aws/internal/providers/sts_web_identity

STS AssumeRoleWithWebIdentity provider — the IRSA (IAM Roles for Service Accounts) flow used inside EKS pods and any other environment that hands you a signed identity token plus an IAM role to assume.

Flow:

1. Read the web identity token from AWS_WEB_IDENTITY_TOKEN_FILE at fetch time (IRSA rotates the token periodically; we must not pin it at provider construction).
2. POST form-encoded Action=AssumeRoleWithWebIdentity to STS with RoleArn, RoleSessionName, WebIdentityToken, and a duration.
3. Pull the credentials out of the XML response.

XML is parsed with simple <Tag>value</Tag> string scans — the STS response shape is fixed and well-known, so a real XML parser would be over-investment.

pub type Error {
  Misconfigured(reason: String)
  Failed(reason: String)
}

pub type Options {
  Options(
    endpoint: String,
    role_arn: String,
    role_session_name: String,
    token: String,
    duration_seconds: Int,
  )
}

pub type StsCredentials {
  StsCredentials(
    access_key_id: String,
    secret_access_key: String,
    session_token: String,
    expires_at: Int,
  )
}

pub fn fetch(
  send: fn(request.Request(BitArray)) -> Result(
    response.Response(BitArray),
    http_send.HttpError,
  ),
  options: Options,
) -> Result(StsCredentials, Error)