yggdrasil.aws.provider¶
provider ¶
Abstract refreshable AWS credentials provider.
A provider vends fresh :class:AwsCredentials on demand and is
directly callable, so it slots straight into
:attr:AWSClient.refresher (which botocore re-invokes ~5 min before
each STS token expires).
Identity & singleton caching¶
Providers are cached process-wide per (cls, key) — two callers
asking for the same key collapse to one provider instance, which in
turn caches one :class:AWSClient per region. The credential vend,
the boto session, the connection pool, and the
:class:RefreshableCredentials cycle are all shared across every
caller on the same scope.
Subclasses¶
Subclasses implement :meth:get_credentials and pass a string
key to super().__init__ that uniquely identifies the
credential scope (volume id + operation, table id + operation, STS
role ARN, …). Everything else — the singleton dance, the per-region
:class:AWSClient cache, pickle hooks — is inherited.
AwsCredentialsProvider ¶
Bases: ABC
Abstract refreshable AWS credentials provider.
Construct with a string key that uniquely identifies the
credential scope. Two providers built with the same (cls, key)
collapse to the same instance.
get_credentials
abstractmethod
¶
Return a fresh :class:AwsCredentials. Called by botocore
~5 min before token expiry.
Subclasses that vend different credentials per read/write scope
(e.g. the Databricks UC providers) use mode to pick the
backing UC operation; providers that don't care about scope
ignore it. None means "the subclass's default mode".
aws_client ¶
Return the cached :class:AWSClient for this provider / region.
First call seeds a botocore :class:RefreshableCredentials
backed session by invoking self() once; subsequent calls
with the same region return the same live client (and
therefore share the connection pool, boto-client cache, and
in-flight refresh state). Different region values mint
different clients — boto region is a per-client concern.