Enum S3Credentials 

pub enum S3Credentials {
    Static {
        access_key_id: SecretString,
        secret_access_key: SecretString,
        session_token: Option<SecretString>,
    },
    DefaultChain {
        profile: Option<String>,
    },
}

S3 credential source (#437). Tagged on the inner source field.

Static credential fields use SecretString so an incidental tracing::debug!(?cfg) or panic backtrace cannot leak the material — the wrapper redacts itself in Debug output, and its Serialize impl emits a non-reversible hashed placeholder rather than the cleartext, so any incidental serialization of the config is redacted too (see SecretString for the full contract). The codebase already redacts HTTP-origin URL credentials (see decdn_config_types::redact_for_log); this is the same pattern for TOML-borne secrets.

[cache.origin.credentials]
source = "static"
access_key_id = "AKIA..."
secret_access_key = "..."
# session_token = "..."        # optional

# — or —
[cache.origin.credentials]
source = "default-chain"
# profile = "my-profile"       # optional, override default profile

Variants

Static

Static IAM credentials embedded in the config file. Common for R2/B2/MinIO operator deployments where simple key-pair audit is preferred; for AWS S3, prefer the default credential chain so credentials live outside the TOML.

Fields

access_key_id: SecretString

AWS access key ID. Stored in SecretString so it redacts in Debug output alongside the secret key.

secret_access_key: SecretString

AWS secret access key. Redacted in Debug output.

session_token: Option<SecretString>

Optional STS session token (for assume-role / SSO flows where a static key isn’t enough on its own). Redacted.

DefaultChain

Use the standard AWS credential chain: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars, then ~/.aws/credentials profile, then IAM role / instance profile.

Fields

profile: Option<String>

Override the default profile name when reading ~/.aws/credentials. Threaded through to the SDK as the equivalent of the AWS_PROFILE env var.

Trait Implementations

impl Clone for S3Credentials

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for S3Credentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for S3Credentials

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for S3Credentials

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.