Credentials

The AWS SDK's default chain supplies the region and the credentials, fetched on the first request; from_config takes a prebuilt SdkConfig instead.

A broker built with new loads its configuration with aws_config when it connects. The region comes from AWS_REGION or the shared profile, and the credentials from the environment, the shared profile files, SSO, or the instance or container role. The SDK fetches the credentials on the first request, a subscription's GetQueueUrl at startup, so a service with a subscription meets a missing credential there. The configuration follows the SDK's latest behaviour version. The connect also sets a per-attempt timeout of 25 seconds, above the 20 seconds a long poll waits.

from_config takes an aws_config::SdkConfig the service builds itself: a named profile, a pinned behaviour version, its own HTTP client or credential provider. The credentials, the timeouts and the rest of the SDK's settings come from that config. An endpoint or a region named on the broker replaces the config's own, and what the broker does not name stays as the config has it. test_credentials belongs to new: a prebuilt config signs with its own credential provider. The SDK sets no attempt timeout of its own, so a config without one lets every long poll run its full wait. A config with an attempt timeout under 20 seconds ends every long poll early, and each receive fails; the example sets 25 seconds, as new does. Transport security is the SDK's HTTPS client in both cases.

The service's role needs these permissions:

Action	When
`sqs:GetQueueUrl`, `sqs:ReceiveMessage`, `sqs:DeleteMessage`, `sqs:ChangeMessageVisibility`	every subscription
`sqs:GetQueueAttributes`	a subscription that names no visibility, and the dead-letter queue of a redrive policy
`sqs:SetQueueAttributes`	a subscription with a redrive policy, and the queue of `subscribe_queue_to_topic`
`sqs:CreateQueue`	a subscription with `create_if_missing`
`sqs:SendMessage`	every publish to a queue
`sns:Publish`	every publish to a topic, and `sns:CreateTopic` for a topic named by name rather than ARN
`sns:Subscribe`	`subscribe_queue_to_topic`, with `sns:CreateTopic` on the topic and `sqs:GetQueueUrl`, `sqs:GetQueueAttributes` and `sqs:SetQueueAttributes` on the queue

Example

The service signs its requests with the orders profile of the shared AWS files, in eu-west-1.

Macros
Manual

examples/sqs_broker_credentials.rs
/// The credentials of the `orders` profile in the shared AWS files, in `eu-west-1`. The broker
/// uses the config as it is, so the config carries the attempt timeout: above the 20 seconds a
/// long poll waits.
fn config() -> SdkConfig {
    let profile = ProfileFileCredentialsProvider::builder()
        .profile_name("orders")
        .build();
    SdkConfig::builder()
        .behavior_version(BehaviorVersion::latest())
        .region(Region::new("eu-west-1"))
        .credentials_provider(SharedCredentialsProvider::new(profile))
        .timeout_config(
            TimeoutConfig::builder()
                .operation_attempt_timeout(Duration::from_secs(25))
                .build(),
        )
        .build()
}

#[app]
fn app() -> impl App {
    service(SqsBroker::from_config(config()), "orders".to_owned())
}

examples/manual/sqs_broker_credentials.rs
/// The credentials of the `orders` profile in the shared AWS files, in `eu-west-1`. The broker
/// uses the config as it is, so the config carries the attempt timeout: above the 20 seconds a
/// long poll waits.
fn config() -> SdkConfig {
    let profile = ProfileFileCredentialsProvider::builder()
        .profile_name("orders")
        .build();
    SdkConfig::builder()
        .behavior_version(BehaviorVersion::latest())
        .region(Region::new("eu-west-1"))
        .credentials_provider(SharedCredentialsProvider::new(profile))
        .timeout_config(
            TimeoutConfig::builder()
                .operation_attempt_timeout(Duration::from_secs(25))
                .build(),
        )
        .build()
}

fn app() -> impl App {
    service(SqsBroker::from_config(config()), "orders".to_owned())
}

Example​

Example