DefaultAWSCredentialsIdentityResolver behaviour

[AxelJunker]

I'm using the DefaultAWSCredentialsIdentityResolver to get credentials in order to create presigned S3 POST URLs which is not supported in the SDK yet.

Both GetCredentials() and GetCredentialsAsync() returns AwsCredentials which then can be used to call the same methods and get ImmutableCredentials. What's the difference between them, other than one of them being Async? Does it matter which one I use?

Also, should I call GetCredentials() (to get ImmutableCredentials) each time I generate a presigned URL, or is it enough to call it once at startup of my program? I'm guessing I have to call it each time since the credentials may expire?

I'm using AWSSDK.S3 version 4.0.1.3.

[normj]

It depends what subclass of AWSCredentials is resolved to by DefaultAWSCredentialsIdentityResolver. If it resolves to static credentials from your profile then the sync and async do the same. But if it resolves to a subclass that requires fetching or refreshing credentials like an assume role credential provider then the sync version will internally call async service or web call and block on that.

Our naming is not great here but think of AWSCredentials as essentially a credential provider handling fetching and refreshing credentials. The ImmutableCredentials is the immutable container of the access key id, secret key and possible session token at that point in time it is request from the credential provider.

That all being said we did recently start work in V4 for the S3 POST URLs. You can monitor progress in this branch https://github.com/aws/aws-sdk-net/tree/gcbeatty/presignedpostimpl. We don't have a definitive timeline and our priorities can get shifted out of our control so I don't want you to 100% depend on this getting finished in a timely manner but we are trying to squeeze the work in.

[AxelJunker]

Thank you for the response! And great that you started working on S3 POST URLs!

The credentials are loaded from the shared credentials file (~/.aws/credentials) when running locally, and by the Container credential provider when running on AWS ECS.

So I guess I should call GetCredentialsAsync() of the AWSCredentials class each time I need to create a URL, to be sure that I will have non-expired credentials and to not block the thread.

Do you know if GetCredentialsAsync() of the AWSCredentials class caches the credentials and fetches new ones only when they expire? I've tried to follow the source code but I keep getting lost 😄

[normj]

Yes all of our credential providers cache credentials and in most cases the GetCredentialsAsync will be a noop except when they need to be refreshed. We do refresh them a bit earlier then being expired to avoid corner case issues.

And in general whenever you can prefer the async versions of operations.