Module Awskit.CredentialsSource

AWS credentials for request signing.

AWS credentials.

Values are opaque to prevent accidental logging of secret access keys.

Sourcetype t

Opaque AWS credentials. The secret access key is retained for signing but is not exposed by accessors.

Sourcetype source = [
  1. | `Static
  2. | `Env
  3. | `Shared_file of string
  4. | `Config_file of string
  5. | `Container
  6. | `Imds
  7. | `Custom of string
]

Credential source that produced, skipped, or failed resolution.

Sourcemodule Provider : sig ... end
Sourceval create : access_key_id:string -> secret_access_key:string -> ?session_token:string -> ?source:Provider.source -> ?expires_at:Ptime.t -> unit -> (t, Error.t) result

Create credentials from AWS access key material.

Empty access keys, empty secret keys, and invalid session token values are rejected with a validation error. Optional source and expires_at metadata are preserved for provider chains, refresh, and diagnostics.

Sourceval create_exn : access_key_id:string -> secret_access_key:string -> ?session_token:string -> ?source:Provider.source -> ?expires_at:Ptime.t -> unit -> t

Like create, but raises Error.Awskit_error carrying the structured validation error on validation failure.

Sourceval access_key_id : t -> string

Return the non-secret access key id.

Sourceval session_token : t -> string option

Return the optional session token for temporary credentials.

Sourceval source : t -> Provider.source option

Return the credential source metadata, if the provider supplied one.

Sourceval source_label : t -> string option

Return a stable, human-readable source label, if source metadata exists.

Sourceval expires_at : t -> Ptime.t option

Return the credential expiration timestamp, if the provider supplied one.

Sourceval usable_until : t -> Ptime.t option

Return the instant until which these credentials are usable, if they are temporary credentials.

Sourceval is_expired : now:Ptime.t -> t -> bool

Return true when t has expiration metadata and is not usable at now.

Sourceval validate_usable : now:Ptime.t -> operation:string -> t -> (unit, Error.t) result

Return Ok () when credentials can sign operation at now.

The operation name is controlled SDK context for diagnostics. It must not contain request data such as bucket names, keys, URLs, or headers.

Sourceval validate_fresh : t -> now:Ptime.t -> (unit, Error.t) result

Return Ok () when credentials are still usable at now.

Credentials without expiration metadata are treated as fresh. Expired credentials return a credentials error with source metadata when available.

Sourceval signing_key : t -> datestamp:string -> region:Region.t -> service:string -> string

Derive a SigV4 signing key without exposing the raw secret access key. This is primarily for Awskit.Signing and custom AWS signers.