Changelog — Edge SDK

Edge SDKs support the same Trust Providers in TypeScript and Python

October 16, 2026

The Edge SDKs for TypeScript and Python now attest with the same nine Trust Providers, so the language you pick no longer limits which Trust Providers your workload can use. For the full list, see Edge SDK Trust Providers.

What’s new:

Python Trust Providers: The Python SDK adds AWS Metadata Service, Azure Instance Metadata Service, GCP Identity Token, Kubernetes Service Account, and OIDC ID Token.
TypeScript Trust Providers: The TypeScript SDK adds GitLab, Kubernetes Service Account, and Terraform Cloud.
Python package on PyPI: Install the Python SDK with pip install aembit-edge-sdk. It requires Python 3.10 or later. See the Edge SDK quickstart.
Integration guides: New guides cover Azure Functions, Azure virtual machines, GitHub Actions, GitLab CI/CD, Kubernetes, and Terraform Cloud. Every integration guide now shows both languages.
Logging reference: Edge SDK logging and network activity lists the events the SDKs log, how to send them to your logger, and which hosts the SDKs contact.

Minimum version required:

Edge SDK for TypeScript 1.34.1
Edge SDK for Python 1.35.0

Tags:

GitHub Actions now selects among multiple AWS STS Credential Providers

September 16, 2026

The Aembit GitHub Action can now choose which AWS Security Token Service (STS) Federation Credential Provider to use when an Access Policy holds more than one.

An Access Policy can hold more than one AWS STS Federation Credential Provider, each with its own Access Key ID selector. Until now, a GitHub Actions workflow needed a self-hosted runner running Aembit Edge to reach more than one IAM role from a single Access Policy. The alternative was a direct call to the Edge API.

Key capabilities:

The aws-access-key-id input names the Access Key ID selector of the Credential Provider you want, so a workflow on a GitHub-hosted runner reaches any IAM role in the Access Policy. See Retrieve credentials in GitHub Actions.
The Edge API credentials endpoint carries the same selector as connection metadata, alongside the selectors for multiple JSON Web Token (JWT) Credential Providers. See the Edge API credentials endpoint.
The Edge SDKs for TypeScript and Python pass the selector as connection metadata on the credential request. See Select among multiple Credential Providers with the Edge SDK.

Minimum version required:

Aembit GitHub Action 1.3.0
Edge SDK for TypeScript 1.34.0
Edge SDK for Python 1.35.0

For how Aembit matches a selector to a Credential Provider, see Using multiple AWS STS Credential Providers.

Tags:

Aembit Edge SDKs for TypeScript and Python now available

August 27, 2026

The Aembit Edge SDKs are language libraries that wrap the Aembit Edge API. Your application authenticates a workload and retrieves credentials through a few method calls, so you write no HTTP requests and manage no token lifecycles. The SDK runs inside your application process, so there’s nothing extra to deploy or operate alongside it.

Use an SDK when you can change the application’s source and you want credential retrieval to be explicit in your code. It suits environments where running a proxy next to the workload isn’t practical, such as serverless functions, ephemeral CI containers, and platforms where you don’t control the runtime.

What’s new:

TypeScript and Python libraries: Install the TypeScript SDK from npm and call it from your application. The Python SDK installs from PyPI starting with version 1.35.0. The SDK repository carries the installation steps, the developer reference, and runnable examples.
Workload attestation, token lifecycle, and credential retrieval: The SDK collects identity evidence from the environment it runs in and caches the resulting access token in memory. It refreshes that token before it expires and requests the credential your application needs.
Eight supported Trust Providers: Attest with AWS Metadata Service, AWS Role, Azure Instance Metadata Service, GCP Identity Token, GitHub, GitLab, OIDC ID Token, or Terraform Cloud. For per-language coverage, see Edge SDK Trust Providers.
Integration guides for four platforms: Follow a worked setup for AWS EC2, AWS Lambda, GCP Cloud Run, or Vercel OIDC.

The console-side configuration matches every other Aembit access path. You configure a Trust Provider to verify the workload’s identity and a Credential Provider to supply the credential. An Access Policy then authorizes a specific Client Workload to reach a specific Server Workload.

To retrieve your first credential, see the Edge SDK quickstart. For the full overview, see Aembit Edge SDKs.

Tags: