aws/internal/providers/ecs

ECS container credentials provider.

One HTTP GET to a URL the container runtime advertises in environment variables — typically http://169.254.170.2<relative-uri> inside an ECS/EKS task. Response shape is the same as IMDS step 3 (a JSON document with AccessKeyId, SecretAccessKey, Token, Expiration).

Auth token, when present, goes in the Authorization header verbatim. AWS Fargate gates the metadata endpoint with this token, so an empty value means “no auth header at all” (None) rather than “send the empty string”.

pub type EcsCredentials {
  EcsCredentials(
    access_key_id: String,
    secret_access_key: String,
    session_token: option.Option(String),
    expires_at: option.Option(Int),
  )
}

pub type Error {
  Unreachable(reason: String)
  Failed(reason: String)
}

pub type Options {
  Options(url: String, auth_token: option.Option(String))
}

pub fn fetch(
  send: fn(request.Request(BitArray)) -> Result(
    response.Response(BitArray),
    http_send.HttpError,
  ),
  options: Options,
) -> Result(EcsCredentials, Error)