pub struct Auth {Show 23 fields
pub kind: AuthKind,
pub issuer: Option<String>,
pub token_url: Option<String>,
pub device_authorization_url: Option<String>,
pub authorization_url: Option<String>,
pub client_id: Option<String>,
pub client_secret: Option<Secret>,
pub grant: Option<OAuthGrant>,
pub scopes: Vec<String>,
pub audience: Option<String>,
pub token: Option<Secret>,
pub header: Option<String>,
pub value: Option<Secret>,
pub region: Option<String>,
pub service: Option<String>,
pub source: Option<String>,
pub sso_start_url: Option<String>,
pub account_id: Option<String>,
pub role_name: Option<String>,
pub svid: Option<String>,
pub jwt_svid_file: Option<String>,
pub svid_file: Option<String>,
pub key_file: Option<String>,
}Expand description
A unified per-endpoint authentication provider. A flat, kind-discriminated
record: only the fields relevant to the chosen kind are set, and semantic
validation is what enforces which of them are required — the type itself
cannot, because every field is optional for some other kind.
Fields§
§kind: AuthKind§issuer: Option<String>Issuer base URL for .well-known metadata discovery (RFC 8414 / OIDC).
When set, it fills in whichever of the token / device-authorization /
authorization endpoints the document leaves unset.
token_url: Option<String>§client_id: Option<String>§client_secret: Option<Secret>A confidential client’s secret ({{secret:…}}); omit for a public client
(the device grant needs no secret).
grant: Option<OAuthGrant>device (default, interactive), authorization_code, or
client_credentials (headless M2M).
scopes: Vec<String>§audience: Option<String>§token: Option<Secret>A static bearer ({{secret:…}}) → Authorization: Bearer ….
header: Option<String>A static credential under an arbitrary header name (paired with value).
value: Option<Secret>§region: Option<String>§service: Option<String>The AWS service to sign for (e.g. bedrock, execute-api).
source: Option<String>The credential source: env / static, sso (IAM Identity Center
interactive login → temporary credentials), imds (the EC2 instance
role) or irsa (the Kubernetes projected service-account token).
Unset behaves as env.
sso_start_url: Option<String>aws source: sso — the IAM Identity Center portal start URL, the account,
and the permission-set role to assume (via agentd login).
account_id: Option<String>§role_name: Option<String>§svid: Option<String>The SVID type: jwt (a rotating JWT-SVID bearer read from a file) or
x509 (an mTLS client identity rather than a request signer).
jwt_svid_file: Option<String>Path to the SPIRE-written JWT-SVID token file (re-read per request, so a rotation is picked up).
svid_file: Option<String>Paths to the X.509-SVID cert + key (for svid: x509).
key_file: Option<String>