@aws-sdk/token-providers

What is @aws-sdk/token-providers?

@aws-sdk/token-providers is a package within the AWS SDK for JavaScript that provides various token providers for acquiring and managing tokens used for authentication and authorization with AWS services.

What are @aws-sdk/token-providers's main functionalities?

FromSSOToken

This feature allows you to create a token provider that retrieves tokens from AWS Single Sign-On (SSO). The code sample demonstrates how to configure the SSO token provider with a specific SSO session.

const { fromSSOToken } = require('@aws-sdk/token-providers');
const ssoTokenProvider = fromSSOToken({
  ssoClient: new SSOClient({ region: 'us-west-2' }),
  ssoSession: 'my-sso-session'
});

FromWebIdentityToken

This feature allows you to create a token provider that retrieves tokens from a web identity token file. The code sample demonstrates how to configure the web identity token provider with a specific role ARN and token file path.

const { fromWebIdentityToken } = require('@aws-sdk/token-providers');
const webIdentityTokenProvider = fromWebIdentityToken({
  roleArn: 'arn:aws:iam::123456789012:role/WebIdentityRole',
  webIdentityTokenFile: '/path/to/token'
});

FromCognitoIdentity

This feature allows you to create a token provider that retrieves tokens from Amazon Cognito Identity. The code sample demonstrates how to configure the Cognito identity token provider with a specific identity pool ID and logins.

const { fromCognitoIdentity } = require('@aws-sdk/token-providers');
const cognitoIdentityProvider = fromCognitoIdentity({
  identityPoolId: 'us-west-2:example-pool-id',
  logins: {
    'cognito-idp.us-west-2.amazonaws.com/us-west-2_example': 'example-token'
  }
});

Other packages similar to @aws-sdk/token-providers

aws-sdk

The 'aws-sdk' package is the official AWS SDK for JavaScript, which includes a wide range of services and features for interacting with AWS. It provides comprehensive support for AWS services, including token management, but it is a larger package compared to @aws-sdk/token-providers, which is more focused on token providers.

aws-amplify

The 'aws-amplify' package is a JavaScript library for frontend and mobile developers building cloud-enabled applications. It includes support for authentication, including token management with Amazon Cognito. While it offers similar functionalities, it is more geared towards frontend development and user authentication flows.

aws-cdk

The 'aws-cdk' package is the AWS Cloud Development Kit, which allows developers to define cloud infrastructure using code. It includes support for managing authentication and authorization tokens as part of infrastructure as code. However, it is primarily focused on infrastructure management rather than just token providers.

README

@aws-sdk/token-providers

A collection of all token providers. The token providers should be used when the authorization type is going to be token based. For example, the bearer authorization type set using httpBearerAuth trait in Smithy.

Static Token Provider

import { fromStatic } from "@aws-sdk/token-providers";

const token = { token: "TOKEN" };
const staticTokenProvider = fromStatic(token);

const staticToken = await staticTokenProvider(); // returns { token: "TOKEN" }

SSO Token Provider

import { fromSso } from "@aws-sdk/token-providers";

// returns token from SSO token cache or ssoOidc.createToken() call.
const ssoToken = await fromSso();

Token Provider Chain

import { nodeProvider } from "@aws-sdk/token-providers";

// returns token from default providers.
const token = await nodeProvider();

Development

This package contains a minimal copy of the SSO OIDC client, instead of relying on the full client, which would cause a circular dependency.

When regenerating the bundled version of the SSO OIDC client, run the esbuild.js script and then make the following changes:

• Remove any dependency of the generated client on the credential chain such that it would create a circular dependency back to this package. Because we only need the CreateTokenCommand, the client, and this command's associated Exceptions, it is possible to remove auth dependencies.
• Ensure all required packages are declared in the package.json of token-providers.

Changelog

3.723.0 (2025-01-06)

Features

• client-iotsecuretunneling: Adds dualstack endpoint support for IoT Secure Tunneling (513f9c4)
• client-supplychain: Allow vanity DNS domain when creating a new ASC instance (0cdf2e3)
• clients: update client endpoints as of 2025-01-06 (db366a2)