Metadata-Version: 2.5
Name: aws-credentials-sts
Version: 0.2.0
Summary: STS-based credentials support for the AWS SDK for Python.
Project-URL: Code, https://github.com/aws/aws-sdk-python/tree/develop/packages/aws-credentials-sts/
Project-URL: Issue tracker, https://github.com/aws/aws-sdk-python/issues
Author: Amazon Web Services
License: Apache License 2.0
License-File: NOTICE
Keywords: aws,credentials,sdk,smithy,sts
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Natural Language :: English
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
Classifier: Programming Language :: Python :: Implementation :: CPython
Classifier: Topic :: Software Development :: Libraries
Requires-Python: >=3.12
Requires-Dist: aws-sdk-sts~=0.10.0
Requires-Dist: smithy-aws-core~=0.10.0
Requires-Dist: smithy-core~=0.8.0
Requires-Dist: smithy-http~=0.4.0
Description-Content-Type: text/markdown

# aws-credentials-sts

This package provides STS-based credential resolvers and a chain provider:

- `AssumeRoleCredentialsResolver` - assumes an explicit `role_arn` using
  credentials from a `source_resolver`.
- `ProfileAssumeRoleCredentialsResolver` - assumes a role configured in a
  named profile in the shared config/credentials files.

## Installation

```shell
uv pip install aws-credentials-sts
```

Once installed, the provider registers itself with the SDK's modular credential
chain. When a client resolves credentials through the default chain, it
will attempt to assume the role configured in the active profile
(`role_arn`/`source_profile`/`credential_source`), unless a higher-precedence
source resolves credentials first.

## Client Configuration

To use this resolver explicitly, set the `aws_credentials_identity_resolver`
property on a service client's config to an `AssumeRoleCredentialsResolver`
instance. It assumes `role_arn` using credentials from the `source_resolver`:

```python
from aws_credentials_sts import AssumeRoleCredentialsResolver
from smithy_aws_core.identity import EnvironmentCredentialsResolver

service_client = ServiceClient(
    config=ServiceClientConfig(
        aws_credentials_identity_resolver=AssumeRoleCredentialsResolver(
            source_resolver=EnvironmentCredentialsResolver(),
            role_arn="arn:aws:iam::123456789012:role/example-role",
        ),
    )
)
```

To assume the role defined in a named profile instead, use
`ProfileAssumeRoleCredentialsResolver` with a `MergedConfig` loaded from the
shared config/credentials files:

```python
from aws_credentials_sts import ProfileAssumeRoleCredentialsResolver
from smithy_aws_core.config import load_config


async def build_client() -> ServiceClient:
    return ServiceClient(
        config=ServiceClientConfig(
            aws_credentials_identity_resolver=ProfileAssumeRoleCredentialsResolver(
                profile_name="my-profile",
                config_file=await load_config(),
            ),
        )
    )
```

## Standalone

Either resolver can also be used on its own to fetch credentials directly:

```python
import asyncio

from aws_credentials_sts import AssumeRoleCredentialsResolver
from smithy_aws_core.identity import EnvironmentCredentialsResolver


async def main() -> None:
    resolver = AssumeRoleCredentialsResolver(
        source_resolver=EnvironmentCredentialsResolver(),
        role_arn="arn:aws:iam::123456789012:role/example-role",
    )
    identity = await resolver.get_identity(properties={})


asyncio.run(main())
```
