# `ImagePipe.Source.S3.WebIdentity`
[🔗](https://github.com/hlindset/image_pipe/blob/v0.2.0/image_pipe/lib/image_pipe/source/s3/web_identity.ex#L1)

Credential provider for EKS IAM roles for service accounts (IRSA), using
STS `AssumeRoleWithWebIdentity`.

    credentials:
      {:provider, ImagePipe.Source.S3.WebIdentity,
       token_file: System.fetch_env!("AWS_WEB_IDENTITY_TOKEN_FILE"),
       role_arn: System.fetch_env!("AWS_ROLE_ARN"),
       region: System.fetch_env!("AWS_REGION")}

It exchanges the token the cluster mounts into the pod for temporary
credentials. The STS call is unsigned, since the token authenticates it.
Setting up credentials is covered in
[Serving images from S3](serving-from-s3.md#choose-credentials).

## Options

* `:token_file` (`t:String.t/0`) - Required. Path of the web identity token, from `AWS_WEB_IDENTITY_TOKEN_FILE`. The file is read again on every refresh, since the platform rotates it.

* `:role_arn` (`t:String.t/0`) - Required. ARN of the role to assume, from `AWS_ROLE_ARN`.

* `:region` (`t:String.t/0`) - Required. Region of the STS endpoint, `sts.<region>.amazonaws.com`.

* `:role_session_name` (`t:String.t/0`) - Session name for the assumed role. The default value is `"image-pipe"`.

* `:receive_timeout` (`t:non_neg_integer/0`) - Milliseconds to wait for each response. The default value is `5000`.

* `:connect_timeout` (`t:non_neg_integer/0`) - Milliseconds to wait for a connection. The default value is `5000`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*