Aws Config

Stores AWS connection credentials securely. This is the shared credential holder for AWS-backed operation nodes (SQS, DynamoDB, Athena) — reference it from a node's config dropdown instead of adding a per-service config node. Queue URLs, table names and other service settings stay on the operation node.

Configuration

Auth Mode enum

IAM Role — uses the ECS Task Role attached to the container (recommended for production). Access Keys — uses explicit credentials for development or cross-account access.

Region string

AWS region (e.g., us-east-1). Falls back to the AWS_REGION environment variable if empty.

Access Key ID password

AWS Access Key ID — only required when using Access Key auth mode.

Secret Access Key password

AWS Secret Access Key — stored encrypted by Node-RED.

Endpoint Override string

Custom endpoint for LocalStack or AWS-compatible testing.

Security

Credentials are stored as Node-RED credentials (encrypted at rest). They are never serialised into the flow JSON in plaintext.

Test Connection

Calls sts:GetCallerIdentity — validates that the credentials/region can authenticate to AWS at all. It does not prove any service-specific permission (e.g. athena:StartQueryExecution), so a scoped-down IAM policy may pass this test while a specific operation node still fails at runtime.