Repository navigation
feat(ses): support the AWS default credential chain - #284
Merged
Merged
Conversation
Allow the AWS SES provider to authenticate via the AWS default credential chain (IAM role, environment, shared config, web identity) instead of requiring static access keys. Add the AwsSesUseIAMRole option: when set, StartUp loads the SES client without static credentials, letting the SDK resolve them from its default provider chain. Static keys, when supplied, continue to take precedence, so existing configurations are unchanged. Extract the SES client construction into loadAwsSesService to keep StartUp flat, cover the IAM-role path in the StartUp tests, document the option in the README, and add a usage example.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Changed
Add an
AwsSesUseIAMRoleoption to the AWS SES provider. When enabled,StartUploads the SES client using the AWS default credential chain (IAM role, environment variables, shared config, or web identity) instead of requiring static access keys. Static credentials, when supplied, continue to take precedence, so existing configurations are unchanged.MailService.AwsSesUseIAMRoleconfig field (json/mapstructuretagaws_ses_use_iam_role).StartUpnow loads SES when either static keys or the IAM-role option is set.loadAwsSesServiceto keepStartUpflat.awsSesIAMRoleExample.Why It Was Necessary
When running on AWS compute (Lambda, ECS, EC2), credentials are provided by an attached IAM role and no static keys exist. Previously the SES provider only loaded when both an access id and secret key were set, so role-based deployments could not use it. This lets SES authenticate the same way the rest of the AWS SDK does by default.
Testing Performed
go build ./...,go vet ./...,go test ./...— all pass.TestMailService_StartUpAwsSesIAMRole: SES loads via the default chain with the option set and no static keys, and is skipped when neither keys nor the option are present. Existing static-key coverage inTestMailService_StartUpis unchanged.golangci-lintpasses with 0 issues;loadAwsSesServiceis ~93% covered.Impact / Risk
AwsSesUseIAMRole.aws-sdk-go-v2/configdefault credential chain.Notifications