Table of Contents

Class ProfileCredentialsProvider

Namespace
DynaSharp.Credentials
Assembly
DynaSharp.dll

Supplies the long-term or session credentials of a profile in the shared AWS credentials file (~/.aws/credentials) and config file (~/.aws/config), the files that the AWS CLI and the AWS SDKs share.

public sealed class ProfileCredentialsProvider : IRefreshableCredentialsProvider, ICredentialsProvider
Inheritance
ProfileCredentialsProvider
Implements
Inherited Members

Remarks

Which profile: the one given to the constructor, otherwise the one named by the AWS_PROFILE environment variable, otherwise default. Where the files are: AWS_SHARED_CREDENTIALS_FILE and AWS_CONFIG_FILE, otherwise the .aws folder in the home folder of the user. The files are parsed exactly as botocore does. In the credentials file a profile is a section [dev]; in the config file it is [profile dev], except [default]. If both files define the profile, the credentials file wins option by option. The options read are aws_access_key_id, aws_secret_access_key and, for temporary credentials, aws_session_token (or the older aws_security_token, which wins when both are set). Credentials in the credentials file are preferred to credentials in the config file of the same profile; the two are never mixed.

Both files are optional. A missing file, or a file the process may not read, counts as empty. If no profile was asked for by name and default does not exist, or if the profile has no aws_access_key_id, GetCredentialsAsync(CancellationToken) throws a CredentialsUnavailableException and the default chain moves on to the next source, as botocore does. In contrast, a profile named by the constructor or by AWS_PROFILE that does not exist, a file that exists but is malformed, a profile with an access key but no secret, and a profile that needs a feature DynaSharp does not support fail loudly with a CredentialsUnavailableException that names the file and line, or the setting and the profile. They are never skipped, because the next source would sign requests as a different principal. The unsupported settings are login_session and mfa_serial on a role. Messages never contain file content.

The order is botocore's. role_arn with source_profile or credential_source comes first and takes the profile over even if it has keys: it assumes the role with AssumeRoleCredentialsProvider, with role_session_name, external_id and duration_seconds (900 to 43200) of the profile. A source_profile with static keys, or without role_arn, gives its own credentials, from any source below; one with role_arn and no keys assumes its role in turn, so roles chain, and a profile that comes back is a loop, which fails, unless a profile names itself and has static keys. credential_source is Environment, Ec2InstanceMetadata or EcsContainer. Then web_identity_token_file with role_arn federates through WebIdentityCredentialsProvider; then sso_account_id or sso_role_name gets the role of AWS IAM Identity Center through SsoCredentialsProvider, with the sso_session of a [sso-session name] section of the config file or the older sso_start_url and sso_region in the profile; then the static keys of the credentials file, credential_process, and the static keys of the config file. The region of STS is that of the client, otherwise AWS_REGION, AWS_DEFAULT_REGION or the region of this profile.

credential_process runs a program that writes the credentials as JSON, see the AWS documentation of the setting: on Windows the command line is split by the rules of the C runtime, elsewhere like a POSIX shell, and the program starts without a shell, gets 20 seconds, no input, and is killed with what it started when it runs longer. It runs again before the Expiration it wrote, with the windows of WebIdentityCredentialsProvider. A failure names the profile and the exit code, never what the program wrote, which is a secret. Static keys in the credentials file of the profile go ahead of it, and static keys in its config file come after it, as in botocore.

The files are read on the first call that finds what the profile asks for, and not again, so changes need a restart. Static keys are one AwsCredentials instance without expiration. A failed call is not cached and reads the files again. The provider is thread-safe. Reading happens synchronously on the calling thread: it is a small local file.

Differences from the AWS SDKs: AWS_DEFAULT_PROFILE is not read, and a profile named by AWS_PROFILE that does not exist is reported by GetCredentialsAsync(CancellationToken) only, not when the client is created.

Constructors

ProfileCredentialsProvider()

Initializes a new instance of the ProfileCredentialsProvider class for the profile named by the AWS_PROFILE environment variable, or default.

public ProfileCredentialsProvider()

ProfileCredentialsProvider(string)

Initializes a new instance of the ProfileCredentialsProvider class for a named profile.

public ProfileCredentialsProvider(string profileName)

Parameters

profileName string

The profile, for example dev. AWS_PROFILE is ignored.

Exceptions

ArgumentException

profileName is null or empty.

Methods

GetCredentialsAsync(CancellationToken)

Gets the credentials of the profile, reading the files on the first call that finds what the profile asks for.

public ValueTask<AwsCredentials> GetCredentialsAsync(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Stops this call from waiting for STS or a credential_process. The files are read synchronously.

Returns

ValueTask<AwsCredentials>

For static keys, the same AwsCredentials instance on every call; otherwise the same instance until it is refreshed.

Exceptions

CredentialsUnavailableException

The profile or its keys are not found, a file is malformed, the profile has only one of the two keys, the profile uses a setting that DynaSharp does not support or a role that is configured wrongly, or STS or its credential_process fails. The message says which.

OperationCanceledException

cancellationToken was cancelled while a program ran.

TryInvalidate(AwsCredentials)

Drops credentials that DynamoDB rejected as expired, if the profile gets them from a source that can be asked again. A client does this by itself.

public bool TryInvalidate(AwsCredentials rejected)

Parameters

rejected AwsCredentials

The instance that was rejected. Any other than the current one has been replaced already, and is ignored.

Returns

bool

true if the profile assumes a role, federates a web identity, uses SSO or runs a credential_process, which the next call asks again. false for static keys, which the files hold once and for all, and before the first call.

Exceptions

ArgumentNullException

rejected is null.