Using AWS SDK for Swift credential providers

All requests to AWS must be cryptographically signed by using credentials issued by AWS. At runtime, the SDK retrieves configuration values for credentials by checking several locations.

If the retrieved configuration includes AWS IAM Identity Center single sign-on access settings, the SDK works with the IAM Identity Center to retrieve temporary credentials that it uses to make request to AWS services.

If the retrieved configuration includes temporary credentials, the SDK uses them to make AWS service calls. Temporary credentials consist of access keys and a session token.

Authentication with AWS can be handled outside of your codebase. Many authentication methods can be automatically detected, used, and refreshed by the SDK using the credential provider chain.

For guided options for getting started on AWS authentication for your project, see Authentication and access in the AWS SDKs and Tools Reference Guide.

The credential provider chain

If you don't explicitly specify a credential provider when constructing a client, the AWS SDK for Swift uses a credential provider chain that checks a series of places where you can supply credentials. Once the SDK finds credentials in one of these locations, the search stops.

Credential retrieval order

The credential provider chain searches for credentials using the following predefined sequence:

For details on AWS credential provider configuration settings, see Standardized credential providers in the Settings reference of the AWS SDKs and Tools Reference Guide.

Credential identity resolvers

A credential identity resolver is an object that takes some form of identity, verifies that it's valid for use by the application, and returns credentials that can be used when using an AWS service . There are several supported ways to obtain a valid identity, and each has a corresponding credential identity resolver type available for you to use, depending on which authorization methods you want to use.

The credential identity resolver acts as an adaptor between the identity and the AWS service. By providing a credential identity resolver to the service instead of directly providing the user's credentials, the service is able to fetch currently-valid credentials for the identity at any time, as long as the identity provider allows it.

Identity features in the AWS SDK for Swift are defined in the module AWSSDKIdentity. In the AWSSDKIdentity module, credentials are represented by the struct AWSCredentialIdentity. See AWS security credentials in the IAM User Guide for further information about AWS credentials.

There are several credential identity resolver types available as a means of obtaining an identity to use for authentication. Some credential identity resolvers are specific to a given source while others encompass an assortment of identity sources that share similar technologies. For example, the STSWebIdentityCredentialIdentityResolver, which uses a JSON Web Token (JWT) as the source identity for which to return AWS credentials. The JWT can come from a number of different services, including Amazon Cognito federated identities, Sign In With Apple, Google, or Facebook. See Identity pools third-party identity providers for information on third-party identity providers.

Getting credentials from an identity

The process of using a credential identity resolver involves four primary steps:

The following sections provide examples using some of the credential identity providers supported by AWS.

SSO credential identity resolvers with AWS IAM Identity Center

Authenticating for an AWS service using SSO requires first configuring SSO access using AWS IAM Identity Center. See IAM Identity Center authentication for your SDK or tool in the AWS SDKs and Tools Reference Guide for instructions on setting up IAM Identity Center and configuring SSO access on computers that will use your application.

Once a user has authenticated with the AWS Command Line Interface (AWS CLI) command aws sso login or aws sso login --profile profile-name, your application can use an SSOAWSCredentialIdentityResolver to obtain credentials using the established IAM Identity Center identity.

To create an SSO credential identity resolver, create a new SSOAWSCredentialIdentityResolver that uses the desired settings for the profile name, config file path, and credentials file path. Any of these can be nil to use the same default value the AWS CLI would use.

import AWSSDKIdentity

            let identityResolver = try SSOAWSCredentialIdentityResolver(
                profileName: profile,
                configFilePath: config,
                credentialsFilePath: credentials
            )

To use the IAM Identity Center identity resolver to provide credentials to an AWS service, set the service configuration's awsCredentialIdentityResolver to the created credential identity resolver.

        // Get an S3Client with which to access Amazon S3.
        let configuration = try await S3Client.S3ClientConfiguration(
            awsCredentialIdentityResolver: identityResolver
        )
        let client = S3Client(config: configuration)

        // Use "Paginated" to get all the buckets. This lets the SDK handle
        // the 'continuationToken' in "ListBucketsOutput".
        let pages = client.listBucketsPaginated(
            input: ListBucketsInput(maxBuckets: 10)
        )

With the service configured this way, each time the SDK accesses the AWS service, it uses the credentials returned by the SSO credential identity resolver to authenticate the request.

Static credential identity resolvers

Static credential identity resolvers use AWS credentials as an identity. To create a static credential identity resolver, create an AWSCredentialIdentity object with the static credentials, then create a new StaticAWSCredentialIdentityResolver that uses that identity.

import AWSSDKIdentity

        let credentials = AWSCredentialIdentity(
            accessKey: accessKey,
            secret: secretKey,
            sessionToken: sessionToken
        )

        let identityResolver = try StaticAWSCredentialIdentityResolver(credentials)

To use the static credential identity resolver to provide credentials to an AWS service, use it as the service configuration's awsCredentialIdentityResolver.

            let s3Configuration = try await S3Client.S3ClientConfiguration(
                awsCredentialIdentityResolver: identityResolver,
                region: region
            )
            let client = S3Client(config: s3Configuration)

            // Use "Paginated" to get all the buckets. This lets the SDK handle
            // the 'continuationToken' in "ListBucketsOutput".
            let pages = client.listBucketsPaginated(
                input: ListBucketsInput( maxBuckets: 10)
            )

When the service client asks the credential identity resolver for its credentials, the resolver returns the AWSCredentialIdentity struct's access key, secret, and session token.

The complete example is available on GitHub.

Additional information