# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

id: aws
display_name: AWS
description: Generic AWS access via STS temporary credentials
category: other
credentials:
  - name: access_key_id
    description: AWS access key ID (gateway-minted via STS)
    env_vars: [AWS_ACCESS_KEY_ID]
    required: true
    refresh:
      strategy: aws_sts_assume_role
      refresh_before_seconds: 300
      max_lifetime_seconds: 3600
      # One AssumeRole call mints all three AWS credentials. The refresh is
      # attached to access_key_id (primary); these outputs co-manage the
      # secret key and session token on their sibling credentials.
      additional_outputs:
        - output: secret_access_key
          credential: secret_access_key
        - output: session_token
          credential: session_token
      material:
        - name: role_arn
          description: ARN of the IAM role to assume
          required: true
          secret: false
        - name: session_name
          description: Session name for CloudTrail attribution
          required: false
          secret: false
        - name: external_id
          description: External ID for cross-account role assumption
          required: false
          secret: false
        - name: aws_region
          description: AWS region for STS endpoint
          required: false
          secret: false
        - name: aws_access_key_id
          description: Long-lived IAM access key (only needed if gateway lacks ambient AWS credentials)
          required: false
          secret: false
        - name: aws_secret_access_key
          description: Long-lived IAM secret key (only needed if gateway lacks ambient AWS credentials)
          required: false
          secret: true
        - name: aws_session_token
          description: Session token for temporary source credentials (SSO or a prior AssumeRole); requires the access/secret pair
          required: false
          secret: true
  - name: secret_access_key
    description: AWS secret access key (co-managed with access_key_id)
    env_vars: [AWS_SECRET_ACCESS_KEY]
    required: true
  - name: session_token
    description: AWS session token (co-managed with access_key_id)
    env_vars: [AWS_SESSION_TOKEN]
    required: true