module AWS::Credentials
AWS credentials: access keys (Keys), and the providers that find
them, as the SDKs do (Credentials.default).
creds = AWS::Credentials.static(access_key_id: "AKIDEXAMPLE", secret_access_key: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY")
creds.get.access_key_id # => "AKIDEXAMPLE"
creds.get.inspect # => "#<AWS::Credentials::Keys AKIDEXAMPLE>"
/home/runner/work/aws/aws/src/credentials.qz:32
Classes and modules
AWS::Credentials::KeysAccess keys: an access key id and its secret, with a session token and an expiry for temporary ones. inspect and to_s show the access key id and the expiry only: never the secret nor the token.AWS::Credentials::ProviderA source of keys: get gives them, or raises CredentialsError. Providers are Shareable: one can be kept in a constant and used from any task.
Constants
REFRESH_MARGIN: Duration
Temporary keys are refreshed this long before they expire.
Class methods
def self.static(*, access_key_id: String, secret_access_key: String, session_token: String? = …) -> AWS::Credentials::Provider
Keys given in the program.
def self.env(env: Hash[String, String] = …) -> AWS::Credentials::Provider
The keys of the environment: AWS_ACCESS_KEY_ID,
AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN (env is ENV
unless a test gives another).
def self.profile(name: String? = …, *, env: Hash[String, String] = …, http: HTTP::Client = …) -> AWS::Credentials::Provider
The keys of profile name in the shared files: ~/.aws/credentials
(AWS_SHARED_CREDENTIALS_FILE) and ~/.aws/config
(AWS_CONFIG_FILE, its sections [profile name]), the first one's
settings winning. A profile with role_arn and source_profile is
the role's temporary keys, from STS AssumeRole signed with the
source profile's own keys (one level), cached and refreshed; with
credential_source instead (Environment, Ec2InstanceMetadata,
EcsContainer), signed with the keys of env, instance or
container (their settings from env); with both, ProfileError
(they are mutually exclusive, as in the SDKs). A named
profile, or one with role_arn, that cannot give keys raises
ProfileError (ProfileNotFound when neither file has it).
def self.container(*, env: Hash[String, String] = …, base: String = …, http: HTTP::Client = …) -> AWS::Credentials::Provider
The keys of an ECS task or an EKS Pod Identity: from
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI (against base,
http://169.254.170.2, which tests replace) or
AWS_CONTAINER_CREDENTIALS_FULL_URI (https on any host, http only on
loopback, 169.254.170.2 or fd00:ec2::23), with
AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE (read each time) or
AWS_CONTAINER_AUTHORIZATION_TOKEN as the Authorization header.
Cached and refreshed.
def self.instance(*, env: Hash[String, String] = …, base: String? = …, http: HTTP::Client = …) -> AWS::Credentials::Provider
The keys of an EC2 instance's role, from its metadata service
(IMDSv2: a token PUT, then the role's name and keys), at base
(AWS_EC2_METADATA_SERVICE_ENDPOINT, else
http://169.254.169.254; tests replace it); none when
AWS_EC2_METADATA_DISABLED is true. One attempt with 1-second
timeouts, so that a chain off EC2 moves on. Cached and refreshed.
def self.web_identity(*, env: Hash[String, String] = …, endpoint: String? = …, http: HTTP::Client = …) -> AWS::Credentials::Provider
The keys of a role assumed with a web identity token (EKS IRSA,
GitHub Actions' OIDC): STS AssumeRoleWithWebIdentity, unsigned,
with the token of AWS_WEB_IDENTITY_TOKEN_FILE (read at each
refresh), AWS_ROLE_ARN and AWS_ROLE_SESSION_NAME; STS's regional
endpoint for AWS_REGION/AWS_DEFAULT_REGION (the global one
without), or endpoint. Cached and refreshed.
def self.chain(providers: Array[AWS::Credentials::Provider]) -> AWS::Credentials::Provider
The first of providers that answers, tried in order; raises
CredentialsError naming what each said when none does. Once one has
answered, it is the chain's: its later failure is the chain's error,
not other keys (of another identity). A ProfileError stops it.
def self.default(env: Hash[String, String] = …) -> AWS::Credentials::Provider
The SDKs' chain: env, web_identity, profile, container,
instance.