stscreds

Documentation

Overview

Package stscreds are credential Providers to retrieve STS AWS credentials.

STS provides multiple ways to retrieve credentials which can be used when making future AWS service API operation calls.

Index

• Constants
• Variables
• func NewCredentials(c client.ConfigProvider, roleARN string, options ...func(*AssumeRoleProvider)) *credentials.Credentials
• func NewCredentialsWithClient(svc AssumeRoler, roleARN string, options ...func(*AssumeRoleProvider)) *credentials.Credentials
• type AssumeRoleProvider
  • func (p *AssumeRoleProvider) Retrieve() (credentials.Value, error)
• type AssumeRoler

Constants

const ProviderName = "AssumeRoleProvider"

ProviderName provides a name of AssumeRole provider

Variables

var DefaultDuration = time.Duration(15) * time.Minute

DefaultDuration is the default amount of time in minutes that the credentials will be valid for.

Functions

func NewCredentials

func NewCredentials(c client.ConfigProvider, roleARN string, options ...func(*AssumeRoleProvider)) *credentials.Credentials

NewCredentials returns a pointer to a new Credentials object wrapping the AssumeRoleProvider. The credentials will expire every 15 minutes and the role will be named after a nanosecond timestamp of this operation.

Takes a Config provider to create the STS client. The ConfigProvider is satisfied by the session.Session type.

func NewCredentialsWithClient

func NewCredentialsWithClient(svc AssumeRoler, roleARN string, options ...func(*AssumeRoleProvider)) *credentials.Credentials

NewCredentialsWithClient returns a pointer to a new Credentials object wrapping the AssumeRoleProvider. The credentials will expire every 15 minutes and the role will be named after a nanosecond timestamp of this operation.

Takes an AssumeRoler which can be satisfiede by the STS client.

Types

type AssumeRoleProvider

type AssumeRoleProvider struct {
	credentials.Expiry

	// STS client to make assume role request with.
	Client AssumeRoler

	// Role to be assumed.
	RoleARN string

	// Session name, if you wish to reuse the credentials elsewhere.
	RoleSessionName string

	// Expiry duration of the STS credentials. Defaults to 15 minutes if not set.
	Duration time.Duration

	// Optional ExternalID to pass along, defaults to nil if not set.
	ExternalID *string

	// ExpiryWindow will allow the credentials to trigger refreshing prior to
	// the credentials actually expiring. This is beneficial so race conditions
	// with expiring credentials do not cause request to fail unexpectedly
	// due to ExpiredTokenException exceptions.
	//
	// So a ExpiryWindow of 10s would cause calls to IsExpired() to return true
	// 10 seconds before the credentials are actually expired.
	//
	// If ExpiryWindow is 0 or less it will be ignored.
	ExpiryWindow time.Duration
}

AssumeRoleProvider retrieves temporary credentials from the STS service, and keeps track of their expiration time. This provider must be used explicitly, as it is not included in the credentials chain.

func (*AssumeRoleProvider) Retrieve

func (p *AssumeRoleProvider) Retrieve() (credentials.Value, error)

Retrieve generates a new set of temporary credentials using STS.

type AssumeRoler

type AssumeRoler interface {
	AssumeRole(input *sts.AssumeRoleInput) (*sts.AssumeRoleOutput, error)
}

AssumeRoler represents the minimal subset of the STS client API used by this provider.