Class ContainerCredentialsProvider

Namespace

DynaSharp.Credentials

Assembly

DynaSharp.dll

Supplies temporary credentials from the container credentials endpoint of Amazon ECS (task roles) and Amazon EKS (Pod Identity), and refreshes them before they expire.

public sealed class ContainerCredentialsProvider : IRefreshableCredentialsProvider, ICredentialsProvider

Inheritance

object

ContainerCredentialsProvider

Implements

IRefreshableCredentialsProvider

ICredentialsProvider

Inherited Members

object.GetType()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Remarks

The provider applies when AWS_CONTAINER_CREDENTIALS_RELATIVE_URI or AWS_CONTAINER_CREDENTIALS_FULL_URI is set and not empty; otherwise GetCredentialsAsync(CancellationToken) throws a CredentialsUnavailableException that says so (the default chain then moves on). The relative URI is appended to http://169.254.170.2 and wins if both are set. The full URI must be an absolute URL without user info; over http its host must be a loopback address or one of the container endpoint addresses 169.254.170.2, 169.254.170.23 and fd00:ec2::23 (or localhost), https accepts any host. This is the rule of botocore.

The authorization token, if any, is sent as the Authorization header. It comes from the file named by AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, which wins, or else from AWS_CONTAINER_AUTHORIZATION_TOKEN. The file is read again for every fetch, because EKS rotates it; leading and trailing whitespace is removed. A token with line breaks is rejected.

A fetch is a GET that must answer 200 with a JSON object that has AccessKeyId, SecretAccessKey, Token and Expiration. Each attempt has 2 seconds; a timeout, a connection error, another HTTP status and a body that is not JSON are retried up to 3 attempts in total, one second apart. If all fail, or the configuration is wrong (the URI, the token file), or the response lacks a field or holds credentials that are already expired, the call throws a CredentialsUnavailableException. Once the endpoint is configured, the default chain never goes on to another source, so a pod never signs with the instance role of its node. Redirects, proxies and cookies are not used.

The same AwsCredentials instance is returned until it is refreshed. Refreshing starts 15 minutes before the expiration. In that advisory period the fetch runs in the background and every caller keeps the current credentials, so a slow source delays no request; if the fetch fails a warning is logged and it is tried again after 30 seconds. From 10 minutes before the expiration every caller waits for the fetch, and a failure is thrown. If DynamoDB rejects the credentials as expired before that, a client drops them with TryInvalidate(AwsCredentials) and the next call fetches. Concurrent callers share one fetch, which a caller's cancellation does not cancel. The provider is thread-safe.

Only the endpoint settings are read from the environment, at every fetch. Of the URI, messages and logs show the host alone, because the rest of the URI of ECS contains a credential identifier and the host is no secret. The token never appears.

Constructors

ContainerCredentialsProvider()

Initializes a new instance of the ContainerCredentialsProvider class that reads the environment of the current process and uses the system clock.

public ContainerCredentialsProvider()

Methods

GetCredentialsAsync(CancellationToken)

Gets the credentials, fetching or refreshing them when needed.

public ValueTask<AwsCredentials> GetCredentialsAsync(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Stops this call from waiting. The fetch itself, which other callers may share, is not cancelled.

Returns

ValueTask<AwsCredentials>

The same AwsCredentials instance until it is refreshed.

Exceptions

CredentialsUnavailableException

Neither AWS_CONTAINER_CREDENTIALS_RELATIVE_URI nor AWS_CONTAINER_CREDENTIALS_FULL_URI is set; the configuration is invalid; or the endpoint does not return valid credentials. During the mandatory refresh period, the failure of a refresh is thrown as well.

OperationCanceledException

cancellationToken was cancelled.

TryInvalidate(AwsCredentials)

Drops credentials that DynamoDB rejected as expired, so that the next GetCredentialsAsync(CancellationToken) fetches new ones. A client does this by itself.

public bool TryInvalidate(AwsCredentials rejected)

Parameters

rejected AwsCredentials

The instance that was rejected. Any other than the current one has been replaced already, and is ignored.

Returns

bool

Always true: this source can be asked again.

Exceptions

ArgumentNullException

rejected is null.