aws_auth(
*,
access_key_id: SandboxProxySecret | None = None,
secret_access_key: SandboxProxySecret | NoneBuild a sandbox proxy rule that signs AWS HTTPS requests.
The sandbox proxy keeps the real AWS credentials outside the sandbox and
signs supported AWS requests with SigV4 on the sandbox's behalf.
Provide either role_arn or both static credentials, supplied as
workspace_secret or opaque values. IAM-role support must be enabled
on the backend. LangSmith supplies the workspace External ID and renews
credentials; clients must not provide temporary credentials or External IDs.
In proxy_config, a role uses its effective IAM permissions. In
mount_config(auth=[...]), it is restricted to the configured S3 mounts.
Role authentication is configured at sandbox creation, not through updates.
Plaintext environment variables set for every command in the sandbox while this rule is enabled, for tools that refuse to run unless a credential variable is present even though the proxy injects the real credential on the wire.