NewBackend constructs a *Backend wired to an STS-backed credentials provider. ctx is used only for the initial AWS config load (DNS lookups, IMDS, IRSA token reads); it is not retained for later operations.
(ctx context.Context, creds *Credentials)
| 79 | // provider. ctx is used only for the initial AWS config load (DNS lookups, |
| 80 | // IMDS, IRSA token reads); it is not retained for later operations. |
| 81 | func NewBackend(ctx context.Context, creds *Credentials) (*Backend, error) { |
| 82 | if err := creds.Validate(); err != nil { |
| 83 | return nil, err |
| 84 | } |
| 85 | |
| 86 | // Load the pod's ambient AWS identity once. Subsequent SDK calls |
| 87 | // reuse the resulting config; no per-request credential lookup |
| 88 | // against the pod identity is necessary. |
| 89 | awsCfg, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(creds.Region)) |
| 90 | if err != nil { |
| 91 | return nil, fmt.Errorf("loading aws config: %w", err) |
| 92 | } |
| 93 | |
| 94 | stsClient := sts.NewFromConfig(awsCfg) |
| 95 | |
| 96 | // The per-request credential provider closes over creds so it can |
| 97 | // build the session policy from the AP ARN and key prefix every time |
| 98 | // AWS asks for fresh credentials. NewCredentialsCache handles |
| 99 | // proactive refresh and concurrent-call deduplication. |
| 100 | // |
| 101 | // In dev mode we hand the provider the ambient credentials so it can |
| 102 | // return them directly without calling STS. The provider still |
| 103 | // enforces the requesting-org context discipline. |
| 104 | credProvider := aws.NewCredentialsCache(&sessionCredentialsProvider{ |
| 105 | stsClient: stsClient, |
| 106 | ambientCreds: awsCfg.Credentials, |
| 107 | useAmbientForRetrieve: devModeEnabled(), |
| 108 | creds: creds, |
| 109 | }) |
| 110 | |
| 111 | s3Client := s3.NewFromConfig(awsCfg, func(o *s3.Options) { |
| 112 | o.Credentials = credProvider |
| 113 | }) |
| 114 | |
| 115 | return &Backend{ |
| 116 | creds: creds, |
| 117 | stsClient: stsClient, |
| 118 | s3Client: s3Client, |
| 119 | }, nil |
| 120 | } |
| 121 | |
| 122 | // keyFor builds the bucket-level S3 key for a digest. Every tenant's |
| 123 | // objects live under a prefix derived from the requesting org carried in |