# `ImagePipe.Source.S3.AssumeRole`
[🔗](https://github.com/hlindset/image_pipe/blob/v0.2.0/image_pipe/lib/image_pipe/source/s3/assume_role.ex#L1)

Credential provider that assumes an IAM role with STS `AssumeRole`, usually
a role in another account.

    credentials:
      {:provider, ImagePipe.Source.S3.AssumeRole,
       base: {:provider, ImagePipe.Source.S3.InstanceRole, []},
       role_arn: "arn:aws:iam::123456789012:role/image-read",
       region: "eu-west-1"}

It signs the STS call with the `:base` credentials. Setting up credentials
is covered in [Serving images from S3](serving-from-s3.md#choose-credentials).

## Options

* `:base` (`{:static, keyword()}` or `{:provider, module(), keyword()}`) - Required. Credentials allowed to assume `:role_arn`, in any form the `:credentials` option of `ImagePipe.Source.S3` takes. They are cached and refreshed separately.

* `:role_arn` (`t:String.t/0`) - Required. ARN of the role to assume.

* `:region` (`t:String.t/0`) - Required. Region of the STS endpoint, `sts.<region>.amazonaws.com`, also used to sign the call.

* `:external_id` (`t:String.t/0`) - External ID that the role's trust policy requires.

* `:role_session_name` (`t:String.t/0`) - Session name for the assumed role. The default value is `"image-pipe"`.

* `:receive_timeout` (`t:non_neg_integer/0`) - Milliseconds to wait for each response. The default value is `5000`.

* `:connect_timeout` (`t:non_neg_integer/0`) - Milliseconds to wait for a connection. The default value is `5000`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*