Module aws_credentials 

Native AWS Bedrock (Amazon Titan) embedding provider (sync ureq + SigV4). AWS credentials for the hand-rolled SigV4 signers (Bedrock embeddings here, Bedrock extraction in mentedb-extraction).

Resolution order, checked once at construction:

1. Static keys: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN for temporary credentials).
2. The container credentials endpoint used by ECS task roles and EKS Pod Identity: AWS_CONTAINER_CREDENTIALS_FULL_URI (with AWS_CONTAINER_AUTHORIZATION_TOKEN or _TOKEN_FILE when set), else AWS_CONTAINER_CREDENTIALS_RELATIVE_URI on 169.254.170.2.

Endpoint credentials are temporary, so they are cached and fetched again shortly before they expire. Profiles and EC2 instance metadata are not resolved; export keys or run in a container for those.

Structs

AwsCredentialSource

Where request signing gets its credentials from. Cheap to clone and safe to share across threads; endpoint credentials are cached between calls.

AwsCredentials

A resolved set of AWS credentials.

CredentialRefreshConfig

Settings for fetching credentials from the container endpoint.