awsclient¶

Resolve the AWS credential chain once, and share it.

awsclient hands out an aws.Config — the thing every AWS service client is built from. It exists so that a process using several AWS-backed components resolves the credential chain once rather than once per component.

src := awsclient.Ambient(awsclient.WithRegion("eu-west-2"))

cfg, err := src.AWSConfig(ctx)          // resolved lazily, on first use
ssmClient := ssm.NewFromConfig(cfg)
s3Client  := s3.NewFromConfig(cfg)

Why you would import it¶

You would not, to use a single adapter — every adapter that needs AWS can resolve its own. You import this when you want one resolution feeding several: config-aws-ssm and config-aws-s3 together, or config alongside go/signing and go/encryption.

Sharing is an explicit act. Nothing here is process-global, and no adapter consults a hidden cache — because a hidden one would silently share credentials between components that may deliberately differ.

The rungs¶

Ambient and PerCall return the same Source interface, so changing posture is a one-word change. Choosing between them is a security decision, not a performance one.

It refuses to guess a region¶

There is no ambient AWS region convention that is safe to invent, so Ambient without a region errors with ErrNoRegion rather than choosing. Give it one:

awsclient.Ambient(awsclient.WithRegion("eu-west-2"))

Adopting a provider's own documented default is a different act from inventing one — and AWS documents none. This is the same reason vaultclient does adopt 127.0.0.1:8200.

Start here¶

• Getting started — one source, two service clients.
• Share one credential across components — config, signing and encryption over a single resolution.
• Holding credentials is a posture — why PerCall exists and when to take it.

Where this comes from¶

org spec 0003 — one module per provider (P-1), yielding the connection prerequisite rather than a service client (P-2).