Skip to content

yggdrasil.aws.config

config

AWS wire-format credential records.

The :class:AWSClient in :mod:.client owns both the configuration and the behavior — there is no separate AWSConfig class. This module holds the passive wire records that flow into the client and the refresher callable type.

  • :class:AwsCredentials mirrors AWS STS's Credentials shape and is what services (Databricks Storage Credentials, STS, etc.) hand back. Convert into an :class:AWSClient via :meth:AWSClient.from_credentials.

  • :class:DatabricksSQLCredentialsRefresher is a picklable refresher that re-runs a Databricks SQL query for fresh creds; wired up by :meth:AWSClient.from_databricks_sql.

  • :data:CredentialsRefresher is the callable type for vended-creds flows — anything returning :class:AwsCredentials or a botocore metadata mapping.

AwsCredentials dataclass 

AwsCredentials(
    access_key_id: Optional[str] = None,
    access_point: Optional[str] = None,
    secret_access_key: Optional[str] = None,
    session_token: Optional[str] = None,
    expiration: Optional[str] = None,
)

AWS temporary credentials for API authentication.

Mirrors AWS STS's Credentials shape and the equivalent Databricks-issued temporary credentials. See https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html.

access_key_id class-attribute instance-attribute 

access_key_id: Optional[str] = None

The access key ID that identifies the temporary credentials.

access_point class-attribute instance-attribute 

access_point: Optional[str] = None

The Amazon Resource Name (ARN) of the S3 access point for temporary credentials related to the external location.

secret_access_key class-attribute instance-attribute 

secret_access_key: Optional[str] = None

The secret access key that can be used to sign AWS API requests.

session_token class-attribute instance-attribute 

session_token: Optional[str] = None

The token that users must pass to AWS API to use the temporary credentials.

expiration class-attribute instance-attribute 

expiration: Optional[str] = None

ISO-8601 timestamp at which the credentials expire. Optional on construction; STS-issued creds always have one, long-lived keys don't.

is_complete 

is_complete() -> bool

True iff at least access_key_id + secret_access_key are set.

to_botocore_metadata 

to_botocore_metadata() -> Mapping[str, Optional[str]]

Render as the metadata dict botocore's RefreshableCredentials expects.

Used by :class:AWSClient when seeding refreshable creds from an initial static :class:AwsCredentials snapshot.

DatabricksSQLCredentialsRefresher dataclass 

DatabricksSQLCredentialsRefresher(
    query: str,
    client: Optional["DatabricksClient"] = None,
    columns: Optional[dict[str, str]] = None,
    column_aliases: dict[str, tuple[str, ...]] = dict(),
)

Refresher that re-runs a Databricks SQL query for fresh AWS credentials.

Picklable by design — closure-free so botocore can hand the refresher to a Spark worker, a multiprocessing pool, or a cross-process job runner without cloudpickle. Serialization follows the project rule: the dataclass body holds plain picklable fields, the :class:DatabricksClient (when explicitly set) goes through its own URL-based round-trip, and the lazy DatabricksClient.current() fallback is resolved inside :meth:__call__ so the refresher stays constructible at module-import time without a live workspace.

Mapped to :class:AwsCredentials via column_aliases — each canonical field tries the user-provided columns override first, then walks the alias tuple in order. Per-call columns overrides win over the default :data:DATABRICKS_SQL_CREDENTIAL_COLUMNS.

query instance-attribute 

query: str

SQL query that returns at least one row of credentials.

client class-attribute instance-attribute 

client: Optional['DatabricksClient'] = None

Workspace to query. None resolves to :meth:DatabricksClient.current lazily on first call.

columns class-attribute instance-attribute 

columns: Optional[dict[str, str]] = None

Per-call column-name overrides keyed by canonical field (access_key_id / secret_access_key / session_token / expiration). Wins over :attr:column_aliases.

column_aliases class-attribute instance-attribute 

column_aliases: dict[str, tuple[str, ...]] = field(default_factory=dict)

Fallback alias tuples per canonical field. Populated from :data:DATABRICKS_SQL_CREDENTIAL_COLUMNS by :meth:AWSClient.from_databricks_sql; pre-snapshotted so the refresher survives a cross-process pickle without depending on the receiver's class-var defaults.