Function getAWSCredentialConfig

packages/components/src/awsToolsUtils.ts:76–115

(nodeData: INodeData, options: ICommonObject, region?: string)

 *   External ID) — The full error is logged server-side.
 */
export async function getAWSCredentialConfig(nodeData: INodeData, options: ICommonObject, region?: string): Promise<AWSCredentialConfig> {
    const credentialData = await getCredentialData(nodeData.credential ?? '', options)
    const awsRegion = region || DEFAULT_AWS_REGION

    const accessKeyId = getCredentialParam('awsKey', credentialData, nodeData)
    const secretAccessKey = getCredentialParam('awsSecret', credentialData, nodeData)
    const sessionToken = getCredentialParam('awsSession', credentialData, nodeData)
    const roleArn = getCredentialParam('roleArn', credentialData, nodeData)
    const externalId = getCredentialParam('externalId', credentialData, nodeData)

    // --- AssumeRole flow ---
    if (roleArn) {
        if (!AWS_ROLE_ARN_REGEX.test(roleArn)) {
            throw new Error('Invalid Role ARN format: Expected format: arn:aws:iam::<12-digit-account-id>:role/<role-name>')
        }
        const assumedCredentials = await assumeRole({
            accessKeyId,
            secretAccessKey,
            sessionToken,
            roleArn,
            externalId,
            region: awsRegion,
            logger: options.logger
        })
        return { credentials: assumedCredentials, region: awsRegion }
    }

    // --- Static credentials flow (backward-compatible) ---
    if (accessKeyId && secretAccessKey) {
        const credentials: AWSCredentials = {
            accessKeyId,
            secretAccessKey,
            ...(sessionToken && { sessionToken })
        }
        return { credentials, region: awsRegion }
    }

    // No explicit keys and no role — let SDK use default chain
    return { credentials: undefined, region: awsRegion }
}

/**
 * Assume an IAM role using AWS STS and return temporary session credentials.