Ankusa.AWS.Credentials (ankusa v0.7.0)

Where Ankusa.BlobStore.S3 and Ankusa.Sink.SQS get the credentials they sign with, in the order the AWS SDKs look:

opts: :access_key_id and :secret_access_key (plus an optional :session_token).
The environment: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN when set.
Web identity (EKS IRSA and similar): AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN (AWS_ROLE_SESSION_NAME optional) exchanged at STS (AssumeRoleWithWebIdentity, an unsigned call).
The EC2 instance metadata service, IMDSv2 (a session token, then the instance role's credentials), with a 1 s connect timeout so a node off EC2 falls through quickly.

Temporary credentials (3 and 4) are cached per source in a public ETS table until 5 minutes before they expire. Nothing here raises: no source at all is {:error, :no_credentials}, which the caller returns like any failed request.

The STS and IMDS endpoints can be overridden with :sts_endpoint and :imds_endpoint, and the environment with :env (a map), for tests.

Summary

Types

t()

Functions

get(opts)

Types

t()

@type t() :: %{
  access_key_id: String.t(),
  secret_access_key: String.t(),
  session_token: String.t() | nil
}

Functions

get(opts)

@spec get(keyword()) :: {:ok, t()} | {:error, :no_credentials | term()}