Dependency on deprecated Penlight XML (pl.xml) module

[flrgh]

This module brings in pl.xml in order to parse an XML response from an STS call.

Since it's only this one code path, I wonder if we can just drop the XML parse operation instead of trying to find another suitable XML library. It's been so long since I've played with any of the AWS APIs directly though, and it's a tough one to google for--any idea if the STS API is capable of returning a json response?

[Tieske]

I doubt STS is the only XML one. Have you checked the SDK metadata for XML based ones?

Penlight XML is end-of-life though, so maybe we should replace it with proper XML, eg. LuaExpat?

[flrgh]

I doubt STS is the only XML one.

I was actually very surprised to find this one credential handler was the only user of pl.xml within ./src. There is some code in resty.aws.request.build that serializes a request to XML, but it does not use any dependencies to do so. There is a lot of magic/code-gen happening in here though, so there could be something else that's just not very git grep-able.

[StarlightIbuki]

Could we simply extract it with regex or even Lua string-matching function?

[windmgc]

any idea if the STS API is capable of returning a json response?

Actually, it could, like this:
https://github.com/aws/aws-sdk-go/blob/d9ed7d6c12b09f718a2283c59a631fa91765e58e/aws/credentials/endpointcreds/provider.go#L166

We need to specify the Accept Header when sending requests

❯ curl -H 'Accept: application/json' -L 'https://sts.amazonaws.com/?Action=AssumeRoleWithWebIdentity&Version=2011-06-15'
{"Error":{"Code":"ValidationError","Message":"3 validation errors detected: Value null at 'roleArn' failed to satisfy constraint: Member must not be null; Value null at 'roleSessionName' failed to satisfy constraint: Member must not be null; Value at 'webIdentityToken' failed to satisfy constraint: Member must not be null","Type":"Sender"},"RequestId":"bf558395-7f75-4472-8a70-3174b6bec85a"}%

[Tieske]

Did a check on the resty.aws.raw-api folder, and there seem to be plenty of files there referencing xml. So just updating the sts to include an accept header is probably not enough.

From Kong 3.1, we'll have luaexpat available. So maybe wait for the release and then switch to that.

[Tieske]

should we start revisiting this?