aws.internal.SignOptions

Credential and region inputs for `sign_request` / `resolve_region`.

Reference version

Signature

class aws.internal.SignOptions

Credential and region inputs for sign_request / resolve_region.

Each field mirrors a client option. Everything except service is optional; unset fields fall through to the AWS provider chain.

Source:<builtin>/aws/ns_internal/auth.bamlbytes 537–1292

Fields

region

string | null

Explicit region; null resolves from AWS_REGION, AWS_DEFAULT_REGION, or the active profile.

profile

string | null

Named profile to read from the shared config/credentials files; null uses AWS_PROFILE, else default.

access_key_id

string | null

Explicit access key. Only used together with secret_access_key — a lone key id falls through to the chain rather than signing with half an identity.

secret_access_key

string | null

session_token

string | null

Session token for temporary credentials (STS/SSO), sent as x-amz-security-token.

service

string

The AWS service the signature is scoped to, e.g. "bedrock".