Select among multiple Credential Providers with the Edge SDK

An Access Policy can hold multiple AWS STS Federation Credential Providers, each with its own Access Key ID selector. For how Aembit uses the selector, see Using multiple AWS STS Credential Providers. Pass the selector as connection metadata when you request the credential, and Aembit returns temporary AWS credentials for the IAM role of the matching Credential Provider. Connection metadata requires Edge SDK 1.34.0 or later.

TypeScript
Python

const credential = await client.getCredential({
  server: { host: "s3.amazonaws.com", port: 443 },
  credentialType: "AwsStsFederation",
  connectionMetadata: { accessKeyId: "AKIADUMMYFORROLEA" },
});

const { awsAccessKeyId, awsSecretAccessKey, awsSessionToken } = credential.data;

from aembit_edge import CredentialServerRef, GetCredentialInput

credential_input = GetCredentialInput(
    server=CredentialServerRef(host="s3.amazonaws.com", port=443),
    credential_type="AwsStsFederation",
    connection_metadata={"accessKeyId": "AKIADUMMYFORROLEA"},
)
result = client.get_credential(credential_input)

aws_access_key_id = result.data["awsAccessKeyId"]
aws_secret_access_key = result.data["awsSecretAccessKey"]
aws_session_token = result.data["awsSessionToken"]

Selector values use uppercase characters only. Omit the connection metadata when the Access Policy has a single AWS STS Credential Provider. A selector that matches no Credential Provider in the Access Policy fails the request.

Connection metadata also carries the selectors for multiple JSON Web Token (JWT) Credential Providers. The Edge API credentials endpoint lists every field.