Struct AssumeRoleGranter 

pub struct AssumeRoleGranter { /* private fields */ }

Available on crate feature services-s3 only.

Explicitly grants an AWS STS assumed-role credential.

The source credential provided to reqsign_core::Granter signs the STS request directly. Both long-lived credentials and valid temporary credentials are supported; a temporary source’s session token is included in the SigV4 request.

AssumeRole is an authority transition. The returned session receives the intersection of the target role’s permissions and the optional session policies in AssumeRoleGrant, not necessarily a subset of the source principal’s direct permissions.

AWS limits role chaining to one hour, but an opaque Credential does not reliably identify whether a temporary source is an assumed-role session. Callers performing role chaining must request at most one hour; STS remains authoritative for this and for the target role’s configured maximum.

This granter uses the standard regional STS endpoint for the bound signing region. Every call performs a new STS exchange; granted credentials are never cached.

Example

use std::time::Duration;

use reqsign_aws_v4::{
    AssumeRoleGrant, AssumeRoleGranter, StaticCredentialProvider,
};
use reqsign_core::{Context, Granter};

let source = StaticCredentialProvider::new("source-access-key", "source-secret-key");
let grant = AssumeRoleGrant::new(
    "arn:aws:iam::123456789012:role/customer-reader",
    "customer-a",
);
// Supply a Context configured with an HttpSend implementation.
let context = Context::new();
let credential = Granter::new(
    context,
    source,
    AssumeRoleGranter::new("us-east-1", grant),
)
.grant(Some(Duration::from_secs(3600)))
.await?;

Implementations

impl AssumeRoleGranter

pub fn new( region: impl Into<String>, grant: AssumeRoleGrant, ) -> AssumeRoleGranter

Create a granter for a signing region and bound AssumeRole grant.

pub fn with_grant(self, grant: AssumeRoleGrant) -> AssumeRoleGranter

Replace the bound authority transition.

Trait Implementations

impl Clone for AssumeRoleGranter

fn clone(&self) -> AssumeRoleGranter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AssumeRoleGranter

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl GrantCredential for AssumeRoleGranter

type Credential = Credential

Credential used as the source and returned as the granted result.

fn required_valid_until( &self, _credential: &<AssumeRoleGranter as GrantCredential>::Credential, _expires_in: Option<Duration>, ) -> Timestamp

Return the timestamp through which the source credential must remain usable.

async fn grant_credential( &self, ctx: &Context, credential: &<AssumeRoleGranter as GrantCredential>::Credential, expires_in: Option<Duration>, ) -> Result<<AssumeRoleGranter as GrantCredential>::Credential, Error>

Grant a bounded, expiring credential from an existing service credential.