Class EnvironmentCredentialsProvider

Namespace

DynaSharp.Credentials

Assembly

DynaSharp.dll

Supplies credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and, for temporary credentials, AWS_SESSION_TOKEN and AWS_CREDENTIAL_EXPIRATION environment variables.

public sealed class EnvironmentCredentialsProvider : IRefreshableCredentialsProvider, ICredentialsProvider

Inheritance

object

EnvironmentCredentialsProvider

Implements

IRefreshableCredentialsProvider

ICredentialsProvider

Inherited Members

object.GetType()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Remarks

The variables are read on first use, and the resulting AwsCredentials instance is returned by every later call. Without AWS_CREDENTIAL_EXPIRATION the credentials never expire and the variables are not read again, which also keeps the signer's key cache effective. The provider is thread-safe: concurrent first calls all receive the same instance.

With AWS_CREDENTIAL_EXPIRATION, an ISO 8601 time such as 2026-11-03T12:00:00Z that tools like aws configure export-credentials --format env write, the credentials carry that expiration, as in botocore. The variables are read again from 15 minutes before it, and every call waits for that from 10 minutes before it, with the windows of WebIdentityCredentialsProvider; if DynamoDB rejects the credentials as expired, TryInvalidate(AwsCredentials) drops them and the next call reads the variables again. So a process that sets new variables before the old ones expire goes on without a restart. Credentials whose expiration has passed fail, and name the variable. A value that is not a time fails too.

A failure is not cached. If the variables are missing on the first call, a later call reads them again, so a process that sets them late recovers without a restart.

Constructors

EnvironmentCredentialsProvider()

Initializes a new instance of the EnvironmentCredentialsProvider class that reads the environment of the current process.

public EnvironmentCredentialsProvider()

Methods

GetCredentialsAsync(CancellationToken)

Gets the credentials from the environment, reading it on the first call, and again near the expiration of AWS_CREDENTIAL_EXPIRATION.

public ValueTask<AwsCredentials> GetCredentialsAsync(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Not used: reading environment variables is synchronous and instant.

Returns

ValueTask<AwsCredentials>

The same AwsCredentials instance until the variables are read again.

Exceptions

CredentialsUnavailableException

AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY is not set or empty, or AWS_CREDENTIAL_EXPIRATION is not a time or has passed. The next call reads the environment again.

TryInvalidate(AwsCredentials)

Drops credentials that DynamoDB rejected as expired, if AWS_CREDENTIAL_EXPIRATION gave them an expiration, so that the next call reads the environment again. A client does this by itself.

public bool TryInvalidate(AwsCredentials rejected)

Parameters

rejected AwsCredentials

The instance that was rejected. Any other than the current one has been replaced already, and is ignored.

Returns

bool

true if the credentials have an expiration: the environment may hold new ones by now. false for credentials without one, which the environment holds once and for all.

Exceptions

ArgumentNullException

rejected is null.