AWS Config Profile Credential Loader

A utility that loads AWS credentials from a configuration profile that uses an external credential process. This enables authentication with AWS services using credentials obtained from custom credential providers.

Capabilities

Loads credentials from profile with credential process

• Given a profile name and config file path where the profile specifies a credential_process, the function loads credentials by executing the process and returns an AWS credential object with accessKeyId, secretAccessKey, and optional sessionToken. @test
• Given a profile that does not specify a credential_process, the function throws an error indicating the profile is invalid for process credentials. @test

Creates STS client with process credentials

• Given valid process credentials from a profile, the function creates and returns a working STS client that can make authenticated API calls. @test
• Given process credentials, the function successfully calls GetCallerIdentity using the STS client to verify the credentials work. @test

Implementation

@generates

API

interface ProcessCredentials {
  accessKeyId: string;
  secretAccessKey: string;
  sessionToken?: string;
  expiration?: Date;
}

interface ProfileLoaderConfig {
  profileName: string;
  configFilePath: string;
}

/**
 * Loads AWS credentials from a profile that uses credential_process.
 *
 * @param config - Configuration specifying profile and config file location
 * @returns Promise resolving to process credentials
 * @throws Error if profile doesn't specify credential_process or process fails
 */
async function loadCredentialsFromProfile(
  config: ProfileLoaderConfig
): Promise<ProcessCredentials>;

/**
 * Creates an STS client using credentials from a process-based profile.
 *
 * @param profileName - Name of the AWS config profile to use
 * @param configFilePath - Path to the AWS config file
 * @returns Promise resolving to configured STS client
 */
async function createSTSClientFromProfile(
  profileName: string,
  configFilePath: string
): Promise<any>;

export { loadCredentialsFromProfile, createSTSClientFromProfile, ProcessCredentials, ProfileLoaderConfig };

Dependencies { .dependencies }

@aws-sdk/client-sts { .dependency }

Provides the STS client for AWS Security Token Service operations and credential management.

@satisfied-by