ImagePipe.Source.S3.AssumeRole (image_pipe v0.1.0)

Copy Markdown View Source

Credential provider that assumes an IAM role with STS AssumeRole, usually a role in another account.

credentials:
  {:provider, ImagePipe.Source.S3.AssumeRole,
   base: {:provider, ImagePipe.Source.S3.InstanceRole, []},
   role_arn: "arn:aws:iam::123456789012:role/image-read",
   region: "eu-west-1"}

It signs the STS call with the :base credentials. Setting up credentials is covered in Serving images from S3.

Options

  • :base ({:static, keyword()} or {:provider, module(), keyword()}) - Required. Credentials allowed to assume :role_arn, in any form the :credentials option of ImagePipe.Source.S3 takes. They are cached and refreshed separately.

  • :role_arn (String.t/0) - Required. ARN of the role to assume.

  • :region (String.t/0) - Required. Region of the STS endpoint, sts.<region>.amazonaws.com, also used to sign the call.

  • :external_id (String.t/0) - External ID that the role's trust policy requires.

  • :role_session_name (String.t/0) - Session name for the assumed role. The default value is "image-pipe".

  • :receive_timeout (non_neg_integer/0) - Milliseconds to wait for each response. The default value is 5000.

  • :connect_timeout (non_neg_integer/0) - Milliseconds to wait for a connection. The default value is 5000.