github.com/aws/aws-sdk-go-v2 v1.47.0: aws.CredentialsProvider

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/aws/aws-sdk-go-v2/aws.CredentialsProvider in pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0
Demonstrate these symbols/APIs:
  - github.com/aws/aws-sdk-go-v2/aws.CredentialsProvider

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:230f7bdd963d1d753c89fb37c611bb891136fce9f5ae4a34de66371bc5d4b35b","contract":["CredentialsProvider interface can be implemented by a custom struct with Retrieve method","CredentialsProvider.Retrieve successfully returns valid Credentials when invoked with a context","CredentialsProviderFunc wraps a function value to satisfy the CredentialsProvider interface","CredentialsProvider propagation of error when Retrieve fails","NewCredentialsCache wraps a CredentialsProvider and caches unexpired credentials across calls","IsCredentialsProvider checks whether two CredentialsProvider instances share the same concrete type"],"goal":"verify github.com/aws/aws-sdk-go-v2/aws.CredentialsProvider in pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0","kind":"HOW","packages":["pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0"],"schemaVersion":1,"symbols":["github.com/aws/aws-sdk-go-v2/aws.CredentialsProvider"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0","symbols":["github.com/aws/aws-sdk-go-v2/aws.CredentialsProvider"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/aws/aws-sdk-go-v2 v1.47.0

require github.com/aws/smithy-go v1.28.5 // indirect

github.com/aws/aws-sdk-go-v2 v1.47.0 h1:0jsHallhJCeaU0Ko48c/3FK1ctOQ7NpzggxriJOQ8MQ=
github.com/aws/aws-sdk-go-v2 v1.47.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
github.com/aws/aws-sdk-go-v2 v1.47.3 h1:HRoT/MkNi3bjO5xF4dCzLzvVmkvRGHj3/cLINDnJejk=
github.com/aws/aws-sdk-go-v2 v1.47.3/go.mod h1:xSl+OSI5ZUw6bSMupWc218zE5Pl+65MCCu3ySWFY99A=
github.com/aws/smithy-go v1.28.5 h1:OqbqKtzY9NUnr2yAe9+hiTdFb20tNaK/lI0PMOGXX9k=
github.com/aws/smithy-go v1.28.5/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=

package main

import (
	"context"
	"fmt"

	"github.com/aws/aws-sdk-go-v2/aws"
)

type staticCredentialsProvider struct {
	creds aws.Credentials
}

func (p staticCredentialsProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
	return p.creds, nil
}

func main() {
	ctx := context.Background()

	var provider aws.CredentialsProvider = staticCredentialsProvider{
		creds: aws.Credentials{
			AccessKeyID:     "mock-access-key-id",
			SecretAccessKey: "mock-secret-access-key",
			SessionToken:    "mock-session-token",
			Source:          "StaticCredentials",
		},
	}

	creds, err := provider.Retrieve(ctx)
	if err != nil {
		fmt.Printf("failed to retrieve credentials: %v\n", err)
		return
	}

	fmt.Printf("Retrieved credentials from source %s (hasKeys: %t, expired: %t)\n",
		creds.Source, creds.HasKeys(), creds.Expired())
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/aws/aws-sdk-go-v2/aws.CredentialsProvider in pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0"
  ],
  "symbols": [
    "github.com/aws/aws-sdk-go-v2/aws.CredentialsProvider"
  ]
}

package main

import (
	"context"
	"errors"
	"fmt"
	"os"
	"sync/atomic"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
)

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("PASS: all contract assertions satisfied")
}

type staticProvider struct {
	creds aws.Credentials
}

func (s staticProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
	return s.creds, nil
}

type failingProvider struct {
	err error
}

func (f failingProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
	return aws.Credentials{}, f.err
}

type countingProvider struct {
	count atomic.Int64
	creds aws.Credentials
}

func (c *countingProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
	c.count.Add(1)
	return c.creds, nil
}

func runContract() error {
	ctx := context.Background()

	// 1. CredentialsProvider interface can be implemented by a custom struct with Retrieve method
	validCreds := aws.Credentials{
		AccessKeyID:     "mock-access-key-id",
		SecretAccessKey: "mock-secret-access-key",
		SessionToken:    "mock-session-token",
		Source:          "StaticProvider",
		CanExpire:       false,
	}
	var provider aws.CredentialsProvider = staticProvider{creds: validCreds}
	if provider == nil {
		return fmt.Errorf("CredentialsProvider instance is nil")
	}

	// 2. CredentialsProvider.Retrieve successfully returns valid Credentials when invoked with a context
	retrieved, err := provider.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("provider.Retrieve failed unexpectedly: %w", err)
	}
	if retrieved.AccessKeyID != "mock-access-key-id" || retrieved.SecretAccessKey != "mock-secret-access-key" {
		return fmt.Errorf("retrieved credentials mismatch: %+v", retrieved)
	}
	if !retrieved.HasKeys() {
		return fmt.Errorf("expected HasKeys() to be true, got false")
	}
	if retrieved.Expired() {
		return fmt.Errorf("expected Expired() to be false for non-expiring credentials")
	}

	// 3. CredentialsProviderFunc wraps a function value to satisfy the CredentialsProvider interface
	funcInvoked := false
	var funcProvider aws.CredentialsProvider = aws.CredentialsProviderFunc(func(ctx context.Context) (aws.Credentials, error) {
		funcInvoked = true
		return aws.Credentials{
			AccessKeyID:     "func-access-key",
			SecretAccessKey: "func-secret-key",
			SessionToken:    "func-token",
			Source:          "FuncProvider",
		}, nil
	})

	funcCreds, err := funcProvider.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("CredentialsProviderFunc Retrieve failed: %w", err)
	}
	if !funcInvoked {
		return fmt.Errorf("CredentialsProviderFunc did not execute underlying function")
	}
	if funcCreds.Source != "FuncProvider" || !funcCreds.HasKeys() {
		return fmt.Errorf("unexpected credentials from CredentialsProviderFunc: %+v", funcCreds)
	}

	// 4. CredentialsProvider propagation of error when Retrieve fails
	expectedErr := errors.New("simulated retrieval error")
	var errProvider aws.CredentialsProvider = failingProvider{err: expectedErr}
	_, err = errProvider.Retrieve(ctx)
	if err == nil {
		return fmt.Errorf("expected error from failing provider, got nil")
	}
	if !errors.Is(err, expectedErr) {
		return fmt.Errorf("expected %v, got %v", expectedErr, err)
	}

	// 5. NewCredentialsCache wraps a CredentialsProvider and caches unexpired credentials across calls
	counter := &countingProvider{
		creds: aws.Credentials{
			AccessKeyID:     "cached-access-key",
			SecretAccessKey: "cached-secret-key",
			Source:          "CachedProvider",
			CanExpire:       true,
			Expires:         time.Now().Add(1 * time.Hour),
		},
	}
	var cachedProvider aws.CredentialsProvider = aws.NewCredentialsCache(counter)
	c1, err := cachedProvider.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("cachedProvider first retrieve failed: %w", err)
	}
	c2, err := cachedProvider.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("cachedProvider second retrieve failed: %w", err)
	}
	if c1.AccessKeyID != c2.AccessKeyID {
		return fmt.Errorf("cached credentials mismatch between calls")
	}
	if calls := counter.count.Load(); calls != 1 {
		return fmt.Errorf("expected exactly 1 provider invocation due to cache, got %d", calls)
	}

	// 6. IsCredentialsProvider checks whether two CredentialsProvider instances share the same concrete type
	sameType1 := staticProvider{}
	sameType2 := staticProvider{}
	diffType := failingProvider{}
	if !aws.IsCredentialsProvider(sameType1, sameType2) {
		return fmt.Errorf("expected IsCredentialsProvider to return true for matching types")
	}
	if !aws.IsCredentialsProvider(&sameType1, sameType2) {
		return fmt.Errorf("expected IsCredentialsProvider to return true when one is pointer of matching type")
	}
	if aws.IsCredentialsProvider(sameType1, diffType) {
		return fmt.Errorf("expected IsCredentialsProvider to return false for different types")
	}

	return nil
}