Preserve interceptor-set signer properties across auth scheme and endpoint resolution

core/aws-core/src/main/java/software/amazon/awssdk/awscore/internal/AwsExecutionContextBuilder.java

@@ -161,6 +161,9 @@ private AwsExecutionContextBuilder() {
         ExecutionInterceptorChain executionInterceptorChain =
             new ExecutionInterceptorChain(clientConfig.option(SdkClientOption.EXECUTION_INTERCEPTORS));
 
+        executionAttributes.putAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_BEFORE_INTERCEPTORS,
+                                         executionAttributes.getAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME));
+
         InterceptorContext interceptorContext = InterceptorContext.builder()
                                                                   .request(originalRequest)
                                                                   .asyncRequestBody(executionParams.getAsyncRequestBody())

core/sdk-core/src/main/java/software/amazon/awssdk/core/http/auth/AuthSchemeResolver.java

@@ -19,6 +19,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.concurrent.CompletableFuture;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
@@ -35,6 +36,7 @@
 import software.amazon.awssdk.http.auth.spi.scheme.AuthScheme;
 import software.amazon.awssdk.http.auth.spi.scheme.AuthSchemeOption;
 import software.amazon.awssdk.http.auth.spi.signer.HttpSigner;
+import software.amazon.awssdk.http.auth.spi.signer.SignerProperty;
 import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
 import software.amazon.awssdk.identity.spi.Identity;
 import software.amazon.awssdk.identity.spi.IdentityProvider;
@@ -137,9 +139,28 @@ public static <T extends Identity> SelectedAuthScheme<T> mergePreExistingAuthSch
             return selectedAuthScheme;
         }
 
+        SelectedAuthScheme<?> beforeInterceptors =
+            executionAttributes.getAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_BEFORE_INTERCEPTORS);
+
+        if (beforeInterceptors != null &&
+            beforeInterceptors.authSchemeOption() == existingAuthScheme.authSchemeOption()) {
+            return selectedAuthScheme;
+        }
+
         AuthSchemeOption.Builder mergedOption = selectedAuthScheme.authSchemeOption().toBuilder();
+
+        existingAuthScheme.authSchemeOption().forEachSignerProperty(new AuthSchemeOption.SignerPropertyConsumer() {
+            @Override
+            public <S> void accept(SignerProperty<S> key, S value) {
+                if (wasModifiedByInterceptor(beforeInterceptors, key, value)) {
+                    mergedOption.putSignerProperty(key, value);
+                } else {
+                    mergedOption.putSignerPropertyIfAbsent(key, value);
+                }
+            }
+        });
+
         existingAuthScheme.authSchemeOption().forEachIdentityProperty(mergedOption::putIdentityPropertyIfAbsent);
-        existingAuthScheme.authSchemeOption().forEachSignerProperty(mergedOption::putSignerPropertyIfAbsent);
 
         return new SelectedAuthScheme<>(
             selectedAuthScheme.identity(),
@@ -148,6 +169,57 @@ public static <T extends Identity> SelectedAuthScheme<T> mergePreExistingAuthSch
         );
     }
 
+    private static <T> boolean wasModifiedByInterceptor(SelectedAuthScheme<?> beforeInterceptors,
+                                                         SignerProperty<T> key, T currentValue) {
+        if (beforeInterceptors == null) {
+            return true;
+        }
+        T originalValue = beforeInterceptors.authSchemeOption().signerProperty(key);
+        return !Objects.equals(originalValue, currentValue);
+    }
+
+    /**
+     * Re-applies interceptor-modified signer properties onto the current auth scheme.
+     * Called after endpoint resolution, which may have overwritten properties that interceptors set.
+     */
+    public static void applyInterceptorModifiedProperties(SelectedAuthScheme<?> currentScheme,
+                                                           SelectedAuthScheme<?> beforeInterceptors,
+                                                           SelectedAuthScheme<?> afterInterceptors,
+                                                           ExecutionAttributes attrs) {
+        if (afterInterceptors == null) {
+            return;
+        }
+        doApplyInterceptorModifiedProperties(currentScheme, beforeInterceptors, afterInterceptors, attrs);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static <T extends Identity> void doApplyInterceptorModifiedProperties(
+            SelectedAuthScheme<T> currentScheme,
+            SelectedAuthScheme<?> beforeInterceptors,
+            SelectedAuthScheme<?> afterInterceptors,
+            ExecutionAttributes attrs) {
+
+        AuthSchemeOption.Builder mergedOption = currentScheme.authSchemeOption().toBuilder();
+        boolean[] changed = {false};
+
+        afterInterceptors.authSchemeOption().forEachSignerProperty(new AuthSchemeOption.SignerPropertyConsumer() {
+            @Override
+            public <S> void accept(SignerProperty<S> key, S value) {
+                if (wasModifiedByInterceptor(beforeInterceptors, key, value)) {
+                    mergedOption.putSignerProperty(key, value);
+                    changed[0] = true;
+                }
+            }
+        });
+
+        if (changed[0]) {
+            attrs.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME,
+                               new SelectedAuthScheme<>(currentScheme.identity(),
+                                                        currentScheme.signer(),
+                                                        mergedOption.build()));
+        }
+    }
+
     private static <T extends Identity> SelectedAuthScheme<T> trySelectAuthScheme(
             AuthSchemeOption authOption,
             AuthScheme<T> authScheme,

core/sdk-core/src/main/java/software/amazon/awssdk/core/interceptor/SdkInternalExecutionAttribute.java

@@ -204,6 +204,22 @@ public final class SdkInternalExecutionAttribute extends SdkExecutionAttribute {
     public static final ExecutionAttribute<SelectedAuthScheme<?>> SELECTED_AUTH_SCHEME =
         new ExecutionAttribute<>("SelectedAuthScheme");
 
+    /**
+     * Snapshot of {@link #SELECTED_AUTH_SCHEME} taken before execution interceptors run.
+     * Used by {@code AuthSchemeResolver#mergePreExistingAuthSchemeProperties} to detect which signer properties
+     * were explicitly modified by interceptors (and should therefore override the freshly-resolved values).
+     */
+    public static final ExecutionAttribute<SelectedAuthScheme<?>> AUTH_SCHEME_BEFORE_INTERCEPTORS =
+        new ExecutionAttribute<>("AuthSchemeBeforeInterceptors");
+
+    /**
+     * Snapshot of {@link #SELECTED_AUTH_SCHEME} taken after interceptors run but before auth scheme resolution.
+     * Together with {@link #AUTH_SCHEME_BEFORE_INTERCEPTORS}, this allows detecting which signer properties
+     * were explicitly modified by interceptors so they can be re-applied after endpoint resolution.
+     */
+    public static final ExecutionAttribute<SelectedAuthScheme<?>> AUTH_SCHEME_AFTER_INTERCEPTORS =
+        new ExecutionAttribute<>("AuthSchemeAfterInterceptors");
+
     /**
      * The supported compression algorithms for an operation, and whether the operation is streaming or not.
      */

core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/pipeline/stages/AuthSchemeResolutionStage.java

@@ -76,6 +76,9 @@ public SdkHttpFullRequest.Builder execute(SdkHttpFullRequest.Builder request, Re
         SelectedAuthScheme<? extends Identity> selectedAuthScheme =
             AuthSchemeResolver.selectAuthScheme(authOptions, authSchemes, identityProviders, metricCollector);
 
+        executionAttributes.putAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_AFTER_INTERCEPTORS,
+                                         executionAttributes.getAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME));
+
         selectedAuthScheme = AuthSchemeResolver.mergePreExistingAuthSchemeProperties(selectedAuthScheme, executionAttributes);
 
         executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);

core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/pipeline/stages/EndpointResolutionStage.java

@@ -22,6 +22,8 @@
 import software.amazon.awssdk.annotations.SdkInternalApi;
 import software.amazon.awssdk.core.ClientEndpointProvider;
 import software.amazon.awssdk.core.SdkRequest;
+import software.amazon.awssdk.core.SelectedAuthScheme;
+import software.amazon.awssdk.core.http.auth.AuthSchemeResolver;
 import software.amazon.awssdk.core.interceptor.ExecutionAttributes;
 import software.amazon.awssdk.core.interceptor.SdkExecutionAttribute;
 import software.amazon.awssdk.core.interceptor.SdkInternalExecutionAttribute;
@@ -70,6 +72,8 @@ public SdkHttpFullRequest.Builder execute(SdkHttpFullRequest.Builder request, Re
         Endpoint endpoint = resolver.resolve(sdkRequest, attrs);
         Duration resolveEndpointDuration = Duration.ofNanos(System.nanoTime() - resolveEndpointStart);
 
+        reapplyInterceptorModifiedAuthProperties(attrs);
+
         MetricCollector metricCollector = attrs.getAttribute(SdkExecutionAttribute.API_CALL_METRIC_COLLECTOR);
         if (metricCollector != null) {
             metricCollector.reportMetric(CoreMetric.ENDPOINT_RESOLVE_DURATION, resolveEndpointDuration);
@@ -140,4 +144,21 @@ private static String combinePath(String clientEndpointPath, String requestPath,
         String requestPathWithClientPathRemoved = StringUtils.replaceOnce(requestPath, clientEndpointPath, "");
         return SdkHttpUtils.appendUri(resolvedUriPath, requestPathWithClientPathRemoved);
     }
+
+    private static void reapplyInterceptorModifiedAuthProperties(ExecutionAttributes attrs) {
+        SelectedAuthScheme<?> currentScheme = attrs.getAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME);
+        if (currentScheme == null) {
+            return;
+        }
+        SelectedAuthScheme<?> beforeInterceptors =
+            attrs.getAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_BEFORE_INTERCEPTORS);
+
+        SelectedAuthScheme<?> afterInterceptors =
+            attrs.getAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_AFTER_INTERCEPTORS);
+        if (afterInterceptors == null) {
+            return;
+        }
+
+        AuthSchemeResolver.applyInterceptorModifiedProperties(currentScheme, beforeInterceptors, afterInterceptors, attrs);
+    }
 }

services/s3/src/test/java/software/amazon/awssdk/services/s3/ExecutionAttributeBackwardsCompatibilityTest.java

@@ -72,10 +72,7 @@ public void canSetSignerExecutionAttributes_beforeExecution() {
                  public void beforeExecution(Context.BeforeExecution context, ExecutionAttributes executionAttributes) {
                      attributeModifications.accept(executionAttributes);
                  }
-             },
-             AwsSignerExecutionAttribute.SERVICE_SIGNING_NAME, // Endpoint rules override signing name
-             AwsSignerExecutionAttribute.SIGNING_REGION, // Endpoint rules override signing region
-             AwsSignerExecutionAttribute.SIGNER_DOUBLE_URL_ENCODE); // Endpoint rules override double-url-encode
+             });
     }
 
     @Test