Swiftpack.co -  amzn/smoke-aws-credentials as Swift Package
Swiftpack.co is a collection of thousands of indexed Swift packages. Search packages.
A library to obtain and assume automatically rotating AWS IAM roles written in the Swift programming language.
.package(url: "https://github.com/amzn/smoke-aws-credentials.git", from: "2.0.1")

Build - Master Branch Swift 5.2, 5.3 and 5.4 Tested Ubuntu 18.04 and 20.04 Tested CentOS 8 Tested Amazon Linux 2 Tested Join the Smoke Server Side community on gitter Apache 2


The SmokeAWSCredentials package is a library for obtaining or assuming short-lived rotating AWS IAM credentials, suitable for being passed to clients from https://github.com/amzn/smoke-aws.

Conceptual overview

This package provides two mechanisms for obtaining credentials-

  • obtaining credentials from a container environment such as Elastic Container Service (ECS)
  • assuming credentials using existing credentials

Getting Started

Step 1: Add the SmokeAWSCredentials dependency

SmokeAWSCredentials uses the Swift Package Manager. To use the framework, add the following dependency to your Package.swift and depend on the SmokeAWSCredentials target from this package-

For swift-tools version 5.2 and greater-

dependencies: [
    .package(url: "https://github.com/amzn/smoke-aws-credentials", from: "2.0.0")

.target(name: ..., dependencies: [
    .product(name: "SmokeAWSCredentials", package: "smoke-aws-credentials"),

For swift-tools version 5.1 and prior-

dependencies: [
    .package(url: "https://github.com/amzn/smoke-aws-credentials", from: "2.0.0")

    name: ...,
    dependencies: [..., "SmokeAWSCredentials"]),

Step 2: Obtain a credentials provider from a container environment such as Elastic Container Service (ECS)

Once your application is depending in SmokeAWSCredentials, you can use AwsContainerRotatingCredentialsProvider to obtain credentials from a container environment such as Elastic Container Service (ECS).

guard let credentialsProvider = 
    AwsContainerRotatingCredentialsProvider.get() else {
        Log.error("Unable to obtain credentials from the container environment.")

The returned provider will mange the short lived credentials and rotate them when required. To get the current credentials-

    let currentCredentials = credentialsProvider.credentials

The credentials returned will be valid for at least 5 minutes from the time this call is made.

When you no longer need these credentials, you can stop the background credentials rotation.


Step 3: Assuming credentials using existing credentials

SmokeAWSCredentials also allows you to assume short-lived credentials - maybe from another account or with different permissions -based on existing credentials. The following API reference discusses how assuming roles is handled-

    guard let assumedCredentials = credentialsProvider.getAssumedRotatingCredentials(
        roleArn: roleArn,
        roleSessionName: roleSessionName,
        durationSeconds: assumedRoleDurationSeconds) else {
            Log.error("Unable to obtain assume credentials for arn '\(roleArn)'.")

When you no longer need these credentials, you can stop the background credentials rotation.


Note: If you stop the rotation of the parent credentials provider, the assumed credentials will eventually fail to rotate due to invalid parent credentials.

Step 4: Using custom credentials in development

It is likely that your development environment will not have the same credentials available as production. AwsContainerRotatingCredentialsProvider has the ability to use static credentials from the AWS_SECRET_ACCESS_KEY and AWS_ACCESS_KEY_ID environment variables if these variables are available. For situations where static credentials are not acceptable, if the DEBUG compiler flag and the AwsContainerRotatingCredentialsProvider.devIamRoleArnEnvironmentVariable environment variable are set, this library will make the call the following shell script with the provided role-

  • /usr/local/bin/get-credentials.sh -r <role> -d <role life time in seconds>

This script can use this role to obtain credentials. If the output of this script can be JSON-decoded with the ExpiringCredentials struct, these credentials will be used for this provider. If the script returns credentials with an expiration, the provider will manage rotation, re-calling this script for updated credentials.

For convenience, AwsContainerRotatingCredentialsProvider.get optionally accepts the current environment variables.

    #if DEBUG
    let environment = [...,
    let environment = ProcessInfo.processInfo.environment
    guard let credentialsProvider = 
        AwsContainerRotatingCredentialsProvider.get(fromEnvironment: environment) else {
            return Log.error("Unable to obtain credentials from the container environment.")


This library is licensed under the Apache 2.0 License.


Stars: 15
Last commit: 3 weeks ago

Ad: Job Offers

iOS Software Engineer @ Perry Street Software
Perry Street Software is Jack’d and SCRUFF. We are two of the world’s largest gay, bi, trans and queer social dating apps on iOS and Android. Our brands reach more than 20 million members worldwide so members can connect, meet and express themselves on a platform that prioritizes privacy and security. We invest heavily into SwiftUI and using Swift Packages to modularize the codebase.

Release Notes

Align platforms with requirements from dependencies
3 weeks ago

This release of SmokeAWSCredentials provides compatibility with Swift 5.2, Swift 5.3 and Swift 5.4 using SwiftNIO 2.x.

  1. Align platforms with requirements from dependencies. (#24)

Swiftpack is being maintained by Petr Pavlik | @ptrpavlik | @swiftpackco | API