Documentation
¶
Index ¶
- func NewCredentialsProvider(ctx context.Context, logger logr.Logger, awsConfig *aws.Config) (*credentialsProvider, error)
- func WithDurationSeconds(duration int32) option.Option
- func WithIdentityTokenProvider(idtp token.IdentityTokenProvider) option.Option
- func WithRoleArn(roleArn string) option.Option
- func WithRoleSessionName(sessionName string) option.Option
- func WithTracerProvider(tracerProvider trace.TracerProvider) option.Option
- type CredentialsOption
- type CredentialsProvider
- type Provider
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewCredentialsProvider ¶
func NewCredentialsProvider(ctx context.Context, logger logr.Logger, awsConfig *aws.Config) (*credentialsProvider, error)
NewCredentialsProvider creates a new instance of CredentialsProvider for AWS. It accepts an optional AWS configuration. If not provided, it will use the default configuration. The returned provider can be used to obtain AWS temporary session credentials by exchanging ID tokens using AWS's Workload Identity Federation functionality.
Parameters:
- ctx: The context for the operation
- logger: Logger for logging credential operations
- awsConfig: Optional AWS configuration. If nil, default configuration will be used.
Returns:
- A credential provider that can exchange ID tokens for AWS credentials
- An error if the provider cannot be created
func WithDurationSeconds ¶
WithDurationSeconds sets the duration in seconds for the assumed role session. The value must be between 900 (15 minutes) and 43200 (12 hours).
func WithIdentityTokenProvider ¶
func WithIdentityTokenProvider(idtp token.IdentityTokenProvider) option.Option
WithIdentityTokenProvider sets an identity token provider. This is a required option for AWS credential exchange. The identity token provider supplies the ID token that will be exchanged for AWS credentials. The provider should handle token refreshing internally if needed.
func WithRoleArn ¶
WithRoleArn sets the role ARN for assuming the role. This is a required option for AWS credential exchange. The role ARN specifies the AWS IAM role that will be assumed using the federated identity.
func WithRoleSessionName ¶
WithRoleSessionName sets the role session name. This is a required option for AWS credential exchange. The session name is used to identify the session in AWS CloudTrail logs.
func WithTracerProvider ¶ added in v0.4.0
func WithTracerProvider(tracerProvider trace.TracerProvider) option.Option
WithTracerProvider sets the OTel TracerProvider used to emit credential.fetch spans. If not set, the tracer falls back to the current span's TracerProvider (if any), then the OTel global TracerProvider.
Types ¶
type CredentialsOption ¶
type CredentialsOption interface {
Apply(*credentialsConfig)
}
Option is a function that modifies the credentialsConfig.
type CredentialsProvider ¶
type CredentialsProvider interface {
// GetCredentials exchanges an ID token for AWS temporary session credentials and returns a channel to receive them.
// The channel provides updates when credentials are refreshed or removed.
// For the first credential and each refresh, an Update event is sent.
// In case of errors, the Err field is populated, Credential is nil, and the refresh loop exits.
// When the refresh loop exits, the channel is closed.
// The tokenProvider is used to obtain the ID token for exchange.
// Options can be provided to configure the request (e.g., role ARN, session name, duration).
GetCredentials(ctx context.Context, tokenProvider token.IdentityTokenProvider, opts ...option.Option) (<-chan credential.Result, error)
}
CredentialsProvider defines the interface for obtaining AWS credentials. It exchanges ID tokens for AWS temporary session credentials using AWS's Workload Identity Federation.
Source Files