Credentials are loaded once for each client

[rcoh]

Each IdentityResolver that is created has its own IdentityPartitionCacheKey. This means that we hit separate caches. We need to create the identity resolver in SdkConfig as part of the call to build().

e.g:

--- a/aws/rust-runtime/aws-types/src/sdk_config.rs
+++ b/aws/rust-runtime/aws-types/src/sdk_config.rs
@@ -55,6 +55,7 @@ pub struct SdkConfig {
     app_name: Option<AppName>,
     identity_cache: Option<SharedIdentityCache>,
     credentials_provider: Option<SharedCredentialsProvider>,
+    credentials_identity_resolver: Option<SharedIdentityResolver>,
     region: Option<Region>,
     endpoint_url: Option<String>,
     retry_config: Option<RetryConfig>,

Logs:

2024-02-19T17:23:02.363590Z  INFO lazy_load_identity: aws_smithy_runtime::client::identity::cache::lazy: identity cache miss occurred; added new identity (took Ok(678.027ms)) new_expiration=SystemTime { tv_sec: 1708366982, tv_nsec: 0 } valid_for=Ok(3599.636442s) partition=IdentityCachePartition(1)
2024-02-19T17:23:03.600080Z  INFO lazy_load_identity: aws_smithy_runtime::client::identity::cache::lazy: identity cache miss occurred; added new identity (took Ok(733.768ms)) new_expiration=SystemTime { tv_sec: 1708366983, tv_nsec: 0 } valid_for=Ok(3599.399947s) partition=IdentityCachePartition(4)

[jdisanti]

This was fixed in the April 12th release.

[aajtodd]

Well to be clear it is now possible, you still have to pass an identity_cache(..) to the config loader yourself until #3578 is merged and made the default behavior.