Table of Contents

Class DefaultCredentialsProvider

Namespace
DynaSharp.Credentials
Assembly
DynaSharp.dll

Finds credentials the way the AWS SDKs do, trying these sources in order and using the first that has credentials:

  1. the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN (EnvironmentCredentialsProvider);
  2. the web identity token file named by AWS_WEB_IDENTITY_TOKEN_FILE, which IAM roles for service accounts on EKS use (WebIdentityCredentialsProvider);
  3. the profile in the shared credentials and config files (ProfileCredentialsProvider);
  4. the container credentials endpoint of Amazon ECS and EKS (ContainerCredentialsProvider);
  5. the instance metadata service of Amazon EC2 (InstanceMetadataCredentialsProvider).

This is what a DynamoDbClient uses when Credentials is not set.

public sealed class DefaultCredentialsProvider : IRefreshableCredentialsProvider, ICredentialsProvider
Inheritance
DefaultCredentialsProvider
Implements
Inherited Members

Remarks

Nothing is looked up when the provider is created. The first call to GetCredentialsAsync(CancellationToken) walks the sources in order and remembers the one that answered; every later call goes straight to it. The choice is logged once, at debug level. A source that does not apply is skipped: an unset variable, a missing file, a missing default profile, a profile without an access key, a disabled or unreachable metadata service. The sources are not mixed, and a source is never asked again once another one was chosen.

A source that applies but is broken is not skipped. Its CredentialsUnavailableException ends the walk, because moving on would sign requests as a different principal than the one the configuration asks for. This covers a partial environment (an access key without a secret), a token file without a role or one that STS does not accept, a profile named by AWS_PROFILE that does not exist, a malformed shared file, a profile that needs a feature DynaSharp does not support (login_session, mfa_serial), a profile whose credential_process, role, web identity or SSO fails, and a container endpoint that is configured and fails in any way: an error status, a malformed response, missing fields, a timeout, or credentials that are already expired. Setting AWS_PROFILE does not turn the environment variables off, as in the AWS SDKs: the variables are tried first.

If no source has credentials, the call throws a CredentialsUnavailableException that lists what was tried and why each source did not apply. That failure is not cached, so a later call walks the sources again, which includes a request to the metadata service of up to two seconds.

A web identity token file comes before the shared files, the container endpoint and the metadata service, as in botocore, and it asks STS in the region of the DynamoDbClient that made this provider. A provider that the application creates finds the region as a client would, from AWS_REGION, AWS_DEFAULT_REGION and the profile, and fails at the token file if there is none. A profile that assumes a role or federates a web identity asks STS in that region too.

The provider is thread-safe. The temporary credentials of web identity, a role, SSO or a credential_process of a profile, the container endpoint and the metadata service are refreshed before they expire, see those providers, and are fetched again if DynamoDB rejects them as expired (TryInvalidate(AwsCredentials)). Failed refreshes are logged as warnings by the logger factory that the DynamoDbClient was given.

Constructors

DefaultCredentialsProvider()

Initializes a new instance of the DefaultCredentialsProvider class that reads the environment and the files of the current process, uses the system clock and does not log.

public DefaultCredentialsProvider()

Methods

GetCredentialsAsync(CancellationToken)

Gets the credentials of the first source that has some.

public ValueTask<AwsCredentials> GetCredentialsAsync(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Cancels a pending lookup, for example a request to the metadata service.

Returns

ValueTask<AwsCredentials>

The credentials, the same instance as long as the source keeps them.

Exceptions

CredentialsUnavailableException

No source has credentials (the message lists them), or a source that applies is broken (the message says how).

OperationCanceledException

cancellationToken was cancelled.

TryInvalidate(AwsCredentials)

Drops credentials that DynamoDB rejected as expired, if the chosen source can fetch new ones. A client does this by itself.

public bool TryInvalidate(AwsCredentials rejected)

Parameters

rejected AwsCredentials

The instance that was rejected. Any other than the current one has been replaced already, and is ignored.

Returns

bool

true if the chosen source is one that can be asked again: the environment with AWS_CREDENTIAL_EXPIRATION, web identity, a profile with a role, web identity, SSO or a credential_process, the container endpoint or the metadata service. false if it holds keys that were read once, from the environment or a profile, or if no source was chosen yet. The chain never moves on to another source for this.

Exceptions

ArgumentNullException

rejected is null.