Documentation
¶
Overview ¶
Package awssts answers one question: which AWS account is this credential in.
ONE CALL, AND IT EXISTS FOR A REFUSAL. `billet acceptance` stands up a deployment that launches real compute and then destroys everything it finds belonging to itself, and the instruction an operator gives it is "do that in account N". Without asking, "account N" is a comment: the command would run against whatever credential happened to be in the environment, which on a developer's machine is routinely the wrong one.
A LEAF BESIDE internal/awssig, for the reason internal/awsquota is one: the provider packages are siblings that may not import each other, and this is not a compute backend at all.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoAccount = errors.New("awssts: the response carried no account id")
ErrNoAccount is what a caller gets when the response carried no account.
SEPARATE FROM A TRANSPORT FAILURE, because the two mean opposite things to a refusal: "I could not ask" must never read as "the account does not match".
Functions ¶
func Endpoint ¶
Endpoint returns the STS endpoint and signing region for an AWS region.
REGIONAL RATHER THAN GLOBAL, deliberately. The global endpoint (sts.amazonaws.com) exists and works, and using it would mean a GovCloud or China credential signing against a host in the commercial partition — which fails, and fails with an authentication error rather than anything that names the partition. A regional endpoint is derived from the region billet was already told to use.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client calls GetCallerIdentity.
type Identity ¶
type Identity struct {
// Account is the twelve-digit account id — the only field billet compares.
Account string
// ARN and UserID are reported, never matched. An acceptance run prints them
// so a person reading a log can see WHICH principal did the work, which is
// the question that follows "was it the right account".
ARN string
UserID string
}
Identity is who a credential belongs to.
Source Files