Struct S3ExpressSessionGranter 

pub struct S3ExpressSessionGranter { /* private fields */ }

Available on crate feature services-s3 only.

Grants expiration-aware credentials for one S3 Express directory bucket or one caller-configured compatible endpoint.

The source credential authorizes s3express:CreateSession and is used only to sign the issuance request. The output contains only the independently usable access key, secret access key, S3 session token, and exact expiration returned by S3. Every call performs a new CreateSession; granted outputs are never cached.

S3 fixes the session lifetime at five minutes and does not expose a lifetime request parameter. Call reqsign_core::Granter::grant with None.

Example

use reqsign_aws_v4::{
    DefaultCredentialProvider, S3ExpressSessionConfig, S3ExpressSessionGrant,
    S3ExpressSessionGranter,
};
use reqsign_core::{Context, Granter};

let config = S3ExpressSessionConfig::from_bucket(
    "my-bucket--usw2-az1--x-s3",
    "us-west-2",
)?;
let grant = S3ExpressSessionGrant::maximum_allowed();
let granter = Granter::new(
    Context::new(),
    DefaultCredentialProvider::new(),
    S3ExpressSessionGranter::new(config, grant),
);

let credential = granter.grant(None).await?;

Implementations

impl S3ExpressSessionGranter

pub fn new( config: S3ExpressSessionConfig, grant: impl Into<S3ExpressSessionGrantSelection>, ) -> S3ExpressSessionGranter

Create a granter with stable bucket configuration and a mode selection.

pub fn new_with_custom_endpoint( bucket: impl Into<String>, region: impl Into<String>, endpoint: impl Into<String>, grant: impl Into<S3ExpressSessionGrantSelection>, ) -> Result<S3ExpressSessionGranter, Error>

Create a granter for a compatible service at a custom HTTPS endpoint.

This path deliberately bypasses AWS directory-bucket name, Zone ID, partition, and DNS derivation rules. The endpoint must already route CreateSession to bucket; reqsign sends the exact configured authority and does not add the bucket to the request target. region is used verbatim in the SigV4 credential scope.

Security

The endpoint receives AWS Authorization material and, when the source credential is temporary, its x-amz-security-token. Reqsign validates endpoint syntax but cannot determine whether the configured service is authorized to receive those credentials or implements CreateSession.

Example

use reqsign_aws_v4::{
    S3ExpressSessionGrant, S3ExpressSessionGranter, S3ExpressSessionMode,
};

let granter = S3ExpressSessionGranter::new_with_custom_endpoint(
    "compatible-bucket",
    "custom-region-1",
    "https://sessions.example.com",
    S3ExpressSessionGrant::new(S3ExpressSessionMode::ReadWrite),
)?;

pub fn with_grant( self, grant: impl Into<S3ExpressSessionGrantSelection>, ) -> S3ExpressSessionGranter

Replace the bound mode selection while retaining the stable bucket configuration.

Trait Implementations

impl Clone for S3ExpressSessionGranter

fn clone(&self) -> S3ExpressSessionGranter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for S3ExpressSessionGranter

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl GrantCredential for S3ExpressSessionGranter

type Credential = Credential

Credential used as the source and returned as the granted result.

fn required_valid_until( &self, _credential: &<S3ExpressSessionGranter as GrantCredential>::Credential, _expires_in: Option<Duration>, ) -> Timestamp

Return the timestamp through which the source credential must remain usable.

async fn grant_credential( &self, ctx: &Context, credential: &<S3ExpressSessionGranter as GrantCredential>::Credential, expires_in: Option<Duration>, ) -> Result<<S3ExpressSessionGranter as GrantCredential>::Credential, Error>

Grant a bounded, expiring credential from an existing service credential.