chore: Ensure the subject token type matches AWS before building AwsC…

…redentials

lib/googleauth/external_account.rb

@@ -23,6 +23,9 @@ module Auth
     # Authenticates requests using External Account credentials, such
     # as those provided by the AWS provider.
     class ExternalAccountCredentials
+      # The subject token type used for AWS external_account credentials.
+      AWS_SUBJECT_TOKEN_TYPE = "urn:ietf:params:aws:token-type:aws4_request"
+
       attr_reader :project_id
       attr_reader :quota_project_id
 
@@ -36,6 +39,7 @@ def self.make_creds options = {}
         raise "a json file is required for external account credentials" unless json_key_io
         user_creds = read_json_key json_key_io
 
+        raise "aws is the only currently supported external account type" unless user_creds["subject_token_type"] == AWS_SUBJECT_TOKEN_TYPE
         Google::Auth::ExternalAccount::AwsCredentials.new(
           audience: user_creds["audience"],
           scope: scope,