1---
2title: 2.0.0-beta.53 - AWS Auth & Config Props
3date: 2026-06-10T18:00:00Z
4category: release
5excerpt: v2.0.0-beta.53 moves AWS authentication onto Alchemy profiles — `alchemy login` now manages AWS credentials like every other provider — and extends `effect/Config` from Worker init into any resource input prop.
6---
7
8AWS authentication now runs through Alchemy's own auth-provider
9system. `alchemy login` manages AWS credentials the same way it
10manages Cloudflare's — one profile (selected by `ALCHEMY_PROFILE`),
11one interactive setup, no `AWS_PROFILE` / `AWS_ACCOUNT_ID` env
12plumbing in your shell. And `effect/Config`, which beta.45 made the
13way to read config inside a Worker, now works in any resource input
14prop too.
15
16:::caution
17**Breaking changes for AWS users:**
18
19- **AWS credentials resolve through the Alchemy auth provider.**
20 `AWSEnvironment.Default` no longer reads `AWS_PROFILE` / SSO config
21 directly — run `alchemy login --configure` once and pick SSO,
22 Environment Variables, or Stored. Under CI the Environment
23 Variables method is selected automatically, so
24 `aws-actions/configure-aws-credentials` pipelines keep working
25 ([#574](https://github.com/alchemy-run/alchemy/pull/574)).
26- **`AWSEnvironment` is now lazy.** The service holds an
27 `Effect<AWSEnvironmentShape>` — read it with
28 `yield* AWSEnvironment.current` instead of `yield* AWSEnvironment`.
29 `AWSEnvironment.makeEnvironment` and `loadDefault` are removed
30 ([#567](https://github.com/alchemy-run/alchemy/pull/567)).
31:::
32
33## AWS auth through `alchemy login`
34
35Setting up AWS is now the same flow as every other provider:
36
37```sh
38alchemy login --configure
39
40# AWS authentication method
41# ● SSO — aws sso login, credentials loaded from AWS SSO cache
42# ○ Environment Variables — AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY
43# ○ Stored — stored in ~/.alchemy/credentials
44```
45
46Your AWS account ID is captured automatically via
47`STS.GetCallerIdentity` and saved on the profile — the Stored method
48detects it from the keys you paste, and the Environment Variables
49method falls back to STS when `AWS_ACCOUNT_ID` isn't exported
50([#574](https://github.com/alchemy-run/alchemy/pull/574)).
51
52Auth providers are also evaluated **lazily** now
53([#567](https://github.com/alchemy-run/alchemy/pull/567)).
54Credentials resolve the first time a resource actually needs them —
55a stack that touches no AWS resources never prompts for AWS auth.
56Inside lifecycle operations, the environment is read through the new
57accessor:
58
59```diff lang="typescript"
60reconcile: Effect.fn(function* ({ id, news }) {
61- const { accountId, region } = yield* AWSEnvironment;
62+ const { accountId, region } = yield* AWSEnvironment.current;
63 // ...
64}),
65```
66
67Rounding it out, `alchemy login` always refreshes credentials instead
68of short-circuiting on a non-expired cache
69([#575](https://github.com/alchemy-run/alchemy/pull/575)), and
70`--configure` no longer runs a redundant login pass after the
71interactive setup completes.
72
73## `effect/Config` in any input prop
74
75[beta.45](/blog/2026-05-29-beta-45) made `effect/Config` the way to
76read secrets and variables inside a Worker's init. beta.53 completes
77the picture: `Config` values are resolved in **resource input props**
78— at the top level or nested anywhere inside objects and arrays
79([#566](https://github.com/alchemy-run/alchemy/pull/566)).
80
81```typescript
82export default class EffectWorker extends Cloudflare.Worker<EffectWorker>()(
83 "EffectWorker",
84 {
85 main: import.meta.filename,
86 dev: {
87 port: Config.number("PORT").pipe(Config.withDefault(1338)),
88 },
89 },
90 Effect.gen(function* () {
91 /* ... */
92 }),
93) {}
94```
95
96The plan resolves each `Config` against the deploy environment's
97`ConfigProvider`, so the concrete value flows into diffing and
98hashing — an opaque `Config` would otherwise hash the same no matter
99what it evaluates to. `Config.redacted` resolves to a `Redacted` that
100stays wrapped end to end, preserving the secrecy boundary. See
101[Concepts › Secrets and Config](/environments/secrets).
102
103## `alchemy dev` fixes
104
105Two dev-server fixes land via `@distilled.cloud/cloudflare-runtime`
106bumps (0.10.5 → 0.10.11): a race condition when a stack runs more
107than one Workflow in `alchemy dev`
108([#573](https://github.com/alchemy-run/alchemy/pull/573)), and
109incorrect Vite handling of `require()` of Node built-ins in Worker
110code ([#556](https://github.com/alchemy-run/alchemy/pull/556)).
111
112## Also in this release
113
114- **R2 custom-domain updates ride out `NoSuchBucket`** during R2's
115 endpoint eventual-consistency window — including when a create
116 loses a race and the winning bucket isn't readable yet
117 ([448ba756](https://github.com/alchemy-run/alchemy/commit/448ba756)).
118- **Narrowed S3 bucket tag-fetch requirements** to
119 `Credentials | HttpClient | Region`. Thanks
120 **[Kilian Cirera Sant](https://github.com/kiliancs)**
121 ([#555](https://github.com/alchemy-run/alchemy/pull/555)).
122- **Fixed Worker static-assets bundling** by switching to a named
123 import of `@alchemy.run/node-utils/ignore`
124 ([#572](https://github.com/alchemy-run/alchemy/pull/572)).
125- **Added a missing permission to
126 [Tutorial Part 5](/cloudflare/tutorial/part-5)**. Thanks
127 **[David J. Felix](https://github.com/DavidJFelix)**
128 ([#560](https://github.com/alchemy-run/alchemy/pull/560)).
129
130## Where to go next
131
132- [Concepts › Profiles](/environments/profiles)
133- [Concepts › Secrets and Config](/environments/secrets)
134- [Concepts › Local Development](/environments/local-development)
135- [Guides › CLI](/cli)
136- [CHANGELOG](https://github.com/alchemy-run/alchemy/blob/main/CHANGELOG.md#v200-beta53)
137- [Compare v2.0.0-beta.52 → v2.0.0-beta.53](https://github.com/alchemy-run/alchemy/compare/v2.0.0-beta.52...v2.0.0-beta.53)