# `ImagePipe.Source.S3.ContainerCredentials`
[🔗](https://github.com/hlindset/image_pipe/blob/v0.2.0/image_pipe/lib/image_pipe/source/s3/container_credentials.ex#L1)

Credential provider for ECS, Fargate, and EKS container credentials.

    credentials:
      {:provider, ImagePipe.Source.S3.ContainerCredentials,
       relative_uri: System.fetch_env!("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI")}

Pass the values the platform sets in the `AWS_CONTAINER_*` environment
variables. Fetching fails when neither `:full_uri` nor `:relative_uri` is
given. Setting up credentials is covered in
[Serving images from S3](serving-from-s3.md#choose-credentials).

## Options

* `:base_url` (`t:String.t/0`) - Base URL that `:relative_uri` is appended to. The default value is `"http://169.254.170.2"`.

* `:full_uri` (`t:String.t/0`) - Full credentials URL, from `AWS_CONTAINER_CREDENTIALS_FULL_URI`. Takes precedence over `:relative_uri`. Must use `https`, a loopback host, or the ECS or EKS credential endpoint, so the token can't be sent to another host.

* `:relative_uri` (`t:String.t/0`) - Credentials path, from `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`. Must start with `/`.

* `:auth_token` (`t:String.t/0`) - `Authorization` header value, from `AWS_CONTAINER_AUTHORIZATION_TOKEN`.

* `:auth_token_file` (`t:String.t/0`) - Path of a file holding the `Authorization` header value, from `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE`. The file is read again on every refresh, since the platform rotates it. Takes precedence over `:auth_token`.

* `:receive_timeout` (`t:non_neg_integer/0`) - Milliseconds to wait for each response. The default value is `2000`.

* `:connect_timeout` (`t:non_neg_integer/0`) - Milliseconds to wait for a connection. The default value is `2000`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*