Namespace DynaSharp.Credentials

AssumeRoleCredentialsProvider: Supplies temporary credentials of an IAM role, which it gets from the AssumeRole call of AWS STS with the credentials of another provider, and refreshes before they expire. This is what a profile with role_arn and source_profile or credential_source does, see ProfileCredentialsProvider; this class is the same for code.

AssumeRoleOptions: The optional settings of AssumeRoleCredentialsProvider, which a profile spells external_id and duration_seconds.

AwsCredentials: AWS credentials used to sign requests: an access key pair and, for temporary credentials, a session token.

ContainerCredentialsProvider: Supplies temporary credentials from the container credentials endpoint of Amazon ECS (task roles) and Amazon EKS (Pod Identity), and refreshes them before they expire.

Finds credentials the way the AWS SDKs do, trying these sources in order and using the first that has credentials:

the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN (EnvironmentCredentialsProvider);
the web identity token file named by AWS_WEB_IDENTITY_TOKEN_FILE, which IAM roles for service accounts on EKS use (WebIdentityCredentialsProvider);
the profile in the shared credentials and config files (ProfileCredentialsProvider);
the container credentials endpoint of Amazon ECS and EKS (ContainerCredentialsProvider);
the instance metadata service of Amazon EC2 (InstanceMetadataCredentialsProvider).

This is what a DynamoDbClient uses when Credentials is not set.

EnvironmentCredentialsProvider: Supplies credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and, for temporary credentials, AWS_SESSION_TOKEN and AWS_CREDENTIAL_EXPIRATION environment variables.

InstanceMetadataCredentialsProvider: Supplies temporary credentials of the IAM role of an Amazon EC2 instance from the instance metadata service (IMDS), and refreshes them before they expire.

ProfileCredentialsProvider: Supplies the long-term or session credentials of a profile in the shared AWS credentials file (~/.aws/credentials) and config file (~/.aws/config), the files that the AWS CLI and the AWS SDKs share.

SsoCredentialsProvider: Supplies the credentials of a role in an account that AWS IAM Identity Center (SSO) gives the user who signed in with aws sso login, from the token that the AWS CLI caches, and refreshes them before they expire. This is what a profile with sso_account_id and sso_role_name does, see ProfileCredentialsProvider; this class is the same for code.

StaticCredentialsProvider: Always supplies the same credentials. Use for long-term keys, tests and DynamoDB Local.

WebIdentityCredentialsProvider: Supplies temporary credentials of an IAM role for the holder of a web identity token: IAM roles for service accounts (IRSA) on Amazon EKS, and any other OpenID Connect issuer that the account trusts, such as GitHub Actions. It trades the token for credentials with the AssumeRoleWithWebIdentity call of AWS STS, and refreshes them before they expire.

IRefreshableCredentialsProvider: A credentials provider that can let go of credentials the service has rejected, so that the next GetCredentialsAsync(CancellationToken) gets other ones. An optional capability: a provider that does not implement it keeps working, and the client passes the rejection on to the caller.