API Reference

PREVIEW DOCUMENTATION - This is a preview of a new format for the AWS SDK for Go API Reference documentation. For the current AWS SDK for Go API Reference, see

We welcome your feedback on this new version of the documentation. Send your comments to


import ""

Package processcreds is a credential Provider to retrieve `credential_process` credentials.

WARNING: The following describes a method of sourcing credentials from an external process. This can potentially be dangerous, so proceed with caution. Other credential providers should be preferred if at all possible. If using this option, you should make sure that the config file is as locked down as possible using security best practices for your operating system.

You can use credentials from a `credential_process` in a variety of ways.

One way is to setup your shared config file, located in the default location, with the `credential_process` key and the command you want to be called. You also need to set the AWS_SDK_LOAD_CONFIG environment variable (e.g., `export AWS_SDK_LOAD_CONFIG=1`) to use the shared config file.

[default] credential_process = /command/to/call

Creating a new session will use the credential process to retrieve credentials. NOTE: If there are credentials in the profile you are using, the credential process will not be used.

// Initialize a session to load credentials. sess, _ := session.NewSession(&aws.Config{ Region: aws.String("us-east-1")}, ) // Create S3 service client to use the credentials. svc := s3.New(sess)

Another way to use the `credential_process` method is by using `credentials.NewCredentials()` and providing a command to be executed to retrieve credentials:

// Create credentials using the ProcessProvider. creds := processcreds.NewCredentials("/path/to/command") // Create service client value configured for credentials. svc := s3.New(sess, &aws.Config{Credentials: creds})

You can set a non-default timeout for the `credential_process` with another constructor, `credentials.NewCredentialsTimeout()`, providing the timeout. To set a one minute timeout:

// Create credentials using the ProcessProvider. creds := processcreds.NewCredentialsTimeout( "/path/to/command", time.Duration(500) * time.Millisecond)

If you need more control, you can set any configurable options in the credentials using one or more option functions. For example, you can set a two minute timeout, a credential duration of 60 minutes, and a maximum stdout buffer size of 2k.

creds := processcreds.NewCredentials( "/path/to/command", func(opt *ProcessProvider) { opt.Timeout = time.Duration(2) * time.Minute opt.Duration = time.Duration(60) * time.Minute opt.MaxBufSize = 2048 })

You can also use your own `exec.Cmd`:

// Create an exec.Cmd myCommand := exec.Command("/path/to/command") // Create credentials using your exec.Cmd and custom timeout creds := processcreds.NewCredentialsCommand( myCommand, func(opt *processcreds.ProcessProvider) { opt.Timeout = time.Duration(1) * time.Second })