Safe Haskell	None
Language	GHC2021

Ecluse.Config.Ambient

Description

The ambient cloud-SDK environment: the handful of AWS_* variables Écluse itself consults, read straight from the process environment at boot and carried beside the parsed configuration, never through the config document or its environment overlay.

Keeping them out of the config AST makes "secrets never live in the structured config" structural: a document key like awsSecretAccessKey is an unknown key and a loud parse failure, not a silently ignored ghost. The AWS SDK's own credential discovery (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, the instance role) is untouched; this record carries only the values Écluse reads explicitly.

Synopsis

data AmbientAws = AmbientAws {
- ambientAwsRegion :: Maybe Text
- ambientAwsEndpointUrlSqs :: Maybe Text
- ambientAwsEndpointUrl :: Maybe Text
}
ambientAwsFromEnv :: [(String, String)] -> AmbientAws
parseEndpointUrl :: Text -> Maybe (Bool, Text, Int)

Documentation

data AmbientAws Source #

The AWS_* values Écluse consults directly (region scoping and endpoint overrides); each is Nothing when the variable is unset. Blank-value handling stays with each consumer, so sourcing these ambiently changes no behaviour.

Constructors

AmbientAws

Fields

ambientAwsRegion :: Maybe Text
AWS_REGION: scopes the SQS mirror queue. (CodeArtifact's mint region comes from the mirror-target host, not from here.)
ambientAwsEndpointUrlSqs :: Maybe Text
AWS_ENDPOINT_URL_SQS: the SQS endpoint override (a local emulator or a VPC endpoint).
ambientAwsEndpointUrl :: Maybe Text
AWS_ENDPOINT_URL: the generic endpoint override, consulted by the S3 advisory-database client (the proxy's sync and Pilot's export).

Instances

Instances details

Show AmbientAws Source #
Instance details Defined in Ecluse.Config.Ambient Methods showsPrec :: Int -> AmbientAws -> ShowS # show :: AmbientAws -> String # showList :: [AmbientAws] -> ShowS #
Eq AmbientAws Source #
Instance details Defined in Ecluse.Config.Ambient Methods (==) :: AmbientAws -> AmbientAws -> Bool # (/=) :: AmbientAws -> AmbientAws -> Bool #

ambientAwsFromEnv :: [(String, String)] -> AmbientAws Source #

Read the ambient AWS values from the process environment (as getEnvironment returns it).

parseEndpointUrl :: Text -> Maybe (Bool, Text, Int) Source #

Parse an endpoint override URL (an ambientAwsEndpointUrl or ambientAwsEndpointUrlSqs value) into its (TLS flag, host, port). The scheme picks the TLS flag and the default port (443/80) when none is given; an absent scheme or a non-numeric port yields Nothing. The host[:port] authority is split by the shared bracket-aware splitHostPort, so a bracketed IPv6 literal ([::1]:4566) is split on its closing bracket, not on an inner colon, and the host is returned without brackets -- the same primitive the data-plane host extractor uses, so the two cannot drift on an authority edge case.