localserver command for serving S3 credentials via HTTP

[simonw]

New localserver command that starts a localhost HTTP server serving temporary S3 credentials:

• Serves credentials on GET / as JSON
• --duration option to control credential regeneration (required)
• -p/--port to set port (default 8094)
• --read-only/--write-only permission options
• --prefix option for key restriction
• Credentials cached internally, regenerated after refresh interval
• Thread-safe with dogpile prevention

Also fixes tests to work with newer versions of click that removed the mix_stderr parameter from CliRunner.

🤖 Generated with Claude Code

Claude Code transcript: https://gistpreview.github.io/?500add71f397874ebadb8e04e8a33b53

[simonw]

I manually tested it following these tips from Claude:

⏺ Now, to verify the AWS CLI credential_process integration works, you can run these commands:

1. Start the localserver (in one terminal, with a real bucket you have access to):
   s3-credentials localserver YOUR-BUCKET-NAME --duration 15m

2. Test the JSON output manually:
   curl -s http://localhost:8094/ | jq .

This should show output with "Version": 1:

{
  "Version": 1,
  "AccessKeyId": "ASIA...",
  "SecretAccessKey": "...",
  "SessionToken": "...",
  "Expiration": "..."
}

3. Test with AWS CLI credential_process:

Add a profile to your AWS config

echo '[profile localserver-test]
credential_process = curl -s http://localhost:8094/' >> ~/.aws/config

Test it works

aws s3 ls s3://YOUR-BUCKET-NAME/ --profile localserver-test

Or check the identity

aws sts get-caller-identity --profile localserver-test

4. Clean up (remove the test profile):

Edit ~/.aws/config and remove the [profile localserver-test] section

Sources:

• https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html

Like this:

~ % aws sts get-caller-identity --profile localserver-test           
{
    "UserId": "AROAWXFXAIOZADV4DDGSA:s3.read-write.litestream-experiments",
    "Account": "462092780466",
    "Arn": "arn:aws:sts::462092780466:assumed-role/s3-credentials.AmazonS3FullAccess/s3.read-write.litestream-experiments"
}

[simonw]

Refactored the code a bit: http://gistpreview.github.io/?99b41ecbf1c6157024cf9c122ce37e22