Enum S3Credentials 

pub enum S3Credentials {
    Static {
        access_key_id: String,
        secret_access_key: String,
        session_token: Option<String>,
    },
    DefaultChain {
        profile: Option<String>,
    },
}

How S3Origin obtains AWS credentials.

Static carries the cleartext bytes — the wiring layer in decdn-node is responsible for unwrapping decdn_common::config::secret::SecretString before passing them here. By the time credentials reach the SDK they are plain bytes either way (the SDK’s Credentials::new takes &str/String).

The Debug impl is manual to preserve the redaction discipline across the resolve→runtime boundary: Static’s key fields print as "***" so a stray tracing::debug!(?creds) or panic-backtrace cannot leak the credential bytes. DefaultChain’s profile is operator-set configuration and prints in cleartext (no secret content).

Variants

Static

Explicit IAM access key + secret + optional STS session token.

Fields

access_key_id: String

AWS access key ID.

secret_access_key: String

AWS secret access key.

session_token: Option<String>

Optional STS session token (for temporary credentials).

DefaultChain

Use the AWS default credential chain. Identical to aws-cli’s discovery: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars, then ~/.aws/credentials (selecting profile if set), then container / instance role via IMDS.

Fields

profile: Option<String>

Profile name override for ~/.aws/credentials.

Trait Implementations

impl Clone for S3Credentials

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for S3Credentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.