Environment variables¶
Read only by the integration tests. Nothing in the library reads the environment — clients and key identifiers are passed as arguments, so a consumer's configuration remains its own business.
| Variable | Required for | Purpose |
|---|---|---|
INT_TEST |
all integration tests | Master switch. Unset, every test that calls real KMS skips |
INT_TEST_AWS_REGION |
all | The region the keys live in |
INT_TEST_KMS_ENCRYPT_KEY |
deriver, round trip | The KEY_AGREEMENT key |
INT_TEST_KMS_CERTIFY_KEY |
signer, round trip | The SIGN_VERIFY key |
Why nothing is defaulted¶
A default key identifier would mean that flipping INT_TEST=1 issues billable
calls against whatever that name resolves to in whatever account the ambient
credentials happen to point at. Naming each key is the caller stating which one
they meant.
Why missing values skip rather than fail¶
INT_TEST is the estate-wide "run the integration tests" switch, so a developer
running the whole workspace has not asked for these tests in particular. A
test that has no credentials and was never meant to run is not a regression, and
failing there is indistinguishable from one.
INT_TEST=1 \
INT_TEST_AWS_REGION=eu-west-2 \
INT_TEST_KMS_ENCRYPT_KEY=alias/security-contact-v1-encrypt \
INT_TEST_KMS_CERTIFY_KEY=alias/security-contact-v1-certify \
go test ./...
Credentials come from the ambient AWS configuration chain — profile, SSO
session, or instance role — via config.LoadDefaultConfig.