AWS credentials
Supply short-lived AWS credentials to every AWS Integration Kit service
AWS credentials
Every AWS client resolves credentials through AWSIKCore. Access keys are never Blueprint inputs and are not stored in project settings. Configure the ordered Credential Chain in Project Settings > Betide > Crossplay > AWS Integration Kit. The default order is Cognito Identity Pool, workload role, environment, then a C++ custom provider. Empty or expired sources are skipped.
| Runtime | Recommended source |
|---|---|
| Signed-in player | Cognito Identity Pool temporary credentials |
| GameLift or other dedicated server | Workload/instance role |
| Editor development | Environment credentials, optionally exported from an AWS shared profile |
| CI | Short-lived environment credentials from workload identity |
| Custom broker | Register a refreshable C++ custom provider |
AWSIKCognito publishes identity-pool credentials into the shared refreshable slot after login, refreshes them before expiry, and clears them on logout. All service clients resolve the same provider chain, so a signed-in player can call an authorized S3, DynamoDB, Lambda, CloudWatch, or AppSync operation without placing a key in a Blueprint or config file.
Verifying the region and credential chain
Project Settings > Betide > Crossplay offers a Verify action for the AWS Integration Kit once Region is set. It resolves credentials through the configured chain, signs an STS GetCallerIdentity request with SigV4, and posts it to https://sts.<region>.amazonaws.com/ (or to Endpoint Override when one is set). GetCallerIdentity is free, needs no IAM permission, and never touches your resources. A pass reports the caller, for example Signed in as arn:aws:iam::123456789012:user/dev (us-east-2); a failure quotes the AWS error and names the setting to fix: Region for endpoint or transport problems, the credential chain when no source yielded credentials or STS answered 401/403. The check gives up after 15 seconds.
Grant only the actions required by the player-facing workflow. Raw nodes under a Trusted Backend category are complete SDK coverage for server tools and custom backends; they are not an instruction to grant those control-plane permissions to a shipped client. See Trusted backend operations.
For a custom source, register an Aws::Auth::AWSCredentialsProvider with FAWSIKCoreModule, use the Betide.AWS.Custom provider id, and make renewal atomic. Never log credentials, session tokens, JWTs, authorization headers, signed URLs, or request bodies containing player data.
Client endpoint, connect/request timeouts, retry count, base backoff, jitter, proxy, region, and TLS verification are shared settings. Every service client, including the AppSync request signer, reads them once when the AWS SDK starts, so a change takes effect after an editor restart. Endpoint override is intended for local fakes and approved emulators; shipping builds should retain TLS verification.