Struct Backend

pkg/blobmanager/s3accesspoint/backend.go:61–74

Backend is the per-tenant uploader/downloader. One *Backend instance is bound to one access point; the actual AWS credentials are minted per-request via STS using the org UUID found in the request context.

// bound to one access point; the actual AWS credentials are minted
// per-request via STS using the org UUID found in the request context.
type Backend struct {
	creds *Credentials

	// stsClient is built once at construction using the pod's ambient
	// IAM identity. The credential chain (IRSA → IMDS → env →
	// ~/.aws/credentials) picks up the identity automatically.
	stsClient stsAssumer

	// s3Client uses a custom CredentialsProvider that mints a scoped
	// session per request (cached in-process per requesting-org so back-
	// to-back uploads from the same org reuse the token). Bucket is
	// always the AP ARN; the SDK accepts an ARN there directly.
	s3Client *s3.Client
}

var _ backend.UploaderDownloader = (*Backend)(nil)