Module aws_support 

Credential policy the AWS-SDK clients share. What the AWS-SDK clients (dynamodb, sqs) share about credentials.

aws_config::defaults(..).load() runs the SDK’s default chain — environment, ~/.aws/credentials, then IMDS — and signs every request with whatever identity it finds. That is what an operator wants when they leave the target empty and mean AWS itself. It is never what they want against any other endpoint: endpoint_url is a startup parameter the model can set through open_client, and a SigV4 request to a model-chosen host carries the access key id, a signature over the request, and — on EC2 or under an assumed role — the session token itself in x-amz-security-token. A model talked into "endpoint_url": "http://attacker.example" handed the operator’s temporary credential to it in one request, and a client aimed at a local emulator quietly borrowed the operator’s real identity to do so.

Constants

MAX_REGION_LEN

The longest region name accepted. AWS’s own run to about 14 characters (ap-southeast-4, us-gov-west-1); the bound leaves room for new ones and for emulator-specific names while keeping the value a single short DNS label.

Functions

refuse_ambient_credentials

Refuse to build an SDK client that would sign requests to a non-AWS endpoint with this machine’s ambient credentials.

validate_region

Refuse a region that could change the host the SDK derives from it.