Skip to main content

Interface: S3AwsCredentialsOptions

How the S3 publisher obtains AWS credentials. Only the sources named here are consulted.

Properties​

configFile?​

readonly optional configFile?: string | null

The shared config file for source: "profile" or source: "sso-role-chain". AWS_CONFIG_FILE is not consulted.

Default​

~/.aws/config

credentialsFile?​

readonly optional credentialsFile?: string | null

The shared credentials file for source: "profile" or source: "sso-role-chain". AWS_SHARED_CREDENTIALS_FILE is not consulted.

Default​

~/.aws/credentials

env?​

readonly optional env?: S3AwsCredentialsEnvNames | null

Custom environment variable names for source: "env", e.g. to keep publish-only keys separate from ambient AWS_* variables.

profile?​

readonly optional profile?: string | null

The profile name for source: "profile" or source: "sso-role-chain" (required for those sources; AWS_PROFILE is not used as a fallback). Use default to select the [default] profile.

source​

readonly source: "env" | "profile" | "sso-role-chain"

The credential source (required, no default):

  • env: read only AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN (or the variable names given in env).
  • profile: read the named profile from the shared config/credentials files. Static keys, IAM Identity Center (SSO), credential_process and assume-role profiles are supported. An assume-role profile whose source_profile chain starts at an SSO profile is rejected; use sso-role-chain for it. credential_source, web identity (web_identity_token_file) and aws login sessions (login_session) anywhere in the chain are rejected: they read ambient credentials or settings.
  • sso-role-chain: profile names an assume-role profile (role_arn + source_profile). Its source_profile chain (up to 5 assume-role hops, no cycles) must end at an IAM Identity Center (SSO) profile. electron-builder resolves that SSO profile from the configured files, then calls STS AssumeRole for each hop with the previous hop's credentials. role_session_name, external_id and duration_seconds are honoured per hop; STS uses the named profile's region (else us-east-1) and sts_regional_endpoints. AWS_REGION and other AWS_* variables are not read. credential_source, mfa_serial, web_identity_token_file and credential_process are rejected in the chain.