credentials
etl_craft.dialects.credentials ¶
Short-lived credentials the engine obtains itself, once per new connection.
Two auth modes need one:
oauth: an OAuth 2.0 client-credentials grant (RFC 6749, section 4.4). The profile's client id and secret are exchanged at its token URL for an access token, which the dialect presents its own way (a password, a bearer header, a JWT).sts: an AWS RDS or Aurora IAM auth token, signed locally, optionally after assuming a role through AWS STS. boto3 is the optionaletl-craft[aws]extra, imported only here.
Both run inside the connection creator, so each new pooled connection gets a fresh credential,
and engines recycle pooled connections before one expires. Drivers that implement a flow
themselves (browser SSO, Snowflake's client credentials, libpq's OAuth) are given the settings
instead, and nothing here runs. Neither mode has run against a live identity provider or AWS
account in this project, which doctor reports.
MINTED_CREDENTIAL_POOL_RECYCLE_SECONDS
module-attribute
¶
Pooled connections authenticated with a minted credential are replaced after this long.
client_credentials_token ¶
client_credentials_token(token_url: str, client_id: str, client_secret: str, scope: str | None = None) -> str
Exchange a client id and secret for an access token.
The secret travels only in the POST body, never in a URL, and no error message repeats it.
Raises ConfigurationError when the endpoint refuses, cannot be reached, or answers
without an access token.
aws_rds_auth_token ¶
aws_rds_auth_token(host: str, port: int, user: str, region: str, role_arn: str | None = None) -> str
Return an RDS or Aurora IAM auth token, used in place of a password.
Credentials come from boto3's own chain (environment, shared config, instance or container
role, web identity). With role_arn, that identity first assumes the role and the token
is signed as the role. Raises ConfigurationError without boto3 or when signing fails.