Time returns a pointer to the time.Time value passed in.

 func Time(v time.Time) *time.Time {

 	return &v

 }

@@ -10,9 +10,11 @@ import (

 	"regexp"

 	"runtime"

 	"strconv"

+	"time"

 	"github.com/aws/aws-sdk-go/aws"

 	"github.com/aws/aws-sdk-go/aws/awserr"

+	"github.com/aws/aws-sdk-go/aws/credentials"

 	"github.com/aws/aws-sdk-go/aws/request"

 )

@@ -67,6 +69,34 @@ var SDKVersionUserAgentHandler = request.NamedHandler{

 var reStatusCode = regexp.MustCompile(`^(\d{3})`)

+// ValidateReqSigHandler is a request handler to ensure that the request's

+// signature doesn't expire before it is sent. This can happen when a request

+// is built and signed signficantly before it is sent. Or signficant delays

+// occur whne retrying requests that would cause the signature to expire.

+var ValidateReqSigHandler = request.NamedHandler{

+	Name: "core.ValidateReqSigHandler",

+	Fn: func(r *request.Request) {

+		// Unsigned requests are not signed

+		if r.Config.Credentials == credentials.AnonymousCredentials {

+			return

+		}

+

+		signedTime := r.Time

+		if !r.LastSignedAt.IsZero() {

+			signedTime = r.LastSignedAt

+		}

+

+		// 10 minutes to allow for some clock skew/delays in transmission.

+		// Would be improved with aws/aws-sdk-go#423

+		if signedTime.Add(10 * time.Minute).After(time.Now()) {

+			return

+		}

+

+		fmt.Println("request expired, resigning")

+		r.Sign()

+	},

+}

+

 // SendHandler is a request handler to send service request using HTTP client.

 var SendHandler = request.NamedHandler{Name: "core.SendHandler", Fn: func(r *request.Request) {

 	var err error

@@ -34,7 +34,7 @@ var (

 //

 // Example of ChainProvider to be used with an EnvProvider and EC2RoleProvider.

 // In this example EnvProvider will first check if any credentials are available

-// vai the environment variables. If there are none ChainProvider will check

+// via the environment variables. If there are none ChainProvider will check

 // the next Provider in the list, EC2RoleProvider in this case. If EC2RoleProvider

 // does not return any credentials ChainProvider will return the error

 // ErrNoValidProvidersFoundInChain

new file mode 100644

@@ -0,0 +1,191 @@

+// Package endpointcreds provides support for retrieving credentials from an

+// arbitrary HTTP endpoint.

+//

+// The credentials endpoint Provider can receive both static and refreshable

+// credentials that will expire. Credentials are static when an "Expiration"

+// value is not provided in the endpoint's response.

+//

+// Static credentials will never expire once they have been retrieved. The format

+// of the static credentials response:

+//    {

+//        "AccessKeyId" : "MUA...",

+//        "SecretAccessKey" : "/7PC5om....",

+//    }

+//

+// Refreshable credentials will expire within the "ExpiryWindow" of the Expiration

+// value in the response. The format of the refreshable credentials response:

+//    {

+//        "AccessKeyId" : "MUA...",

+//        "SecretAccessKey" : "/7PC5om....",

+//        "Token" : "AQoDY....=",

+//        "Expiration" : "2016-02-25T06:03:31Z"

+//    }

+//

+// Errors should be returned in the following format and only returned with 400

+// or 500 HTTP status codes.

+//    {

+//        "code": "ErrorCode",

+//        "message": "Helpful error message."

+//    }

+package endpointcreds

+

+import (

+	"encoding/json"

+	"time"

+

+	"github.com/aws/aws-sdk-go/aws"

+	"github.com/aws/aws-sdk-go/aws/awserr"

+	"github.com/aws/aws-sdk-go/aws/client"

+	"github.com/aws/aws-sdk-go/aws/client/metadata"

+	"github.com/aws/aws-sdk-go/aws/credentials"

+	"github.com/aws/aws-sdk-go/aws/request"

+)

+

+// ProviderName is the name of the credentials provider.

+const ProviderName = `CredentialsEndpointProvider`

+

+// Provider satisfies the credentials.Provider interface, and is a client to

+// retrieve credentials from an arbitrary endpoint.

+type Provider struct {

+	staticCreds bool

+	credentials.Expiry

+

+	// Requires a AWS Client to make HTTP requests to the endpoint with.

+	// the Endpoint the request will be made to is provided by the aws.Config's

+	// Endpoint value.

+	Client *client.Client

+

+	// ExpiryWindow will allow the credentials to trigger refreshing prior to

+	// the credentials actually expiring. This is beneficial so race conditions

+	// with expiring credentials do not cause request to fail unexpectedly

+	// due to ExpiredTokenException exceptions.

+	//

+	// So a ExpiryWindow of 10s would cause calls to IsExpired() to return true

+	// 10 seconds before the credentials are actually expired.

+	//

+	// If ExpiryWindow is 0 or less it will be ignored.

+	ExpiryWindow time.Duration

+}

+

+// NewProviderClient returns a credentials Provider for retrieving AWS credentials

+// from arbitrary endpoint.

+func NewProviderClient(cfg aws.Config, handlers request.Handlers, endpoint string, options ...func(*Provider)) credentials.Provider {

+	p := &Provider{

+		Client: client.New(

+			cfg,

+			metadata.ClientInfo{

+				ServiceName: "CredentialsEndpoint",

+				Endpoint:    endpoint,

+			},

+			handlers,

+		),

+	}

+

+	p.Client.Handlers.Unmarshal.PushBack(unmarshalHandler)

+	p.Client.Handlers.UnmarshalError.PushBack(unmarshalError)

+	p.Client.Handlers.Validate.Clear()

+	p.Client.Handlers.Validate.PushBack(validateEndpointHandler)

+

+	for _, option := range options {

+		option(p)

+	}

+

+	return p

+}

+

+// NewCredentialsClient returns a Credentials wrapper for retrieving credentials

+// from an arbitrary endpoint concurrently. The client will request the

+func NewCredentialsClient(cfg aws.Config, handlers request.Handlers, endpoint string, options ...func(*Provider)) *credentials.Credentials {

+	return credentials.NewCredentials(NewProviderClient(cfg, handlers, endpoint, options...))

+}

+

+// IsExpired returns true if the credentials retrieved are expired, or not yet

+// retrieved.

+func (p *Provider) IsExpired() bool {

+	if p.staticCreds {

+		return false

+	}

+	return p.Expiry.IsExpired()

+}

+

+// Retrieve will attempt to request the credentials from the endpoint the Provider

+// was configured for. And error will be returned if the retrieval fails.

+func (p *Provider) Retrieve() (credentials.Value, error) {

+	resp, err := p.getCredentials()

+	if err != nil {

+		return credentials.Value{ProviderName: ProviderName},

+			awserr.New("CredentialsEndpointError", "failed to load credentials", err)

+	}

+

+	if resp.Expiration != nil {

+		p.SetExpiration(*resp.Expiration, p.ExpiryWindow)

+	} else {

+		p.staticCreds = true

+	}

+

+	return credentials.Value{

+		AccessKeyID:     resp.AccessKeyID,

+		SecretAccessKey: resp.SecretAccessKey,

+		SessionToken:    resp.Token,

+		ProviderName:    ProviderName,

+	}, nil

+}

+

+type getCredentialsOutput struct {

+	Expiration      *time.Time

+	AccessKeyID     string

+	SecretAccessKey string

+	Token           string

+}

+

+type errorOutput struct {

+	Code    string `json:"code"`

+	Message string `json:"message"`

+}

+

+func (p *Provider) getCredentials() (*getCredentialsOutput, error) {

+	op := &request.Operation{

+		Name:       "GetCredentials",

+		HTTPMethod: "GET",

+	}

+

+	out := &getCredentialsOutput{}

+	req := p.Client.NewRequest(op, nil, out)

+	req.HTTPRequest.Header.Set("Accept", "application/json")

+

+	return out, req.Send()

+}

+

+func validateEndpointHandler(r *request.Request) {

+	if len(r.ClientInfo.Endpoint) == 0 {

+		r.Error = aws.ErrMissingEndpoint

+	}

+}

+

+func unmarshalHandler(r *request.Request) {

+	defer r.HTTPResponse.Body.Close()

+

+	out := r.Data.(*getCredentialsOutput)

+	if err := json.NewDecoder(r.HTTPResponse.Body).Decode(&out); err != nil {

+		r.Error = awserr.New("SerializationError",

+			"failed to decode endpoint credentials",

+			err,

+		)

+	}

+}

+

+func unmarshalError(r *request.Request) {

+	defer r.HTTPResponse.Body.Close()

+

+	var errOut errorOutput

+	if err := json.NewDecoder(r.HTTPResponse.Body).Decode(&errOut); err != nil {

+		r.Error = awserr.New("SerializationError",

+			"failed to decode endpoint credentials",

+			err,

+		)

+	}

+

+	// Response body format is not consistent between metadata endpoints.

+	// Grab the error message as a string and include that as the source error

+	r.Error = awserr.New(errOut.Code, errOut.Message, nil)

+}

@@ -30,13 +30,22 @@ func NewStaticCredentials(id, secret, token string) *Credentials {

 	}})

 }

+// NewStaticCredentialsFromCreds returns a pointer to a new Credentials object

+// wrapping the static credentials value provide. Same as NewStaticCredentials

+// but takes the creds Value instead of individual fields

+func NewStaticCredentialsFromCreds(creds Value) *Credentials {

+	return NewCredentials(&StaticProvider{Value: creds})

+}

+

 // Retrieve returns the credentials or error if the credentials are invalid.

 func (s *StaticProvider) Retrieve() (Value, error) {

 	if s.AccessKeyID == "" || s.SecretAccessKey == "" {

 		return Value{ProviderName: StaticProviderName}, ErrStaticCredentialsEmpty

 	}

-	s.Value.ProviderName = StaticProviderName

+	if len(s.Value.ProviderName) == 0 {

+		s.Value.ProviderName = StaticProviderName

+	}

 	return s.Value, nil

 }

new file mode 100644

@@ -0,0 +1,161 @@

+// Package stscreds are credential Providers to retrieve STS AWS credentials.

+//

+// STS provides multiple ways to retrieve credentials which can be used when making

+// future AWS service API operation calls.

+package stscreds

+

+import (

+	"fmt"

+	"time"

+

+	"github.com/aws/aws-sdk-go/aws"

+	"github.com/aws/aws-sdk-go/aws/client"

+	"github.com/aws/aws-sdk-go/aws/credentials"

+	"github.com/aws/aws-sdk-go/service/sts"

+)

+

+// ProviderName provides a name of AssumeRole provider

+const ProviderName = "AssumeRoleProvider"

+

+// AssumeRoler represents the minimal subset of the STS client API used by this provider.

+type AssumeRoler interface {

+	AssumeRole(input *sts.AssumeRoleInput) (*sts.AssumeRoleOutput, error)

+}

+

+// DefaultDuration is the default amount of time in minutes that the credentials

+// will be valid for.

+var DefaultDuration = time.Duration(15) * time.Minute

+

+// AssumeRoleProvider retrieves temporary credentials from the STS service, and

+// keeps track of their expiration time. This provider must be used explicitly,

+// as it is not included in the credentials chain.

+type AssumeRoleProvider struct {

+	credentials.Expiry

+

+	// STS client to make assume role request with.

+	Client AssumeRoler

+

+	// Role to be assumed.

+	RoleARN string

+

+	// Session name, if you wish to reuse the credentials elsewhere.

+	RoleSessionName string

+

+	// Expiry duration of the STS credentials. Defaults to 15 minutes if not set.

+	Duration time.Duration

+

+	// Optional ExternalID to pass along, defaults to nil if not set.

+	ExternalID *string

+

+	// The policy plain text must be 2048 bytes or shorter. However, an internal

+	// conversion compresses it into a packed binary format with a separate limit.

+	// The PackedPolicySize response element indicates by percentage how close to

+	// the upper size limit the policy is, with 100% equaling the maximum allowed

+	// size.

+	Policy *string

+

+	// The identification number of the MFA device that is associated with the user

+	// who is making the AssumeRole call. Specify this value if the trust policy

+	// of the role being assumed includes a condition that requires MFA authentication.

+	// The value is either the serial number for a hardware device (such as GAHT12345678)

+	// or an Amazon Resource Name (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user).

+	SerialNumber *string

+

+	// The value provided by the MFA device, if the trust policy of the role being

+	// assumed requires MFA (that is, if the policy includes a condition that tests

+	// for MFA). If the role being assumed requires MFA and if the TokenCode value

+	// is missing or expired, the AssumeRole call returns an "access denied" error.

+	TokenCode *string

+

+	// ExpiryWindow will allow the credentials to trigger refreshing prior to

+	// the credentials actually expiring. This is beneficial so race conditions

+	// with expiring credentials do not cause request to fail unexpectedly

+	// due to ExpiredTokenException exceptions.

+	//

+	// So a ExpiryWindow of 10s would cause calls to IsExpired() to return true

+	// 10 seconds before the credentials are actually expired.

+	//

+	// If ExpiryWindow is 0 or less it will be ignored.

+	ExpiryWindow time.Duration

+}

+

+// NewCredentials returns a pointer to a new Credentials object wrapping the

+// AssumeRoleProvider. The credentials will expire every 15 minutes and the

+// role will be named after a nanosecond timestamp of this operation.

+//

+// Takes a Config provider to create the STS client. The ConfigProvider is

+// satisfied by the session.Session type.

+func NewCredentials(c client.ConfigProvider, roleARN string, options ...func(*AssumeRoleProvider)) *credentials.Credentials {

+	p := &AssumeRoleProvider{

+		Client:   sts.New(c),

+		RoleARN:  roleARN,

+		Duration: DefaultDuration,

+	}

+

+	for _, option := range options {

+		option(p)

+	}

+

+	return credentials.NewCredentials(p)

+}

+

+// NewCredentialsWithClient returns a pointer to a new Credentials object wrapping the

+// AssumeRoleProvider. The credentials will expire every 15 minutes and the

+// role will be named after a nanosecond timestamp of this operation.

+//

+// Takes an AssumeRoler which can be satisfiede by the STS client.

+func NewCredentialsWithClient(svc AssumeRoler, roleARN string, options ...func(*AssumeRoleProvider)) *credentials.Credentials {

+	p := &AssumeRoleProvider{

+		Client:   svc,

+		RoleARN:  roleARN,

+		Duration: DefaultDuration,

+	}

+

+	for _, option := range options {

+		option(p)

+	}

+

+	return credentials.NewCredentials(p)

+}

+

+// Retrieve generates a new set of temporary credentials using STS.

+func (p *AssumeRoleProvider) Retrieve() (credentials.Value, error) {

+

+	// Apply defaults where parameters are not set.

+	if p.RoleSessionName == "" {

+		// Try to work out a role name that will hopefully end up unique.

+		p.RoleSessionName = fmt.Sprintf("%d", time.Now().UTC().UnixNano())

+	}

+	if p.Duration == 0 {

+		// Expire as often as AWS permits.

+		p.Duration = DefaultDuration

+	}

+	input := &sts.AssumeRoleInput{

+		DurationSeconds: aws.Int64(int64(p.Duration / time.Second)),

+		RoleArn:         aws.String(p.RoleARN),

+		RoleSessionName: aws.String(p.RoleSessionName),

+		ExternalId:      p.ExternalID,

+	}

+	if p.Policy != nil {

+		input.Policy = p.Policy

+	}

+	if p.SerialNumber != nil && p.TokenCode != nil {

+		input.SerialNumber = p.SerialNumber

+		input.TokenCode = p.TokenCode

+	}

+	roleOutput, err := p.Client.AssumeRole(input)

+

+	if err != nil {

+		return credentials.Value{ProviderName: ProviderName}, err

+	}

+

+	// We will proactively generate new credentials before they expire.

+	p.SetExpiration(*roleOutput.Credentials.Expiration, p.ExpiryWindow)

+

+	return credentials.Value{

+		AccessKeyID:     *roleOutput.Credentials.AccessKeyId,

+		SecretAccessKey: *roleOutput.Credentials.SecretAccessKey,

+		SessionToken:    *roleOutput.Credentials.SessionToken,

+		ProviderName:    ProviderName,

+	}, nil

+}

@@ -8,6 +8,7 @@

 package defaults

 import (

+	"fmt"

 	"net/http"

 	"os"

 	"time"

@@ -16,6 +17,7 @@ import (

 	"github.com/aws/aws-sdk-go/aws/corehandlers"

 	"github.com/aws/aws-sdk-go/aws/credentials"

 	"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"

+	"github.com/aws/aws-sdk-go/aws/credentials/endpointcreds"

 	"github.com/aws/aws-sdk-go/aws/ec2metadata"

 	"github.com/aws/aws-sdk-go/aws/request"

 	"github.com/aws/aws-sdk-go/private/endpoints"

@@ -70,6 +72,7 @@ func Handlers() request.Handlers {

 	handlers.Build.PushBackNamed(corehandlers.SDKVersionUserAgentHandler)

 	handlers.Build.AfterEachFn = request.HandlerListStopOnError

 	handlers.Sign.PushBackNamed(corehandlers.BuildContentLengthHandler)

+	handlers.Send.PushBackNamed(corehandlers.ValidateReqSigHandler)

 	handlers.Send.PushBackNamed(corehandlers.SendHandler)

 	handlers.AfterRetry.PushBackNamed(corehandlers.AfterRetryHandler)

 	handlers.ValidateResponse.PushBackNamed(corehandlers.ValidateResponseHandler)

@@ -83,16 +86,45 @@ func Handlers() request.Handlers {

 // is available if you need to reset the credentials of an

 // existing service client or session's Config.