# `Ankusa.AWS.Credentials`
[🔗](https://github.com/jamescarr/ankusa/blob/ankusa-v0.7.0/packages/ankusa/lib/ankusa/aws/credentials.ex#L1)

Where `Ankusa.BlobStore.S3` and `Ankusa.Sink.SQS` get the credentials they
sign with, in the order the AWS SDKs look:

  1. `opts`: `:access_key_id` and `:secret_access_key` (plus an optional
     `:session_token`).
  2. The environment: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and
     `AWS_SESSION_TOKEN` when set.
  3. Web identity (EKS IRSA and similar): `AWS_WEB_IDENTITY_TOKEN_FILE` and
     `AWS_ROLE_ARN` (`AWS_ROLE_SESSION_NAME` optional) exchanged at STS
     (`AssumeRoleWithWebIdentity`, an unsigned call).
  4. The EC2 instance metadata service, IMDSv2 (a session token, then the
     instance role's credentials), with a 1 s connect timeout so a node off
     EC2 falls through quickly.

Temporary credentials (3 and 4) are cached per source in a public ETS table
until 5 minutes before they expire. Nothing here raises: no source at all is
`{:error, :no_credentials}`, which the caller returns like any failed
request.

The STS and IMDS endpoints can be overridden with `:sts_endpoint` and
`:imds_endpoint`, and the environment with `:env` (a map), for tests.

# `t`

```elixir
@type t() :: %{
  access_key_id: String.t(),
  secret_access_key: String.t(),
  session_token: String.t() | nil
}
```

# `get`

```elixir
@spec get(keyword()) :: {:ok, t()} | {:error, :no_credentials | term()}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*