AWS Credentials Cache Upgrade Guide

[jdisanti]

This guide explains the changes to AWS credentials caching in the AWS Rust SDK.

Previously, the ConfigLoader, SdkConfig, and Config all had a credentials_cache() method that would take configuration for caching. For example:

let sdk_config = aws_config::from_env()
    // disables the credentials cache
    .credentials_cache(CredentialsCache::no_caching())
    .load()
    .await;

In the near future, the SDK will support both AWS credentials and SSO tokens. In addition, the underlying code generator, smithy-rs, needed a cache for its supported identity types such as HTTP auth, bearer auth, etc. To address this, a single unified identity cache was added to replace the credentials cache.

Using the identity cache is similar to the credentials cache. The example above can be done with the following:

let sdk_config = aws_config::from_env()
    .identity_cache(IdentityCache::no_cache())
    .load()
    .await;

Additionally, the default lazy caching implementation can still be customized. For example, the load timeout can be tweaked:

let sdk_config = aws_config::from_env()
    .identity_cache(
        IdentityCache::lazy()
            // Change the default load timeout
            .load_timeout(Duration::from_secs(10))
            .build()
    )
    .load()
    .await;

[mattklein123]

@jdisanti I'm trying to upgrade my code and running into issues, although maybe an edge case. I have code that does custom request signing (specifically to make Prometheus remote write requests to AMP). I used to have code that looked roughly like this:

let credentials_cache = sdk_config
            .credentials_cache()
            .ok_or(PromRemoteWriteError::Aws(
              "no credentials cache configured".to_string(),
            ))?
            .clone()
            .create_cache(provider);

And then I could do something like:

let credentials = aws_auth
        .credentials_cache
        .provide_cached_credentials()
        .await
        .map_err(|e| PromRemoteWriteError::Aws(format!("cannot fetch credentials: {e}")))?;

Which was quite simple. Now it looks like all of this has been removed and the caching code is intertwined with the smithy runtime. I can kind of see how to manually build a lazy cache manually, but then to use it I have to start providing RuntimeComponents and various other things, which makes me think I'm not doing what I'm supposed to be doing.

Is there some better way of doing this in the new world? Thanks.

[mattklein123]

OK thank you

[jdisanti]

I was thinking another workaround would be to manually construct a lazy credentials cache around the default credentials provider chain. Something like this:

let config = aws_config::load_from_env().await;
let provider = config.credentials_provider().unwrap();
let cache = IdentityCache::lazy()
    .time_source(SystemTimeSource::new())
    .sleep_impl(default_async_sleep())
    .build();

But it breaks down pretty quickly since the resolver trait requires &RuntimeComponents, which is very difficult to construct:

let components = RuntimeComponentsBuilder::new()
    // Somewhere around 10 fields are required or lead to panic on build, unfortunately
    .set_a_bunch_of_required_things(...)
    .build();
let config = ConfigBag::base();
let creds = cache.resolve_cached_identity(provider.clone(), &components, &config);

[mattklein123]

Yeah that workaround is what I was going to do. It's awful but the for_test() constructor would mostly work. I think you only need sleep/time for it to actually work.

[jdisanti]

I think you only need sleep/time for it to actually work.

Yeah, I think that's correct.

[mattklein123]

FWIW from a user perspective, my preference is to allow me to use the cache directly like I used to vs. force me to use the client.