AWS Credentials support, StaticCredentials Provider (#17)

* added credentials API, disabled FFI backend for now

* Added CredentialsTest

* Added support for specifying CMAKE_BUILD_TYPE on the command line

* Added support for AwsCredentials and StaticCredentialsProvider

Makefile.frag

@@ -10,7 +10,7 @@ ifeq (, $(shell which cmake3))
 	CMAKE = cmake
 endif
 
-CMAKE_CONFIGURE = $(CMAKE) -DCMAKE_INSTALL_PREFIX=$(INT_DIR) -DCMAKE_PREFIX_PATH=$(INT_DIR) -DBUILD_TESTING=OFF
+CMAKE_CONFIGURE = $(CMAKE) -DCMAKE_INSTALL_PREFIX=$(INT_DIR) -DCMAKE_PREFIX_PATH=$(INT_DIR) -DBUILD_TESTING=OFF -DCMAKE_BUILD_TYPE=$(CMAKE_BUILD_TYPE)
 CMAKE_BUILD = $(CMAKE) --build
 CMAKE_BUILD_TYPE ?= RelWithDebInfo
 CMAKE_TARGET = --config $(CMAKE_BUILD_TYPE) --target install
@@ -63,14 +63,7 @@ ffi: src/libaws-crt-ffi.so
 src/libaws-crt-ffi.so: $(BUILD_DIR)/aws-crt-ffi-shared/libaws-crt-ffi.so src/api.h
 	cp -v $(BUILD_DIR)/aws-crt-ffi-shared/libaws-crt-ffi.so src/libaws-crt-ffi.so
 
-# Test the FFI interface on PHP7+
-ifeq ($(AT_LEAST_PHP7), 1)
-test: src/libaws-crt-ffi.so
-	composer update
-	AWS_CRT_PHP_EXTENSION=1 composer run test
-	AWS_CRT_PHP_FFI=1 composer run test
-else
+# Use PHPUnit to run tests
 test: ext/api.h ext/awscrt_arginfo.h ext/crt.lo
 	composer update
 	composer run test
-endif

ext/awscrt.stub.php

@@ -10,12 +10,42 @@ function aws_crt_error_str(int $error_code): string {}
 
 function aws_crt_error_debug_str(int $error_code): string {}
 
-function aws_crt_event_loop_group_options_new(): object {}
+function aws_crt_event_loop_group_options_new(): int {}
 
-function aws_crt_event_loop_group_options_release(object $elg_options): void {}
+function aws_crt_event_loop_group_options_release(int $elg_options): void {}
 
-function aws_crt_event_loop_group_options_set_max_threads(object $elg_options, int $max_threads): void {}
+function aws_crt_event_loop_group_options_set_max_threads(int $elg_options, int $max_threads): void {}
 
-function aws_crt_event_loop_group_new(object $options): object {}
+function aws_crt_event_loop_group_new(int $options): int {}
 
-function aws_crt_event_loop_group_release(object $event_loop_group): void {}
+function aws_crt_event_loop_group_release(int $event_loop_group): void {}
+
+function aws_crt_credentials_options_new(): int {}
+
+function aws_crt_credentials_options_release(int $options): void {}
+
+function aws_crt_credentials_options_set_access_key_id(int $options, string $access_key_id): void {}
+
+function aws_crt_credentials_options_set_secret_access_key(int $options, string $secret_access_key): void {}
+
+function aws_crt_credentials_options_set_session_token(int $options, string $session_token): void {}
+
+function aws_crt_credentials_options_set_expiration_timepoint_seconds(int $options, int $expiration_timepoint_seconds): void {}
+
+function aws_crt_credentials_new(int $options): int {}
+
+function aws_crt_credentials_release(int $credentials): void {}
+
+function aws_crt_credentials_provider_release(int $credentials): void {}
+
+function aws_crt_credentials_provider_static_options_new(): int {}
+
+function aws_crt_credentials_provider_static_options_release(int $options): void {}
+
+function aws_crt_credentials_provider_static_options_set_access_key_id(int $options, string $access_key_id): void {}
+
+function aws_crt_credentials_provider_static_options_set_secret_access_key(int $options, string $secret_access_key): void {}
+
+function aws_crt_credentials_provider_static_options_set_session_token(int $options, string $session_token): void {}
+
+function aws_crt_credentials_provider_static_new(int $options): int {}

ext/awscrt_arginfo.h

@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: a2ad6edf64d0416356ba2a9a4c8b184615054a7c */
+ * Stub hash: c681786667e5b7755b2874e4862ea7f162ef61ee */
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_last_error, 0, 0, IS_LONG, 0)
 ZEND_END_ARG_INFO()
@@ -12,26 +12,71 @@ ZEND_END_ARG_INFO()
 
 #define arginfo_aws_crt_error_debug_str arginfo_aws_crt_error_name
 
-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_event_loop_group_options_new, 0, 0, IS_OBJECT, 0)
-ZEND_END_ARG_INFO()
+#define arginfo_aws_crt_event_loop_group_options_new arginfo_aws_crt_last_error
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_event_loop_group_options_release, 0, 1, IS_VOID, 0)
-	ZEND_ARG_TYPE_INFO(0, elg_options, IS_OBJECT, 0)
+	ZEND_ARG_TYPE_INFO(0, elg_options, IS_LONG, 0)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_event_loop_group_options_set_max_threads, 0, 2, IS_VOID, 0)
-	ZEND_ARG_TYPE_INFO(0, elg_options, IS_OBJECT, 0)
+	ZEND_ARG_TYPE_INFO(0, elg_options, IS_LONG, 0)
 	ZEND_ARG_TYPE_INFO(0, max_threads, IS_LONG, 0)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_event_loop_group_new, 0, 1, IS_OBJECT, 0)
-	ZEND_ARG_TYPE_INFO(0, options, IS_OBJECT, 0)
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_event_loop_group_new, 0, 1, IS_LONG, 0)
+	ZEND_ARG_TYPE_INFO(0, options, IS_LONG, 0)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_event_loop_group_release, 0, 1, IS_VOID, 0)
-	ZEND_ARG_TYPE_INFO(0, event_loop_group, IS_OBJECT, 0)
+	ZEND_ARG_TYPE_INFO(0, event_loop_group, IS_LONG, 0)
 ZEND_END_ARG_INFO()
 
+#define arginfo_aws_crt_credentials_options_new arginfo_aws_crt_last_error
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_credentials_options_release, 0, 1, IS_VOID, 0)
+	ZEND_ARG_TYPE_INFO(0, options, IS_LONG, 0)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_credentials_options_set_access_key_id, 0, 2, IS_VOID, 0)
+	ZEND_ARG_TYPE_INFO(0, options, IS_LONG, 0)
+	ZEND_ARG_TYPE_INFO(0, access_key_id, IS_STRING, 0)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_credentials_options_set_secret_access_key, 0, 2, IS_VOID, 0)
+	ZEND_ARG_TYPE_INFO(0, options, IS_LONG, 0)
+	ZEND_ARG_TYPE_INFO(0, secret_access_key, IS_STRING, 0)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_credentials_options_set_session_token, 0, 2, IS_VOID, 0)
+	ZEND_ARG_TYPE_INFO(0, options, IS_LONG, 0)
+	ZEND_ARG_TYPE_INFO(0, session_token, IS_STRING, 0)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_credentials_options_set_expiration_timepoint_seconds, 0, 2, IS_VOID, 0)
+	ZEND_ARG_TYPE_INFO(0, options, IS_LONG, 0)
+	ZEND_ARG_TYPE_INFO(0, expiration_timepoint_seconds, IS_LONG, 0)
+ZEND_END_ARG_INFO()
+
+#define arginfo_aws_crt_credentials_new arginfo_aws_crt_event_loop_group_new
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_aws_crt_credentials_release, 0, 1, IS_VOID, 0)
+	ZEND_ARG_TYPE_INFO(0, credentials, IS_LONG, 0)
+ZEND_END_ARG_INFO()
+
+#define arginfo_aws_crt_credentials_provider_release arginfo_aws_crt_credentials_release
+
+#define arginfo_aws_crt_credentials_provider_static_options_new arginfo_aws_crt_last_error
+
+#define arginfo_aws_crt_credentials_provider_static_options_release arginfo_aws_crt_credentials_options_release
+
+#define arginfo_aws_crt_credentials_provider_static_options_set_access_key_id arginfo_aws_crt_credentials_options_set_access_key_id
+
+#define arginfo_aws_crt_credentials_provider_static_options_set_secret_access_key arginfo_aws_crt_credentials_options_set_secret_access_key
+
+#define arginfo_aws_crt_credentials_provider_static_options_set_session_token arginfo_aws_crt_credentials_options_set_session_token
+
+#define arginfo_aws_crt_credentials_provider_static_new arginfo_aws_crt_event_loop_group_new
+
 
 ZEND_FUNCTION(aws_crt_last_error);
 ZEND_FUNCTION(aws_crt_error_name);
@@ -42,6 +87,21 @@ ZEND_FUNCTION(aws_crt_event_loop_group_options_release);
 ZEND_FUNCTION(aws_crt_event_loop_group_options_set_max_threads);
 ZEND_FUNCTION(aws_crt_event_loop_group_new);
 ZEND_FUNCTION(aws_crt_event_loop_group_release);
+ZEND_FUNCTION(aws_crt_credentials_options_new);
+ZEND_FUNCTION(aws_crt_credentials_options_release);
+ZEND_FUNCTION(aws_crt_credentials_options_set_access_key_id);
+ZEND_FUNCTION(aws_crt_credentials_options_set_secret_access_key);
+ZEND_FUNCTION(aws_crt_credentials_options_set_session_token);
+ZEND_FUNCTION(aws_crt_credentials_options_set_expiration_timepoint_seconds);
+ZEND_FUNCTION(aws_crt_credentials_new);
+ZEND_FUNCTION(aws_crt_credentials_release);
+ZEND_FUNCTION(aws_crt_credentials_provider_release);
+ZEND_FUNCTION(aws_crt_credentials_provider_static_options_new);
+ZEND_FUNCTION(aws_crt_credentials_provider_static_options_release);
+ZEND_FUNCTION(aws_crt_credentials_provider_static_options_set_access_key_id);
+ZEND_FUNCTION(aws_crt_credentials_provider_static_options_set_secret_access_key);
+ZEND_FUNCTION(aws_crt_credentials_provider_static_options_set_session_token);
+ZEND_FUNCTION(aws_crt_credentials_provider_static_new);
 
 
 static const zend_function_entry ext_functions[] = {
@@ -54,5 +114,20 @@ static const zend_function_entry ext_functions[] = {
 	ZEND_FE(aws_crt_event_loop_group_options_set_max_threads, arginfo_aws_crt_event_loop_group_options_set_max_threads)
 	ZEND_FE(aws_crt_event_loop_group_new, arginfo_aws_crt_event_loop_group_new)
 	ZEND_FE(aws_crt_event_loop_group_release, arginfo_aws_crt_event_loop_group_release)
+	ZEND_FE(aws_crt_credentials_options_new, arginfo_aws_crt_credentials_options_new)
+	ZEND_FE(aws_crt_credentials_options_release, arginfo_aws_crt_credentials_options_release)
+	ZEND_FE(aws_crt_credentials_options_set_access_key_id, arginfo_aws_crt_credentials_options_set_access_key_id)
+	ZEND_FE(aws_crt_credentials_options_set_secret_access_key, arginfo_aws_crt_credentials_options_set_secret_access_key)
+	ZEND_FE(aws_crt_credentials_options_set_session_token, arginfo_aws_crt_credentials_options_set_session_token)
+	ZEND_FE(aws_crt_credentials_options_set_expiration_timepoint_seconds, arginfo_aws_crt_credentials_options_set_expiration_timepoint_seconds)
+	ZEND_FE(aws_crt_credentials_new, arginfo_aws_crt_credentials_new)
+	ZEND_FE(aws_crt_credentials_release, arginfo_aws_crt_credentials_release)
+	ZEND_FE(aws_crt_credentials_provider_release, arginfo_aws_crt_credentials_provider_release)
+	ZEND_FE(aws_crt_credentials_provider_static_options_new, arginfo_aws_crt_credentials_provider_static_options_new)
+	ZEND_FE(aws_crt_credentials_provider_static_options_release, arginfo_aws_crt_credentials_provider_static_options_release)
+	ZEND_FE(aws_crt_credentials_provider_static_options_set_access_key_id, arginfo_aws_crt_credentials_provider_static_options_set_access_key_id)
+	ZEND_FE(aws_crt_credentials_provider_static_options_set_secret_access_key, arginfo_aws_crt_credentials_provider_static_options_set_secret_access_key)
+	ZEND_FE(aws_crt_credentials_provider_static_options_set_session_token, arginfo_aws_crt_credentials_provider_static_options_set_session_token)
+	ZEND_FE(aws_crt_credentials_provider_static_new, arginfo_aws_crt_credentials_provider_static_new)
 	ZEND_FE_END
 };

ext/crt.c

@@ -132,6 +132,181 @@ PHP_FUNCTION(aws_crt_event_loop_group_release) {
     aws_crt_event_loop_group_release(elg);
 }
 
+PHP_FUNCTION(aws_crt_credentials_options_new) {
+    aws_crt_credentials_options *options = aws_crt_credentials_options_new();
+    RETURN_LONG((zend_ulong)options);
+}
+
+PHP_FUNCTION(aws_crt_credentials_options_release) {
+    zend_ulong php_options = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &php_options) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_options *options = (void *)php_options;
+    aws_crt_credentials_options_release(options);
+}
+
+PHP_FUNCTION(aws_crt_credentials_options_set_access_key_id) {
+    zend_ulong php_options = 0;
+    const char *access_key_id = NULL;
+    size_t access_key_id_len = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ls", &php_options, &access_key_id, &access_key_id_len) ==
+        FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_options *options = (void *)php_options;
+    aws_crt_credentials_options_set_access_key_id(options, (uint8_t *)access_key_id, access_key_id_len);
+}
+
+PHP_FUNCTION(aws_crt_credentials_options_set_secret_access_key) {
+    zend_ulong php_options = 0;
+    const char *secret_access_key = NULL;
+    size_t secret_access_key_len = 0;
+
+    if (zend_parse_parameters(
+            ZEND_NUM_ARGS() TSRMLS_CC, "ls", &php_options, &secret_access_key, &secret_access_key_len) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_options *options = (void *)php_options;
+    aws_crt_credentials_options_set_secret_access_key(options, (uint8_t *)secret_access_key, secret_access_key_len);
+}
+
+PHP_FUNCTION(aws_crt_credentials_options_set_session_token) {
+    zend_ulong php_options = 0;
+    const char *session_token = NULL;
+    size_t session_token_len = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ls", &php_options, &session_token, &session_token_len) ==
+        FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_options *options = (void *)php_options;
+    aws_crt_credentials_options_set_session_token(options, (uint8_t *)session_token, session_token_len);
+}
+
+PHP_FUNCTION(aws_crt_credentials_options_set_expiration_timepoint_seconds) {
+    zend_ulong php_options = 0;
+    zend_ulong expiration_timepoint_seconds = 0;
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ll", &php_options, &expiration_timepoint_seconds) ==
+        FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_options *options = (void *)php_options;
+    aws_crt_credentials_options_set_expiration_timepoint_seconds(options, expiration_timepoint_seconds);
+}
+
+PHP_FUNCTION(aws_crt_credentials_new) {
+    zend_ulong php_options = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &php_options) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_options *options = (void *)php_options;
+    aws_crt_credentials *credentials = aws_crt_credentials_new(options);
+    RETURN_LONG((zend_ulong)credentials);
+}
+
+PHP_FUNCTION(aws_crt_credentials_release) {
+    zend_ulong php_credentials = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &php_credentials) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials *credentials = (void *)php_credentials;
+    aws_crt_credentials_release(credentials);
+}
+
+PHP_FUNCTION(aws_crt_credentials_provider_release) {
+    zend_ulong php_creds_provider = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &php_creds_provider) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_provider *provider = (void *)php_creds_provider;
+    aws_crt_credentials_provider_release(provider);
+}
+
+PHP_FUNCTION(aws_crt_credentials_provider_static_options_new) {
+    aws_crt_credentials_provider_static_options *options = aws_crt_credentials_provider_static_options_new();
+    RETURN_LONG((zend_ulong)options);
+}
+
+PHP_FUNCTION(aws_crt_credentials_provider_static_options_release) {
+    zend_ulong php_options = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &php_options) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_provider_static_options *options = (void *)php_options;
+    aws_crt_credentials_provider_static_options_release(options);
+}
+
+PHP_FUNCTION(aws_crt_credentials_provider_static_options_set_access_key_id) {
+    zend_ulong php_options = 0;
+    const char *access_key_id = NULL;
+    size_t access_key_id_len = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ls", &php_options, &access_key_id, &access_key_id_len) ==
+        FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_provider_static_options *options = (void *)php_options;
+    aws_crt_credentials_provider_static_options_set_access_key_id(options, (uint8_t *)access_key_id, access_key_id_len);
+}
+
+PHP_FUNCTION(aws_crt_credentials_provider_static_options_set_secret_access_key) {
+    zend_ulong php_options = 0;
+    const char *secret_access_key = NULL;
+    size_t secret_access_key_len = 0;
+
+    if (zend_parse_parameters(
+            ZEND_NUM_ARGS() TSRMLS_CC, "ls", &php_options, &secret_access_key, &secret_access_key_len) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_provider_static_options *options = (void *)php_options;
+    aws_crt_credentials_provider_static_options_set_secret_access_key(
+        options, (uint8_t *)secret_access_key, secret_access_key_len);
+}
+
+PHP_FUNCTION(aws_crt_credentials_provider_static_options_set_session_token) {
+    zend_ulong php_options = 0;
+    const char *session_token = NULL;
+    size_t session_token_len = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ls", &php_options, &session_token, &session_token_len) ==
+        FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_provider_static_options *options = (void *)php_options;
+    aws_crt_credentials_provider_static_options_set_session_token(options, (uint8_t *)session_token, session_token_len);
+}
+
+PHP_FUNCTION(aws_crt_credentials_provider_static_new) {
+    zend_ulong php_options = 0;
+
+    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &php_options) == FAILURE) {
+        RETURN_NULL();
+    }
+
+    aws_crt_credentials_provider_static_options *options = (void *)php_options;
+    aws_crt_credentials_provider *provider = aws_crt_credentials_provider_static_new(options);
+    RETURN_LONG((zend_ulong)provider);
+}
+
 zend_module_entry awscrt_module_entry = {
     STANDARD_MODULE_HEADER,
     "awscrt",

ext/php_aws_crt.h

@@ -39,6 +39,7 @@ ZEND_EXTERN_MODULE_GLOBALS(awscrt)
         static const zend_arg_info name[] = {{NULL, 0, NULL, required_num_args, return_reference, 0, 0},
 
 /* PHP5 doesn't really handle type hints well, so elide them */
+#    undef ZEND_ARG_TYPE_INFO
 #    define ZEND_ARG_TYPE_INFO(pass_by_ref, name, type_hint, allow_null)                                               \
         {#name, sizeof(#name) - 1, NULL, 0, 0, pass_by_ref, allow_null, 0},
 #endif

src/AWS/CRT/Auth/AwsCredentials.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace AWS\CRT\Auth;
+
+use AWS\CRT\NativeResource as NativeResource;
+use AWS\CRT\Options as Options;
+
+/**
+ * Represents a set of AWS credentials
+ *
+ * @param array options:
+ * - string access_key_id - AWS Access Key Id
+ * - string secret_access_key - AWS Secret Access Key
+ * - string session_token - Optional STS session token
+ * - int expiration_timepoint_seconds - Optional time to expire these credentials
+ */
+final class AwsCredentials extends NativeResource {
+
+    static function defaults() {
+        return array(
+            'access_key_id' => '',
+            'secret_access_key' => '',
+            'session_token' => '',
+            'expiration_timepoint_seconds' => 0,
+        );
+    }
+
+    private $access_key_id;
+    private $secret_access_key;
+    private $session_token;
+    private $expiration_timepoint_seconds = 0;
+
+    public function __get($name) {
+        return $this->$name;
+    }
+
+    function __construct($options = []) {
+        parent::__construct();
+        if (count($options) == 0) {
+            $options = self::defaults();
+        }
+        $options = new Options($options);
+        $this->access_key_id = $options->getString('access_key_id');
+        $this->secret_access_key = $options->getString('secret_access_key');
+        $this->session_token = $options->getString('session_token');
+        $this->expiration_timepoint_seconds = $options->getInt('expiration_timepoint_seconds');
+
+        if (strlen($this->access_key_id) == 0) {
+            throw new \InvalidArgumentException("access_key_id must be provided");
+        }
+        if (strlen($this->secret_access_key) == 0) {
+            throw new \InvalidArgumentException("secret_access_key must be provided");
+        }
+
+        $creds_options = self::$crt->aws_credentials_options_new();
+        self::$crt->aws_credentials_options_set_access_key_id($creds_options, $this->access_key_id);
+        self::$crt->aws_credentials_options_set_secret_access_key($creds_options, $this->secret_access_key);
+        self::$crt->aws_credentials_options_set_session_token($creds_options, $this->session_token);
+        self::$crt->aws_credentials_options_set_expiration_timepoint_seconds($creds_options, $this->expiration_timepoint_seconds);
+        $this->acquire(self::$crt->aws_credentials_new($creds_options));
+        self::$crt->aws_credentials_options_release($creds_options);
+    }
+
+    function __destruct() {
+        self::$crt->aws_credentials_release($this->release());
+        parent::__destruct();
+    }
+}

src/AWS/CRT/Auth/CredentialsProvider.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace AWS\CRT\Auth;
+
+use AWS\CRT\NativeResource as NativeResource;
+
+/**
+ * Base class for credentials providers
+ */
+abstract class CredentialsProvider extends NativeResource {
+
+    function __construct(array $options = []) {
+        parent::__construct();
+    }
+
+    function __destruct() {
+        self::$crt->aws_credentials_provider_release($this->release());
+        parent::__destruct();
+    }
+}

src/AWS/CRT/Auth/StaticCredentialsProvider.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace AWS\CRT\Auth;
+
+/**
+ * Provides a static set of AWS credentials
+ *
+ * @param array options:
+ * - string access_key_id - AWS Access Key Id
+ * - string secret_access_key - AWS Secret Access Key
+ * - string session_token - Optional STS session token
+ */
+final class StaticCredentialsProvider extends CredentialsProvider {
+
+    static function defaults() {
+        return array(
+            'access_key_id' => '',
+            'secret_access_key' => '',
+            'session_token' => '',
+        );
+    }
+
+    private $credentials = null;
+
+    public function __get($name) {
+        return $this->$name;
+    }
+
+    function __construct(array $options = []) {
+        parent::__construct();
+        if (count($options) == 0) {
+            $options = self::defaults();
+        }
+        $this->credentials = new AwsCredentials($options);
+
+        $provider_options = self::$crt->aws_credentials_provider_static_options_new();
+        self::$crt->aws_credentials_provider_static_options_set_access_key_id($provider_options, $this->credentials->access_key_id);
+        self::$crt->aws_credentials_provider_static_options_set_secret_access_key($provider_options, $this->credentials->secret_access_key);
+        self::$crt->aws_credentials_provider_static_options_set_session_token($provider_options, $this->credentials->session_token);
+        $this->acquire(self::$crt->aws_credentials_provider_static_new($provider_options));
+        self::$crt->aws_credentials_provider_static_options_release($provider_options);
+    }
+}

src/AWS/CRT/CRT.php

@@ -3,7 +3,6 @@
 namespace AWS\CRT;
 
 use AWS\CRT\Internal\Extension;
-use AWS\CRT\Internal\FFI;
 
 use \RuntimeException;
 
@@ -22,14 +21,6 @@ final class CRT {
         if (is_null(self::$impl)) {
             // Figure out what backends are/should be available
             $backends = ['Extension'];
-            if (version_compare(PHP_VERSION, '7.0.0') >= 0) {
-                $backends = ['Extension', 'FFI'];
-                if (getenv('AWS_CRT_PHP_EXTENSION')) {
-                    $backends = ['Extension'];
-                } else if (getenv('AWS_CRT_PHP_FFI')) {
-                    $backends = ['FFI'];
-                }
-            }
 
             // Try to load each backend, give up if none succeed
             $exceptions = [];
@@ -113,4 +104,67 @@ final class CRT {
     function event_loop_group_release($elg) {
         return self::$impl->aws_crt_event_loop_group_release($elg);
     }
+
+    /**
+     * return object Pointer to native AWS credentials options
+     */
+    function aws_credentials_options_new() {
+        return self::$impl->aws_crt_credentials_options_new();
+    }
+
+    function aws_credentials_options_release($options) {
+        self::$impl->aws_crt_credentials_options_release($options);
+    }
+
+    function aws_credentials_options_set_access_key_id($options, $access_key_id) {
+        self::$impl->aws_crt_credentials_options_set_access_key_id($options, $access_key_id);
+    }
+
+    function aws_credentials_options_set_secret_access_key($options, $secret_access_key) {
+        self::$impl->aws_crt_credentials_options_set_secret_access_key($options, $secret_access_key);
+    }
+
+    function aws_credentials_options_set_session_token($options, $session_token) {
+        self::$impl->aws_crt_credentials_options_set_session_token($options, $session_token);
+    }
+
+    function aws_credentials_options_set_expiration_timepoint_seconds($options, $expiration_timepoint_seconds) {
+        self::$impl->aws_crt_credentials_options_set_expiration_timepoint_seconds($options, $expiration_timepoint_seconds);
+    }
+
+    function aws_credentials_new($options) {
+        return self::$impl->aws_crt_credentials_new($options);
+    }
+
+    function aws_credentials_release($credentials) {
+        self::$impl->aws_crt_credentials_release($credentials);
+    }
+
+    function aws_credentials_provider_release($provider) {
+        self::$impl->aws_crt_credentials_provider_release($provider);
+    }
+
+    function aws_credentials_provider_static_options_new() {
+        return self::$impl->aws_crt_credentials_provider_static_options_new();
+    }
+
+    function aws_credentials_provider_static_options_release($options) {
+        self::$impl->aws_crt_credentials_provider_static_options_release($options);
+    }
+
+    function aws_credentials_provider_static_options_set_access_key_id($options, $access_key_id) {
+        self::$impl->aws_crt_credentials_provider_static_options_set_access_key_id($options, $access_key_id);
+    }
+
+    function aws_credentials_provider_static_options_set_secret_access_key($options, $secret_access_key) {
+        self::$impl->aws_crt_credentials_provider_static_options_set_secret_access_key($options, $secret_access_key);
+    }
+
+    function aws_credentials_provider_static_options_set_session_token($options, $session_token) {
+        self::$impl->aws_crt_credentials_provider_static_options_set_session_token($options, $session_token);
+    }
+
+    function aws_credentials_provider_static_new($options) {
+        return self::$impl->aws_crt_credentials_provider_static_new($options);
+    }
 }

src/AWS/CRT/IO/EventLoopGroup.php

@@ -3,6 +3,7 @@
 namespace AWS\CRT\IO;
 
 use AWS\CRT\NativeResource as NativeResource;
+use AWS\CRT\Options as Options;
 
 /**
  * Represents 1 or more event loops (1 per thread) for doing I/O and background tasks.
@@ -19,13 +20,14 @@ final class EventLoopGroup extends NativeResource {
         );
     }
 
-    function __construct(array $options = array()) {
+    function __construct(array $options = []) {
         parent::__construct();
         if (count($options) == 0) {
             $options = self::defaults();
         }
+        $options = new Options($options);
         $elg_options = self::$crt->event_loop_group_options_new();
-        self::$crt->event_loop_group_options_set_max_threads($elg_options, $options['max_threads']);
+        self::$crt->event_loop_group_options_set_max_threads($elg_options, $options->getInt('max_threads'));
         $this->acquire(self::$crt->event_loop_group_new($elg_options));
         self::$crt->event_loop_group_options_release($elg_options);
     }

src/AWS/CRT/Internal/FFI.php

@@ -1,51 +0,0 @@
-<?php
-
-namespace AWS\CRT\Internal;
-
-use \Exception;
-use \RuntimeException;
-
-/**
- * @internal
- * Forwards calls on to libaws-crt-ffi via FFI
- */
-final class FFI {
-    private static $ffi = null;
-    private static $refcount = 0;
-
-    function __construct() {
-        if (is_null(self::$ffi)) {
-            try {
-                self::$ffi = \FFI::cdef(file_get_contents(__DIR__ . "/../../../api.h"), __DIR__ . "/../../../libaws-crt-ffi.so");
-                self::init();
-            } catch (Exception $e) {
-                throw new RuntimeException('Exception while initializing CRT via FFI', 0, $e);
-            }
-        }
-        ++self::$refcount;
-    }
-
-    function __destruct() {
-        if (--self::$refcount == 0) {
-            self::clean_up();
-            self::$ffi = null;
-        }
-    }
-
-    /**
-     * Forwards any call made on this object to the FFI function of the
-     * same name with the supplied arguments. Argument type hinting and checking
-     * occurs at the CRT wrapper.
-     */
-    function __call(string $name, $args) {
-        return call_user_func_array(array(self::$ffi, $name), $args);
-    }
-
-    private static function init() {
-        return self::$ffi->aws_crt_init();
-    }
-
-    private static function clean_up() {
-        return self::$ffi->aws_crt_clean_up();
-    }
-}

src/AWS/CRT/Options.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace AWS\CRT;
+
+final class Options {
+    private $options = [];
+
+    public function __construct($opts = []) {
+        $this->options = $opts;
+    }
+
+    public function __get($name) {
+        return (isset($this->options[$name])) ? $this->options[$name] : null;
+    }
+
+    public function asArray() {
+        return $this->options;
+    }
+
+    public function toArray() {
+        return array_merge_recursive([], $this->options);
+    }
+
+    public function getInt($name) {
+        $val = $this->$name;
+        return (is_null($val)) ? 0 : (int)$val;
+    }
+
+    public function getString($name) {
+        return !empty($this->options[$name]) ? strval($this->options[$name]) : "";
+    }
+}

src/tests/CredentialsTest.php

@@ -0,0 +1,43 @@
+<?php
+
+use AWS\CRT\Auth\AwsCredentials as AwsCredentials;
+use AWS\CRT\Auth\StaticCredentialsProvider as StaticCredentialsProvider;
+
+require_once('common.inc');
+
+final class CredentialsTest extends CrtTestCase {
+
+    public function testEmptyCredentials() {
+        $this->expectException(InvalidArgumentException::class);
+        $creds = new AwsCredentials(AwsCredentials::defaults());
+        $this->assertNotNull($creds, "Failed to create default/empty credentials");
+        $creds = null;
+    }
+
+    private function getCredentialsConfig() {
+        $options = AwsCredentials::defaults();
+        $options['access_key_id'] = 'TESTAWSACCESSKEYID';
+        $options['secret_access_key'] = 'TESTSECRETaccesskeyThatDefinitelyDoesntWork';
+        $options['session_token'] = 'ThisIsMyTestSessionTokenIMadeItUpMyself';
+        $options['expiration_timepoint_seconds'] = 42;
+        return $options;
+    }
+
+    public function testCredentialsLifetime() {
+        $options = $this->getCredentialsConfig();
+        $creds = new AwsCredentials($options);
+        $this->assertNotNull($creds, "Failed to create Credentials with options");
+        $this->assertEquals($creds->access_key_id, $options['access_key_id']);
+        $this->assertEquals($creds->secret_access_key, $options['secret_access_key']);
+        $this->assertEquals($creds->session_token, $options['session_token']);
+        $this->assertEquals($creds->expiration_timepoint_seconds, $options['expiration_timepoint_seconds']);
+        $creds = null;
+    }
+
+    public function testStaticCredentialsProviderLifetime() {
+        $options = $this->getCredentialsConfig();
+        $provider = new StaticCredentialsProvider($options);
+        $this->assertNotNull($provider, "Failed to create StaticCredentialsProvider");
+        $provider = null;
+    }
+}

src/tests/EventLoopGroupTest.php

@@ -2,7 +2,9 @@
 
 use AWS\CRT\IO\EventLoopGroup as EventLoopGroup;
 
-final class EventLoopGroupTest extends PHPUnit_Framework_TestCase {
+require_once('common.inc');
+
+final class EventLoopGroupTest extends CrtTestCase {
 
     public function testLifetime() {
         $elg = new EventLoopGroup();

src/tests/common.inc

@@ -0,0 +1,12 @@
+<?php
+
+use AWS\CRT\CRT as CRT;
+
+abstract class CrtTestCase extends PHPUnit_Framework_TestCase {
+    // Ensure that after every test there are no errors in the CRT itself
+    protected function assertPostConditions() {
+        if (CRT::last_error()) {
+            $this->fail("Test left an error on the stack: " . CRT::error_name(CRT::last_error()));
+        }
+    }
+}