: MetadataCredentialsProviderBase(context, aws_cluster_manager, cluster_name,

                                      create_metadata_fetcher_cb, refresh_state,

                                      initialization_timer),

      role_arn_(web_identity_config.role_arn()),

      role_session_name_(web_identity_config.role_session_name()) {

  auto provider_or_error_ = Config::DataSource::DataSourceProvider<std::string>::create(

      web_identity_config.web_identity_token_data_source(), context.mainThreadDispatcher(),

      context.threadLocal(), context.api(), false,

      [](absl::string_view data) { return std::make_shared<std::string>(data); }, 4096);

  if (provider_or_error_.ok()) {

    web_identity_data_source_provider_ = std::move(provider_or_error_.value());

  } else {

    ENVOY_LOG(info, "Invalid web identity data source");

    web_identity_data_source_provider_.reset();

  }

}

void WebIdentityCredentialsProvider::refresh() {

  absl::string_view web_identity_data;

  if (!web_identity_data_source_provider_.has_value() ||

      web_identity_data_source_provider_.value()->data() == nullptr) {

    return;

  }

  ENVOY_LOG(debug, "Getting AWS web identity credentials from STS: {}",

            aws_cluster_manager_->getUriFromClusterName(cluster_name_).value());

  web_identity_data = *web_identity_data_source_provider_.value()->data();

  Http::RequestMessageImpl message;

  message.headers().setScheme(Http::Headers::get().SchemeValues.Https);

  message.headers().setMethod(Http::Headers::get().MethodValues.Get);

  auto statusOr = aws_cluster_manager_->getUriFromClusterName(cluster_name_);

  message.headers().setHost(Http::Utility::parseAuthority(statusOr.value()).host_);

  message.headers().setPath(

      fmt::format("/?Action=AssumeRoleWithWebIdentity"

                  "&Version=2011-06-15"

                  "&RoleSessionName={}"

                  "&RoleArn={}"

                  "&WebIdentityToken={}",

                  Envoy::Http::Utility::PercentEncoding::encode(role_session_name_),

                  Envoy::Http::Utility::PercentEncoding::encode(role_arn_),

                  Envoy::Http::Utility::PercentEncoding::encode(web_identity_data)));

  message.headers().setReference(Http::CustomHeaders::get().Accept,

                                 Http::Headers::get().ContentTypeValues.Json);

  if (!metadata_fetcher_) {

    metadata_fetcher_ = create_metadata_fetcher_cb_(context_.clusterManager(), clusterName());

  } else {

    metadata_fetcher_->cancel(); // Cancel if there is any inflight request.

  }

  on_async_fetch_cb_ = [this](const std::string&& arg) {

    return this->extractCredentials(std::move(arg));

  };

  credentials_pending_.store(true);

  metadata_fetcher_->fetch(message, Tracing::NullSpan::instance(), *this);

}

    const std::string&& credential_document_value) {

  absl::StatusOr<Json::ObjectSharedPtr> document_json_or_error;

  document_json_or_error = Json::Factory::loadFromString(credential_document_value);

  if (!document_json_or_error.ok()) {

    ENVOY_LOG(error, "Could not parse AWS credentials document from STS: {}",

              document_json_or_error.status().message());

    credentialsRetrievalError();

    return;

  }

  absl::StatusOr<Json::ObjectSharedPtr> root_node =

      document_json_or_error.value()->getObject(WEB_IDENTITY_RESPONSE_ELEMENT);

  if (!root_node.ok()) {

    ENVOY_LOG(error, "AWS STS credentials document is empty");

    credentialsRetrievalError();

    return;

  }

  absl::StatusOr<Json::ObjectSharedPtr> result_node =

      root_node.value()->getObject(WEB_IDENTITY_RESULT_ELEMENT);

  if (!result_node.ok()) {

    ENVOY_LOG(error, "AWS STS returned an unexpected result");

    credentialsRetrievalError();

    return;

  }

  absl::StatusOr<Json::ObjectSharedPtr> credentials = result_node.value()->getObject(CREDENTIALS);

  if (!credentials.ok()) {

    ENVOY_LOG(error, "AWS STS credentials document does not contain any credentials");

    credentialsRetrievalError();

    return;

  }

  const auto access_key_id =

      Utility::getStringFromJsonOrDefault(credentials.value(), ACCESS_KEY_ID, "");

  const auto secret_access_key =

      Utility::getStringFromJsonOrDefault(credentials.value(), SECRET_ACCESS_KEY, "");

  const auto session_token =

      Utility::getStringFromJsonOrDefault(credentials.value(), SESSION_TOKEN, "");

  if (access_key_id.empty() || secret_access_key.empty() || session_token.empty()) {

    ENVOY_LOG(error, "Bad format, could not parse AWS credentials document from STS");

    credentialsRetrievalError();

    return;

  }

  ENVOY_LOG(debug, "Received the following AWS credentials from STS: {}={}, {}={}, {}={}",

            AWS_ACCESS_KEY_ID, access_key_id, AWS_SECRET_ACCESS_KEY,

            secret_access_key.empty() ? "" : "*****", AWS_SESSION_TOKEN,

            session_token.empty() ? "" : "*****");

  setCredentialsToAllThreads(

      std::make_unique<Credentials>(access_key_id, secret_access_key, session_token));

  stats_->credential_refreshes_succeeded_.inc();

  ENVOY_LOG(debug, "Metadata receiver {} moving to Ready state", cluster_name_);

  refresh_state_ = MetadataFetcher::MetadataReceiver::RefreshState::Ready;

  stats_->metadata_refresh_state_.set(uint64_t(refresh_state_));

  const auto expiration = Utility::getIntegerFromJsonOrDefault(credentials.value(), EXPIRATION, 0);

  if (expiration != 0) {

    expiration_time_ =

        std::chrono::time_point<std::chrono::system_clock>(std::chrono::seconds(expiration));

    ENVOY_LOG(debug, "AWS STS credentials expiration time (unix timestamp): {}", expiration);

  } else {

    expiration_time_.reset();

  }

  last_updated_ = context_.api().timeSource().systemTime();

  handleFetchDone();

}

void WebIdentityCredentialsProvider::onMetadataSuccess(const std::string&& body) {

  ENVOY_LOG(debug, "AWS metadata fetch from STS success, calling callback func");

  on_async_fetch_cb_(std::move(body));

}

void WebIdentityCredentialsProvider::onMetadataError(Failure reason) {

  ENVOY_LOG(error, "AWS metadata fetch failure: {}", metadata_fetcher_->failureToString(reason));

  credentialsRetrievalError();

}