View Source Dynamo.Credentials (Dynamo v0.2.0)

AWS credential resolution.

Resolution order (first match wins):

  1. Static credentials passed in repo config (access_key_id / secret_access_key / session_token)
  2. Environment: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
  3. ECS/Fargate container credentials (AWS_CONTAINER_CREDENTIALS_FULL_URI or _RELATIVE_URI)
  4. EC2 instance metadata (IMDSv2)

Credentials from metadata endpoints carry an expiry; Dynamo.Credentials.Cache (owned by the repo supervisor) refreshes them a few minutes before they expire and guarantees only one refresh happens at a time.

Summary

Types

t()

Functions

resolve(opts \\ [])

Resolve credentials once, without caching.

stale?(credentials)

True when the credentials need refreshing (expiry within the buffer).

Types

t()

@type t() :: %Dynamo.Credentials{
  access_key_id: String.t(),
  expires_at: DateTime.t() | nil,
  secret_access_key: String.t(),
  session_token: String.t() | nil
}

Functions

resolve(opts \\ [])

@spec resolve(keyword()) :: {:ok, t()} | {:error, Dynamo.Error.t()}

Resolve credentials once, without caching.

Options: :access_key_id/:secret_access_key/:session_token (static), :disable_imds, :req_options (merged into metadata HTTP calls – e.g. a plug: in tests), and for tests :env (map used instead of System.get_env/1), :ecs_host, :imds_base.

stale?(credentials)

@spec stale?(t()) :: boolean()

True when the credentials need refreshing (expiry within the buffer).