Struct FakeImds 

pub struct FakeImds {
    state: Mutex<ImdsState>,
    lifetime: Duration,
}

The instance metadata service, as far as InstanceCredentials is concerned: a source of temporary credentials, each with a stated expiry.

Every read issues a new access key id, so a test can tell which credential a request was signed with, and FakeAws refuses a request signed with one this holder no longer considers live — the way Route53 answers ExpiredTokenException to a signature made with a lapsed instance-profile credential.

Fields

state: Mutex<ImdsState>

lifetime: Duration

Implementations

impl FakeImds

pub fn new() -> Arc<Self>

A metadata service whose credentials last six hours — long enough that InstanceCredentials::current never refreshes on its own, so a test that wants a refresh asks for one with FakeAws::expire_credential or FakeAws::expire_credential_after.

pub fn with_lifetime(lifetime: Duration) -> Arc<Self>

A metadata service whose credentials last lifetime.

pub fn credentials( self: &Arc<Self>, ) -> Result<Arc<InstanceCredentials>, ImdsError>

A credential holder that reads this service, with its first read already made — the same shape InstanceCredentials::from_instance_metadata returns.

Errors

Whatever the first read answers, so a test can start from a metadata service that refuses.

pub fn reads(&self) -> u64

How many times the credential endpoint has been read.

pub fn issued(&self) -> Vec<String>

The access key ids this service has issued, oldest first.

pub fn fail_next(&self, count: u32)

Answers the next count reads with an error instead of a credential.

pub fn expire_current(&self)

Stops accepting the access key id this service issued most recently.

This is the service’s half of an expiry: a request still signed with that key id is refused from here on. The holder’s half — InstanceCredentials noticing that what it holds is past its stated expiry and reading again — is FakeAws::expire_credential, which does both.

pub fn is_live(&self, access_key_id: &str) -> bool

Whether a request signed with access_key_id is still accepted.

fn guard(&self) -> MutexGuard<'_, ImdsState>