module

Anthropic::Bedrock::CredentialsResolver

Resolve AWS credentials for Bedrock.

Resolution order (simplified AWS default chain, pure Crystal):

  1. Explicit constructor args (aws_access_key, aws_secret_key, …)
  2. Environment: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_REGION / AWS_DEFAULT_REGION, AWS_PROFILE
  3. Shared credentials file (~/.aws/credentials, or AWS_SHARED_CREDENTIALS_FILE) for the selected profile
  4. AWS CLI aws login cache (~/.aws/login/cache/{sha256(login_session)}.json) when the profile sets login_session in ~/.aws/config
  5. IAM Identity Center (SSO): read cached access token from ~/.aws/sso/cache/{sha1(start_url)}.json, then call GetRoleCredentials on portal.sso.{region}.amazonaws.com (legacy profile keys or modern [sso-session …] form)
  6. EC2 Instance Metadata Service (IMDS), unless AWS_EC2_METADATA_DISABLED is true — short timeouts so local development does not hang

Region is resolved from explicit arg → AWS_REGION → AWS_DEFAULT_REGION → profile region in config → IMDS → us-east-1.

Optional path kwargs (credentials_path, config_path, login_cache_dir, sso_cache_dir, home) are for tests; production callers omit them.

Constants

DEFAULT_REGION = "us-east-1"
IMDS_CONNECT_TIMEOUT = 1.seconds
IMDS_DEFAULT_ENDPOINT = "http://169.254.169.254"
IMDS_READ_TIMEOUT = 1.seconds
IMDS_TOKEN_TTL_SECONDS = "21600"
SSO_CONNECT_TIMEOUT = 5.seconds
SSO_READ_TIMEOUT = 10.seconds

Instance methods

resolve(aws_access_key : String | Nil = nil, aws_secret_key : String | Nil = nil, aws_session_token : String | Nil = nil, aws_region : String | Nil = nil, aws_profile : String | Nil = nil, *, credentials_path : Path | String | Nil = nil, config_path : Path | String | Nil = nil, login_cache_dir : Path | String | Nil = nil, sso_cache_dir : Path | String | Nil = nil, home : Path | String | Nil = nil, enable_imds : Bool | Nil = nil) : Credentials
Source