Struct S3CredentialConfig 

pub struct S3CredentialConfig {
    pub access_key_id: String,
    pub secret_access_key: String,
}

[serve.s3_credential] — a node-level base S3 credential source (#505) sourcing the base AWS credential from boatramp’s [secrets] sealed store rather than the ambient env chain. Consumed by BOTH the S3 blob object backend and the AWS blob-upload cloud minter (one shared source, since it is the same bucket key). Additive/non-breaking: absent ⇒ the ambient AWS env chain (unchanged).

The access_key_id is a public identifier (plain config). The secret_access_key is a secret reference in the same scheme the guest secrets map uses: boatramp:<name> (the project-scoped sealed store, resolved under the reserved default project — multi-tenant-safe, never the host env), env:<VAR> / a bare <VAR> (the operator’s own environment — honored only when the posture’s allow_env_secret_refs is set), unsealed at serve startup via the [secrets] [KeyEnvelope]. The resolved plaintext is held in memory only (never env/argv/git/logs); see the redacted SealedS3Credential the resolver produces.

Fields

access_key_id: String

The AWS access key id — a public identifier, not a secret, so it is plain config (mirrors how an access_key_id is a public value in the S3-ingress credential model). Empty is refused at resolution.

secret_access_key: String

The secret access key, expressed as a secret reference (never the raw secret in the config text): boatramp:<name> (the project-scoped sealed store), env:<VAR> or a bare <VAR> (the operator env, posture-gated by allow_env_secret_refs). Unsealed at startup via the [secrets] envelope; the resolved value is redacted from Debug/logs. A boatramp:/env: ref configured with NO [secrets] envelope is a fail-closed startup error.

Trait Implementations

impl Clone for S3CredentialConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for S3CredentialConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for S3CredentialConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for S3CredentialConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for S3CredentialConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.