Table of Contents

Class AssumeRoleCredentialsProvider

Namespace
DynaSharp.Credentials
Assembly
DynaSharp.dll

Supplies temporary credentials of an IAM role, which it gets from the AssumeRole call of AWS STS with the credentials of another provider, and refreshes before they expire. This is what a profile with role_arn and source_profile or credential_source does, see ProfileCredentialsProvider; this class is the same for code.

public sealed class AssumeRoleCredentialsProvider : IRefreshableCredentialsProvider, ICredentialsProvider
Inheritance
AssumeRoleCredentialsProvider
Implements
Inherited Members

Remarks

A fetch asks the source for its credentials, signs a POST of a form with them (Signature Version 4, service sts) and sends it to https://sts.{region}.amazonaws.com/, or amazonaws.com.cn for a region whose name starts with cn-. As in botocore, AWS_STS_REGIONAL_ENDPOINTS=legacy selects the global endpoint https://sts.amazonaws.com/ for the regions that used it before regional endpoints existed, and AWS_ENDPOINT_URL_STS, then AWS_ENDPOINT_URL, go ahead of the region; StsEndpoint goes ahead of them all. The variables are read at every fetch. The region is Region, or the one a client would find, and a fetch that needs one and finds none fails.

Each request has 5 seconds. A timeout, a connection error, HTTP 429 and 5xx, the code Throttling and a successful response that is not XML are retried up to 3 attempts in total, one second apart. Any other answer is permanent and throws a CredentialsUnavailableException that names the role and the code, such as AccessDenied when the trust policy of the role does not let the source assume it. The Message of an error is left out, as in WebIdentityCredentialsProvider. A source that has no credentials fails the fetch with its own message.

The same AwsCredentials instance is returned until it is refreshed, with the windows of WebIdentityCredentialsProvider: in the background from 15 minutes before the expiration, by every caller from 10 minutes before it. Concurrent callers share one fetch. The provider is thread-safe, and it does not dispose the source.

Multi-factor authentication is not supported: a session that needs a token code (SerialNumber and TokenCode of AssumeRole) needs a person at every refresh. The requests do not go through HttpHandler, and use the default proxy of the process unless the endpoint is on a loopback address.

Constructors

AssumeRoleCredentialsProvider(ICredentialsProvider, string, string?, AssumeRoleOptions?)

Initializes a new instance of the AssumeRoleCredentialsProvider class.

public AssumeRoleCredentialsProvider(ICredentialsProvider sourceCredentials, string roleArn, string? roleSessionName = null, AssumeRoleOptions? options = null)

Parameters

sourceCredentials ICredentialsProvider

The provider of the credentials that assume the role, for example a DefaultCredentialsProvider.

roleArn string

The ARN of the role, for example arn:aws:iam::123456789012:role/orders.

roleSessionName string

The name of the session, which shows in CloudTrail: 2 to 64 letters, digits or characters of _+=,.@-. null means dynasharp- and the Unix time in seconds at each fetch.

options AssumeRoleOptions

The external id, the duration, the region and the endpoint, or null for none of them.

Exceptions

ArgumentNullException

sourceCredentials is null.

ArgumentException

roleArn is null or empty, roleSessionName breaks the rule above, the external id is empty, the duration is not a whole number of seconds, or the endpoint is not valid.

ArgumentOutOfRangeException

The duration is shorter than 15 minutes or longer than 12 hours.

Methods

GetCredentialsAsync(CancellationToken)

Gets the credentials of the role, fetching or refreshing them when needed.

public ValueTask<AwsCredentials> GetCredentialsAsync(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Stops this call from waiting. The fetch itself, which other callers may share, is not cancelled.

Returns

ValueTask<AwsCredentials>

The same AwsCredentials instance until it is refreshed.

Exceptions

CredentialsUnavailableException

The source has no credentials, the region is needed and not known, or STS does not return valid credentials. During the mandatory refresh period, the failure of a refresh is thrown as well.

OperationCanceledException

cancellationToken was cancelled.

TryInvalidate(AwsCredentials)

Drops credentials that DynamoDB rejected as expired, so that the next GetCredentialsAsync(CancellationToken) assumes the role again. A client does this by itself.

public bool TryInvalidate(AwsCredentials rejected)

Parameters

rejected AwsCredentials

The instance that was rejected. Any other than the current one has been replaced already, and is ignored.

Returns

bool

Always true: this source can be asked again.

Exceptions

ArgumentNullException

rejected is null.