Behaviour for S3 credential providers.
A provider fetches AWS credentials. Select it in the :credentials setting
of ImagePipe.Source.S3, for every bucket or for one bucket in :buckets:
credentials: {:provider, MyApp.VaultCredentials, path: "aws/creds/image-read"}ImagePipe caches each result per provider and options, and shares it
across requests and buckets. Buckets that need different credentials set
different options. Temporary credentials are refreshed five minutes before
they expire. A cache entry is dropped after at least five minutes without a
request, and the next request fetches again. Credentials fetched by
ImagePipe.Source.S3.CredentialWarmup aren't dropped before their first
request. The built-in providers are listed under
Credentials.
Summary
Callbacks
Fetches credentials.
Checks the provider's options when the source is configured, so bad options
fail at startup instead of on the first request. Return :ok when the
provider takes no options.
Types
@type credentials() :: keyword()
@type expiry() :: DateTime.t() | :never
Callbacks
@callback fetch_credentials(keyword()) :: {:ok, credentials(), expiry()} | {:error, term()}
Fetches credentials.
Returns a keyword list with :access_key_id, :secret_access_key, and an
optional :token, and an expiry: a DateTime for temporary credentials,
or :never. A result that has already expired, or any other expiry, is
rejected. When a refresh fails, the previous credentials are used until
they expire.
The result is shared by every request that uses the same options, so it must depend only on the options.
Checks the provider's options when the source is configured, so bad options
fail at startup instead of on the first request. Return :ok when the
provider takes no options.