Documentation
¶
Overview ¶
Package credentialprocess produces AWS process-credential documents for Atmos identities.
It backs `atmos aws credential-process` and `atmos auth env --format=credential-process`, so both entry points emit byte-identical output. The document follows the AWS SDK `credential_process` contract: https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html.
Index ¶
- Constants
- func FormatMinValidity(d time.Duration) string
- func ParseMinValidity(value string) (time.Duration, error)
- func Produce(ctx context.Context, mgr types.AuthManager, identityName string, ...) ([]byte, error)
- func Render(doc []byte) string
- func ResolveIdentity(mgr types.AuthManager, identityName string) (string, error)
- func WriteFile(path string, doc []byte) (err error)
- type Option
Constants ¶
const ( // DefaultMinValidity is the default remaining lifetime cached credentials must have to be // reused without authenticating again. The AWS CLI runs credential_process once per invocation, // so reusing credentials that are still valid for a while keeps every `aws` command fast. // It is the same validity buffer the auth manager applies to its credential chain. DefaultMinValidity = types.DefaultMinCredentialValidity // MinValidityFlagName is the name of the flag that sets the minimum remaining credential lifetime. MinValidityFlagName = "min-validity" // MinValidityEnvVar is the environment variable equivalent of the --min-validity flag. MinValidityEnvVar = "ATMOS_AWS_CREDENTIAL_PROCESS_MIN_VALIDITY" )
Variables ¶
This section is empty.
Functions ¶
func FormatMinValidity ¶
FormatMinValidity formats a minimum validity for display, for example 15m rather than 15m0s.
func ParseMinValidity ¶
ParseMinValidity parses a --min-validity value. Negative durations are rejected.
func Produce ¶
func Produce(ctx context.Context, mgr types.AuthManager, identityName string, opts ...Option) ([]byte, error)
Produce returns the AWS process-credential JSON document for the identity.
Cached temporary credentials are used when they expire after now plus the minimum validity, which requires no network call. Otherwise the identity is authenticated the same way `atmos auth login` would, and standalone identities that keep their own cache refresh it when it does not satisfy the minimum validity. When the source still issues credentials that expire sooner than requested (for example a helper that only mints 20 minute credentials), those credentials are returned as-is: the command neither loops nor fails. Cached credentials without an expiration are never printed directly: for an IAM user they are the long-lived access keys, and authenticating exchanges them for a session (honoring MFA) instead of handing the keys to the caller. Auto-triggered integrations (for example kubeconfig or ECR login) are skipped because this runs as a non-interactive helper.
func Render ¶
Render returns the document as written to stdout or a file: the JSON followed by a newline. Every entry point uses it so their output is byte-identical.
func ResolveIdentity ¶
func ResolveIdentity(mgr types.AuthManager, identityName string) (string, error)
ResolveIdentity resolves the identity to produce credentials for. A concrete name is returned as-is and an empty name falls back to the configured default identity.
It never opens the interactive identity selector: the AWS CLI captures this command's stderr, so a prompt would be invisible and the `aws` command would hang forever. Both the disabled sentinel (--identity=false) and the select sentinel (--identity without a value) are therefore rejected, and a missing default fails fast even when stdin is a terminal.
func WriteFile ¶
WriteFile writes the rendered document to path, replacing any existing content. The file holds secrets, so it is never readable by anyone but the owner, not even briefly: the content goes to a temporary file created with mode 0600 in the same directory, which then atomically replaces the target. An existing file with looser permissions therefore never holds the secrets.
Types ¶
type Option ¶
type Option func(*options)
Option configures Produce.
func WithClock ¶
WithClock overrides the clock used to evaluate credential expiration (used by tests).
func WithMinValidity ¶
WithMinValidity sets how long cached credentials must remain valid to be reused. A zero or negative value reuses any credentials that are not yet expired.
Source Files