An environment with auth credentials. Most AWS requests need one of these, and you can create one with newEnv.

An environment with no auth credentials. Used for certain requests which need to be unsigned, like sts:AssumeRoleWithWebIdentity, and you can create one with newEnvNoAuth if you need it.

The environment containing the parameters required to make AWS requests.

This type tracks whether or not we have credentials at the type level, to avoid "presigning" requests when we lack auth information.

Creates a new environment with a new Manager without debug logging and uses the provided function to expand/discover credentials. Record updates or lenses can be used to further configure the resulting Env.

Since: 1.5.0 - The region is now retrieved from the AWS_REGION environment variable (identical to official SDKs), or defaults to us-east-1. You can override the Env region by updating its $sel:region:Env field.

Since: 1.3.6 - The default logic for retrying HttpExceptions now uses retryConnectionFailure to retry specific connection failure conditions up to 3 times. Previously only service specific errors were automatically retried. This can be reverted to the old behaviour by resetting the Env's $sel:retryCheck:Env field to (\_ _ -> False).

Throws AuthError when environment variables or IAM profiles cannot be read.

See: newEnvFromManager.

Creates a new environment, but with an existing Manager.

Generate an environment without credentials, which may only make unsigned requests. Sets the region based on the AWS_REGION environment variable, or NorthVirginia if unset.

This lets us support calls like the sts:AssumeRoleWithWebIdentity operation, which needs to make an unsigned request to pass the token from an identity provider.

Generate an environment without credentials, passing in an explicit Manager.

Get "the" Auth from an Env', if we can.

Provide a function which will be added to the existing stack of overrides applied to all service configurations.

Configure a specific service. All requests belonging to the supplied service will use this configuration instead of the default.

It's suggested you modify the default service configuration, such as Amazonka.DynamoDB.defaultService.

Override the timeout value for this Env.

Default timeouts are chosen by considering:

• This timeout, if set.
• The related Service timeout for the sent request if set. (Usually 70s)
• The $sel:manager:Env timeout if set.
• The default ClientRequest timeout. (Approximately 30s)

Disable any retry logic for an Env, so that any requests will at most be sent once.

Unwrap a ResourceT transformer, and call all registered release actions.

Note that there is some reference counting involved due to resourceForkIO. If multiple threads are sharing the same collection of resources, only the last call to runResourceT will deallocate the resources.

NOTE Since version 1.2.0, this function will throw a ResourceCleanupException if any of the cleanup functions throw an exception.

Since: resourcet-0.3.0

An access key ID.

For example: AKIAIOSFODNN7EXAMPLE

See: Understanding and Getting Your Security Credentials.

Secret access key credential.

For example: wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKE

See: Understanding and Getting Your Security Credentials.

A session token used by STS to temporarily authorise access to an AWS resource.

See: Temporary Security Credentials.

Attempt to fetch credentials in a way similar to the official AWS SDKs. The C++ SDK lists the following sequence:

• Check environment variables for keys provided directly (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, optionally AWS_SESSION_TOKEN)
• Check credentials/config files for authentication information, respecting the AWS_PROFILE environment variable.
• Exchange a Web Identity for AWS Credentials using sts:AssumeRoleWithWebIdentity, respecting the AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, and optionally the AWS_ROLE_SESSION_NAME environment variables.
• Retrieve credentials from the ECS Container Agent if the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set.

• If we think we're running on EC2, retrieve the first available IAM profile from the instance identity document, and use this to set the Placement. We attempt to resolve http://instance-data rather than directly retrieving http://169.254.169.254 for IAM profile information. This ensures that the DNS lookup terminates promptly if not running on EC2, but means that your VPC must have enableDnsSupport and enableDnsHostnames set.

  NOTE: This is not 100% consistent with the AWS SDKs, which does not attempt to query the ECS service if either AWS_CONTAINER_CREDENTIALS_RELATIVE_URI or AWS_CONTAINER_CREDENTIALS_FULL_URI are set.

  See: https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/EC2ContainerCredentialsProviderWrapper.html

The available AWS regions.

A convenience function for overriding the Service Endpoint.

See: $sel:endpoint:Service.

Send a request, returning the associated response if successful.

Errors are thrown in IO.

See sendEither.

Send a request, returning the associated response if successful.

See send.

Repeatedly send a request, automatically setting markers and performing pagination. Exits on the first encountered error.

Errors are thrown in IO.

See paginateEither.

Repeatedly send a request, automatically setting markers and performing pagination.

Exits on the first encountered error.

See paginate.

Poll the API with the supplied request until a specific Wait condition is fulfilled.

Errors are thrown in IO.

See awaitEither.

Poll the API with the supplied request until a specific Wait condition is fulfilled.

See await.

Make an unsigned request, returning the associated response if successful.

Errors are thrown in IO.

See sendUnsignedEither.

Make a request without signing it. You will almost never need to do this, but some authentication methods (e.g. sts:AssumeRoleWithWebIdentity and sso:GetRoleCredentials) require you to exchange a token using an unsigned request. Amazonka's support for these authentication methods calls sendUnsigned, and we re-export these functions in case you need to support similar authentication methods in your code.

See sendUnsigned.

Anything that can be converted to a streaming request Body.

Invariant: only services that support both standard and chunked signing expose RequestBody as a parameter.

A streaming, exception safe response body.

newtype for show/orhpan instance purposes.

Anything that can be safely converted to a HashedBody.

An opaque request body containing a SHA256 hash.

Construct a HashedBody from a FilePath, calculating the SHA256 hash and file size.

Note: While this function will perform in constant space, it will enumerate the entirety of the file contents twice. Firstly to calculate the SHA256 and lastly to stream the contents to the socket during sending.

See: ToHashedBody.

Construct a HashedBody from a FilePath, specifying the range of bytes to read. This can be useful for constructing multiple requests from a single file, say for S3 multipart uploads.

See: hashedFile, sourceFileRange.

Construct a HashedBody from a Source, manually specifying the SHA256 hash and file size. It's left up to the caller to calculate these correctly, otherwise AWS will return signing errors.

See: ToHashedBody.

An opaque request body which will be transmitted via Transfer-Encoding: chunked.

Invariant: Only services that support chunked encoding can accept a ChunkedBody. (Currently S3.) This is enforced by the type signatures emitted by the generator.

Specifies the transmitted size of the 'Transfer-Encoding' chunks.

See: defaultChunk.

The default chunk size of 128 KB. The minimum chunk size accepted by AWS is 8 KB, unless the entirety of the request is below this threshold.

A chunk size of 64 KB or higher is recommended for performance reasons.

Construct a ChunkedBody from a FilePath, where the contents will be read and signed incrementally in chunks if the target service supports it.

Will intelligently revert to HashedBody if the file is smaller than the specified ChunkSize.

See: ToBody.

Construct a ChunkedBody from a FilePath, specifying the range of bytes to read. This can be useful for constructing multiple requests from a single file, say for S3 multipart uploads.

See: chunkedFile.

Unsafely construct a ChunkedBody.

This function is marked unsafe because it does nothing to enforce the chunk size. Typically for conduit IO functions, it's whatever ByteString's defaultBufferSize is, around 32 KB. If the chunk size is less than 8 KB, the request will error. 64 KB or higher chunk size is recommended for performance reasons.

Note that it will always create a chunked body even if the request is too small.

See: ToBody.

Connect a Sink to a response stream.

Convenience function for obtaining the size of a file.

Incrementally calculate a MD5 Digest.

Incrementally calculate a SHA256 Digest.

Presign an URL that is valid from the specified time until the number of seconds expiry has elapsed.

Presign an HTTP request that is valid from the specified time until the number of seconds expiry has elapsed.

A variant of try that takes a ReifiedPrism (or any ReifiedFold) to select which exceptions are caught (c.f. tryJust, catchJust). If the Exception does not match the predicate, it is re-thrown.

trying :: MonadCatch m => Prism'     SomeException a -> m r -> m (Either a r)
trying :: MonadCatch m => Lens'      SomeException a -> m r -> m (Either a r)
trying :: MonadCatch m => Traversal' SomeException a -> m r -> m (Either a r)
trying :: MonadCatch m => Iso'       SomeException a -> m r -> m (Either a r)
trying :: MonadCatch m => ReifiedGetter     SomeException a -> m r -> m (Either a r)
trying :: MonadCatch m => ReifiedFold       SomeException a -> m r -> m (Either a r)

Catch exceptions that match a given ReifiedPrism (or any ReifiedFold, really).

>>> catching _AssertionFailed (assert False (return "uncaught")) $ \ _ -> return "caught"
"caught"

catching :: MonadCatch m => Prism' SomeException a     -> m r -> (a -> m r) -> m r
catching :: MonadCatch m => Lens' SomeException a      -> m r -> (a -> m r) -> m r
catching :: MonadCatch m => Traversal' SomeException a -> m r -> (a -> m r) -> m r
catching :: MonadCatch m => Iso' SomeException a       -> m r -> (a -> m r) -> m r
catching :: MonadCatch m => ReifiedGetter SomeException a     -> m r -> (a -> m r) -> m r
catching :: MonadCatch m => ReifiedFold SomeException a       -> m r -> (a -> m r) -> m r

Provides a generalised prism for catching a specific service error identified by the opaque service abbreviation and error code.

This can be used if the generated error prisms provided by Amazonka.ServiceName.Types do not cover all the thrown error codes. For example to define a new error prism:

{-# LANGUAGE OverloadedStrings #-}

import Amazonka.S3 (ServiceError, s3)

_NoSuchBucketPolicy :: AsError a => Fold a ServiceError
_NoSuchBucketPolicy = _MatchServiceError s3 "NoSuchBucketPolicy"

With example usage being:

>>> import Control.Exception.Lens (trying)
>>> :t trying _NoSuchBucketPolicy
MonadCatch m => m a -> m (Either ServiceError a)

A logging function called by various default hooks to log informational and debug messages.

This is a primitive logger which can be used to log builds to a Handle.

Note: A more sophisticated logging library such as tinylog or fast-logger should be used in production code.

This is the simplest representation of UTC. It consists of the day number, and a time offset from midnight. Note that if a day has a leap second added to it, it will have 86401 seconds.