Struct ResolvedCredential 

pub struct ResolvedCredential {
    pub secret_access_key: String,
    pub session_token: Option<String>,
    pub principal: Principal,
    pub session_policies: Vec<String>,
    pub mfa_present: bool,
    pub token_issued_at: Option<DateTime<Utc>>,
    pub federated_provider: Option<String>,
    pub role_arn: Option<String>,
    pub federated_parent_arn: Option<String>,
}

Credentials resolved from an access key ID.

Returned by CredentialResolver::resolve. Holds both the secret access key (needed for SigV4 verification) and the resolved Principal (needed for IAM enforcement and GetCallerIdentity consolidation).

Fields

secret_access_key: String

session_token: Option<String>

principal: Principal

session_policies: Vec<String>

Session policies passed to the STS call that minted this credential. Empty for IAM user access keys.

mfa_present: bool

True iff the underlying STS credential was minted with MFA. Drives aws:MultiFactorAuthPresent for downstream IAM evaluation. Always false for raw IAM user access keys.

token_issued_at: Option<DateTime<Utc>>

Wall-clock time at which the underlying STS credential was issued. Drives aws:TokenIssueTime and aws:MultiFactorAuthAge (the latter computed at evaluation time as now - token_issued_at when Self::mfa_present is true). None for raw IAM user access keys — AWS does not expose aws:TokenIssueTime for long-lived credentials.

federated_provider: Option<String>

aws:FederatedProvider — SAML provider ARN for AssumeRoleWithSAML, OIDC provider ARN for AssumeRoleWithWebIdentity. None for raw IAM user keys, plain AssumeRole, GetSessionToken, GetFederationToken.

role_arn: Option<String>

For an assumed-role session, the IAM ARN (path included) of the role it assumed: the session’s aws:PrincipalArn. None for any other principal, or when the role no longer exists.

federated_parent_arn: Option<String>

For a federated user session, the ARN of the IAM user (or root user) that called GetFederationToken. None for any other principal, and for federated sessions minted before it was recorded.

Implementations

impl ResolvedCredential

pub fn principal_arn(&self) -> &str

Convenience accessors for the flat fields batch 3 callers use. Kept as methods rather than re-adding the fields to avoid making the shape inconsistent with Principal itself.

pub fn user_id(&self) -> &str

pub fn account_id(&self) -> &str

Trait Implementations

impl Clone for ResolvedCredential

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ResolvedCredential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ResolvedCredential

impl PartialEq for ResolvedCredential

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ResolvedCredential