Changelog — Edge SDK

GitHub Actions now selects among multiple AWS STS Credential Providers

September 16, 2026

The Aembit GitHub Action can now choose which AWS Security Token Service (STS) Federation Credential Provider to use when an Access Policy holds more than one.

An Access Policy can hold more than one AWS STS Federation Credential Provider, each with its own Access Key ID selector. Until now, a GitHub Actions workflow needed a self-hosted runner running Aembit Edge to reach more than one IAM role from a single Access Policy. The alternative was a direct call to the Edge API.

Key capabilities:

The aws-access-key-id input names the Access Key ID selector of the Credential Provider you want, so a workflow on a GitHub-hosted runner reaches any IAM role in the Access Policy. See Retrieve credentials in GitHub Actions.
The Edge API credentials endpoint carries the same selector as connection metadata, alongside the selectors for multiple JSON Web Token (JWT) Credential Providers. See the Edge API credentials endpoint.
The Edge SDKs for TypeScript and Python pass the selector as connection metadata on the credential request. See Select among multiple Credential Providers with the Edge SDK.

Minimum version required:

Aembit GitHub Action 1.3.0
Edge SDK 1.34.0

For how Aembit matches a selector to a Credential Provider, see Using multiple AWS STS Credential Providers.

Tags:

Aembit Edge SDKs for TypeScript and Python now available

August 27, 2026

The Aembit Edge SDKs are language libraries that wrap the Aembit Edge API. Your application authenticates a workload and retrieves credentials through a few method calls, so you write no HTTP requests and manage no token lifecycles. The SDK runs inside your application process, so there’s nothing extra to deploy or operate alongside it.

Use an SDK when you can change the application’s source and you want credential retrieval to be explicit in your code. It suits environments where running a proxy next to the workload isn’t practical, such as serverless functions, ephemeral CI containers, and platforms where you don’t control the runtime.

What’s new:

TypeScript and Python libraries: Install the SDK from its language package registry and call it from your application. The SDK repository carries the installation steps, the developer reference, and runnable examples.
Workload attestation, token lifecycle, and credential retrieval: The SDK collects identity evidence from the environment it runs in, caches the resulting access token in memory, refreshes that token before it expires, and requests the credential your application needs.
Seven supported Trust Providers: Attest with AWS Metadata Service, AWS Role, Azure Instance Metadata Service, GCP Identity Token, GitHub, GitLab, or OIDC ID Token. For per-language coverage, see Edge SDK Trust Providers.
Integration guides for four platforms: Follow a worked setup for AWS EC2, AWS Lambda, GCP Cloud Run, or Vercel OIDC.

The console-side configuration matches every other Aembit access path. You configure a Trust Provider to verify the workload’s identity and a Credential Provider to supply the credential. An Access Policy then authorizes a specific Client Workload to reach a specific Server Workload.

To retrieve your first credential, see the Edge SDK quickstart. For the full overview, see Aembit Edge SDKs.

Tags: