#include <src/H5FDros3.h>

Detailed Description

Configuration structure for H5Pset_fapl_ros3() / H5Pget_fapl_ros3().

H5FD_ros3_fapl_t is a public structure that is used to pass configuration data to the H5FD_ROS3 driver via a File Access Property List. A pointer to an instance of this structure is a parameter to H5Pset_fapl_ros3() and H5Pget_fapl_ros3().

Data Fields
bool	authenticate
char	aws_region [32+1]
char	secret_id [128+1]
char	secret_key [128+1]
int32_t	version

Field Documentation

◆ authenticate

bool authenticate

A Boolean which specifies if security credentials from this structure should be used for accessing a S3 bucket.

If true, ALL credentials must come from the FAPL and no attempt will be made to load credentials from other places. In this case, both secret_id and secret_key must be non-empty strings. If only one of secret_id or secret_key are non-empty strings while the other is an empty string, an error will be returned when opening a file. If a session token is to be used in this case, it must be specified with H5Pset_fapl_ros3_token().

If false, the ROS3 VFD will instead load credentials with the default credential provider chain from the aws-c-auth library, the same chain used by the AWS CLI and the AWS SDKs, in this order:

From the environment, by checking the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN environment variables
From the AWS profile files, by reading from ~/.aws/config and ~/.aws/credentials, by default. The specific files read from can be overridden with the AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE environment variables, and the profile read from can be selected with the AWS_PROFILE environment variable. Within the selected profile, this step supports:
- Assuming a role, with the role_arn setting together with source_profile or credential_source
- An external credential helper program, with the credential_process setting
- Static credentials, with the aws_access_key_id, aws_secret_access_key, and aws_session_token settings
From STS, by using AssumeRoleWithWebIdentity. This covers the AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, and AWS_ROLE_SESSION_NAME environment variables and the web_identity_token_file profile setting, as used by IAM Roles for Service Accounts on EKS
From container credentials, as provided on ECS and EKS, when the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI or AWS_CONTAINER_CREDENTIALS_FULL_URI environment variable is set
From EC2 instance metadata

If the ROS3 VFD cannot source credentials from any of these locations, it will fallback to using anonymous credentials. This is how objects in public buckets are read. Note that it also means a misconfigured profile results in unsigned requests rather than an error, which usually surfaces later as an HTTP 403 response from the server.

See Credentials for the rest, including the AWS IAM Identity Center (SSO) limitation and the EC2 instance metadata timeout.

◆ aws_region

char aws_region[32+1]

A string which specifies the AWS region of the S3 bucket, e.g. "us-east-1". Specifying an AWS region is always required for the ROS3 VFD, though it does not need to be specified here in the FAPL. The ROS3 VFD looks for the AWS region in the following places, in order:

The FAPL, if aws_region is not an empty string
The AWS_REGION environment variable
The AWS_DEFAULT_REGION environment variable
The AWS configuration file (~/.aws/config by default)
- The 'default' profile from this file is used, unless a different profile is specified with the AWS_PROFILE environment variable

If the ROS3 VFD cannot determine an AWS region from one of these locations, an error will be returned when opening a file.

◆ secret_id

char secret_id[128+1]

A string which specifies the security ID.

◆ secret_key

char secret_key[128+1]

A string which specifies the security key.

◆ version

int32_t version

Version number of the H5FD_ros3_fapl_t structure. Any instance passed to H5Pset_fapl_ros3() / H5Pget_fapl_ros3() must have a recognized version number or an error will be raised. Currently, this field should be set to H5FD_CURR_ROS3_FAPL_T_VERSION.

The documentation for this struct was generated from the following file:

src/H5FDros3.h