Class Credentials

java.lang.Object

com.codename1.backend.aws.Credentials

public final class Credentials
extends Object

AWS credentials, and the ways a server actually obtains them.

Deliberately in this order, which is the order the AWS SDKs use and the order that matters operationally:

1. The environment. This is what Lambda sets, what a local developer exports, and what a CI job injects.
2. The container credential endpoint. ECS and EKS publish a relative URI on 169.254.170.2 (or a full URI for EKS Pod Identity) that returns a temporary credential and refreshes it. This is how a task gets a ROLE rather than a long-lived key, which is the arrangement any reviewer will ask for.
3. The instance metadata service, IMDSv2 only. v1 is a plain GET that any process -- or any server-side request forgery -- can make; v2 requires a PUT to obtain a token first. Falling back to v1 would undo that, so this does not.

Temporary credentials expire. isExpiring(long) says when to fetch again; S3 does it for a credential it resolved from the environment itself.

Constructor Summary

Constructors

Constructor	Description
Credentials(String accessKeyId, String secretKey, String sessionToken)
Credentials(String accessKeyId, String secretKey, String sessionToken, long expiresAtMillis)

Method Summary

Modifier and Type	Method	Description
static Credentials	fromContainer()	The ECS / EKS container credential endpoint, or null when not in one.
static Credentials	fromEnvironment()	AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, or null.
static Credentials	fromInstanceMetadata()	IMDSv2.
String	getAccessKeyId()
long	getExpiresAtMillis()	0 when these do not expire.
String	getSecretKey()
String	getSessionToken()	Null for a long-lived key pair; set for anything temporary.
boolean	isExpiring(long marginMillis)	True within marginMillis of expiry.
static Credentials	resolve()	The first source that answers, in the order documented on this class.

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Credentials

public Credentials(String accessKeyId,
 String secretKey,
 String sessionToken)

Credentials

public Credentials(String accessKeyId,
 String secretKey,
 String sessionToken,
 long expiresAtMillis)

Method Details

getAccessKeyId

public String getAccessKeyId()

getSecretKey

public String getSecretKey()

getSessionToken

public String getSessionToken()

Null for a long-lived key pair; set for anything temporary.

getExpiresAtMillis

public long getExpiresAtMillis()

0 when these do not expire.

isExpiring

public boolean isExpiring(long marginMillis)

True within marginMillis of expiry. A margin rather than the exact instant because a request signed just before expiry can still arrive just after it.

resolve

public static Credentials resolve()
                           throws IOException

The first source that answers, in the order documented on this class. Throws when none does, naming what was tried -- "no credentials" with no further detail is the least useful message a deployment can get.

Throws:

IOException

fromEnvironment

public static Credentials fromEnvironment()
                                   throws IOException

AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, or null.

Throws:

IOException

fromContainer

public static Credentials fromContainer()
                                 throws IOException

The ECS / EKS container credential endpoint, or null when not in one.

Throws:

IOException

fromInstanceMetadata

public static Credentials fromInstanceMetadata()

IMDSv2. The PUT that obtains a token is the whole point: a v1 GET can be made by anything that can persuade this process to fetch a URL.