Backend API. Server-side code: this runs in a Codename One backend, not in the app on the device.
public final class Credentials
- Object
- Credentials
AWS credentials, and the ways a server actually obtains them.
Deliberately in this order, which is the order the AWS SDKs use and the order that matters operationally:
- The environment. This is what Lambda sets, what a local developer exports, and what a CI job injects.
- The container credential endpoint. ECS and EKS publish a relative URI on 169.254.170.2 (or a full URI for EKS Pod Identity) that returns a temporary credential and refreshes it. This is how a task gets a ROLE rather than a long-lived key, which is the arrangement any reviewer will ask for.
- The instance metadata service, IMDSv2 only. v1 is a plain GET that any process – or any server-side request forgery – can make; v2 requires a PUT to obtain a token first. Falling back to v1 would undo that, so this does not.
Temporary credentials expire. isExpiring says when to fetch again;
S3 does it for a credential it resolved from the environment itself.
Constructors
public Credentials(String accessKeyId, String secretKey, String sessionToken) | |
public Credentials(String accessKeyId, String secretKey, String sessionToken, long expiresAtMillis) |
Methods
public String getAccessKeyId() | |
public String getSecretKey() | |
public String getSessionToken() | Null for a long-lived key pair; set for anything temporary. |
public long getExpiresAtMillis() | 0 when these do not expire. |
public boolean isExpiring(long marginMillis) | True within marginMillis of expiry. |
public static Credentials resolve()
throws IOException | The first source that answers, in the order documented on this class. |
public static Credentials fromEnvironment()
throws IOException | AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, or null. |
public static Credentials fromContainer()
throws IOException | The ECS / EKS container credential endpoint, or null when not in one. |
public static Credentials fromInstanceMetadata() | IMDSv2. |
Inherited methods
Constructor details
Credentials
public Credentials(String accessKeyId, String secretKey, String sessionToken)Credentials
public Credentials(String accessKeyId, String secretKey, String sessionToken, long expiresAtMillis)Method details
getAccessKeyId
public String getAccessKeyId()getSecretKey
public String getSecretKey()getSessionToken
public String getSessionToken()Null for a long-lived key pair; set for anything temporary.
getExpiresAtMillis
public long getExpiresAtMillis()0 when these do not expire.
isExpiring
public boolean isExpiring(long marginMillis)True within
marginMillis of expiry. A margin rather than the exact instant
because a request signed just before expiry can still arrive just after it.resolve
public static Credentials resolve()
throws IOExceptionThe first source that answers, in the order documented on this class.
Throws when none does, naming what was tried – “no credentials” with no
further detail is the least useful message a deployment can get.
Throws
fromEnvironment
public static Credentials fromEnvironment()
throws IOExceptionAWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, or null.
Throws
fromContainer
public static Credentials fromContainer()
throws IOExceptionThe ECS / EKS container credential endpoint, or null when not in one.
Throws
fromInstanceMetadata
public static Credentials fromInstanceMetadata()IMDSv2. The PUT that obtains a token is the whole point: a v1 GET can be
made by anything that can persuade this process to fetch a URL.