Credentials

Credentials and the region resolve through the AWS SDK's default chain at connect; from_config takes a prebuilt SdkConfig, which a DynamoDB lease store shares.

A broker built with new loads its configuration with aws_config when the runtime connects it. The region comes from AWS_REGION or the shared profile. The credentials come from the environment, the shared profile files, SSO, or the instance or container role. The SDK fetches them on the first request, a subscription's DescribeStreamSummary at startup, so a service with a subscription meets a missing credential there. The configuration follows the SDK's latest behaviour version.

from_config takes an aws_config::SdkConfig the service builds itself: a named profile, a pinned behaviour version, its own HTTP client or credential provider. The broker uses that config as it is. The region, the credentials and the endpoint all come from it, and the broker's own endpoint, region and test_credentials steps do not apply. A DynamoLeaseStore is built from an SdkConfig too, so a service that uses one hands the same config to both. Transport security is the SDK's HTTPS client in both cases.

The service's role needs these permissions:

Action	When
`kinesis:DescribeStreamSummary`, `kinesis:ListShards`, `kinesis:GetShardIterator`, `kinesis:GetRecords`	every subscription
`kinesis:CreateStream`, `kinesis:DescribeStream`	a subscription with `create_if_missing`
`kinesis:PutRecord`	every publish
`dynamodb:GetItem`, `dynamodb:UpdateItem`	a `DynamoLeaseStore`, on its table

Example

The service signs its requests with the orders profile of the shared AWS files, in eu-west-1.

Macros
Manual

examples/kinesis_broker_credentials.rs
/// The credentials of the `orders` profile in the shared AWS files, in `eu-west-1`. The broker
/// uses the config as it is.
fn config() -> SdkConfig {
    let profile = ProfileFileCredentialsProvider::builder()
        .profile_name("orders")
        .build();
    SdkConfig::builder()
        .behavior_version(BehaviorVersion::latest())
        .region(Region::new("eu-west-1"))
        .credentials_provider(SharedCredentialsProvider::new(profile))
        .build()
}

#[ruststream::app]
fn app() -> impl App {
    service(KinesisBroker::from_config(config()))
}

examples/manual/kinesis_broker_credentials.rs
/// The credentials of the `orders` profile in the shared AWS files, in `eu-west-1`. The broker
/// uses the config as it is.
fn config() -> SdkConfig {
    let profile = ProfileFileCredentialsProvider::builder()
        .profile_name("orders")
        .build();
    SdkConfig::builder()
        .behavior_version(BehaviorVersion::latest())
        .region(Region::new("eu-west-1"))
        .credentials_provider(SharedCredentialsProvider::new(profile))
        .build()
}

fn app() -> impl App {
    service(KinesisBroker::from_config(config()))
}

Example​

Example