diff --git a/aws/configAws/interface.go b/aws/configAws/interface.go
index 1d8a566..a784637 100644
--- a/aws/configAws/interface.go
+++ b/aws/configAws/interface.go
@@ -28,12 +28,12 @@ package configAws
 import (
 	"context"
 	"encoding/json"
-	"net/http"
 
 	sdkaws "github.com/aws/aws-sdk-go-v2/aws"
 	sdkcfg "github.com/aws/aws-sdk-go-v2/config"
 	sdkcrd "github.com/aws/aws-sdk-go-v2/credentials"
 	libaws "github.com/nabbar/golib/aws"
+	libhtc "github.com/nabbar/golib/httpcli"
 )
 
 func GetConfigModel() interface{} {
@@ -88,7 +88,7 @@ func (c *awsModel) Clone() libaws.Config {
 	}
 }
 
-func (c *awsModel) GetConfig(ctx context.Context, cli *http.Client) (*sdkaws.Config, error) {
+func (c *awsModel) GetConfig(ctx context.Context, cli libhtc.HttpClient) (*sdkaws.Config, error) {
 	var (
 		cfg sdkaws.Config
 		err error
@@ -98,7 +98,9 @@ func (c *awsModel) GetConfig(ctx context.Context, cli *http.Client) (*sdkaws.Con
 		return nil, ErrorConfigLoader.Error(err)
 	}
 
-	if c.AccessKey != "" && c.SecretKey != "" {
+	if len(c.AccessKey) < 1 || len(c.SecretKey) < 1 {
+		cfg.Credentials = sdkaws.AnonymousCredentials{}
+	} else {
 		cfg.Credentials = sdkcrd.NewStaticCredentialsProvider(c.AccessKey, c.SecretKey, "")
 	}
 
diff --git a/aws/configCustom/interface.go b/aws/configCustom/interface.go
index 174399e..47aadda 100644
--- a/aws/configCustom/interface.go
+++ b/aws/configCustom/interface.go
@@ -28,13 +28,13 @@ package configCustom
 import (
 	"context"
 	"encoding/json"
-	"net/http"
 	"net/url"
 	"strings"
 
 	sdkaws "github.com/aws/aws-sdk-go-v2/aws"
 	sdkcrd "github.com/aws/aws-sdk-go-v2/credentials"
 	libaws "github.com/nabbar/golib/aws"
+	libhtc "github.com/nabbar/golib/httpcli"
 )
 
 func GetConfigModel() interface{} {
@@ -103,11 +103,16 @@ func (c *awsModel) Clone() libaws.Config {
 	}
 }
 
-func (c *awsModel) GetConfig(ctx context.Context, cli *http.Client) (*sdkaws.Config, error) {
+func (c *awsModel) GetConfig(ctx context.Context, cli libhtc.HttpClient) (*sdkaws.Config, error) {
 
 	cfg := sdkaws.NewConfig()
 
-	cfg.Credentials = sdkcrd.NewStaticCredentialsProvider(c.AccessKey, c.SecretKey, "")
+	if len(c.AccessKey) < 1 || len(c.SecretKey) < 1 {
+		cfg.Credentials = sdkaws.AnonymousCredentials{}
+	} else {
+		cfg.Credentials = sdkcrd.NewStaticCredentialsProvider(c.AccessKey, c.SecretKey, "")
+	}
+
 	cfg.Retryer = c.retryer
 	cfg.EndpointResolver = sdkaws.EndpointResolverFunc(c.ResolveEndpoint)
 	cfg.EndpointResolverWithOptions = sdkaws.EndpointResolverWithOptionsFunc(c.ResolveEndpointWithOptions)
diff --git a/aws/configCustom/models.go b/aws/configCustom/models.go
index 28d4a2f..f198d43 100644
--- a/aws/configCustom/models.go
+++ b/aws/configCustom/models.go
@@ -41,8 +41,8 @@ import (
 type Model struct {
 	Region    string `mapstructure:"region" json:"region" yaml:"region" toml:"region" validate:"required,hostname"`
 	Endpoint  string `mapstructure:"endpoint" json:"endpoint" yaml:"endpoint" toml:"endpoint" validate:"url"`
-	AccessKey string `mapstructure:"accesskey" json:"accesskey" yaml:"accesskey" toml:"accesskey" validate:"required,printascii"`
-	SecretKey string `mapstructure:"secretkey" json:"secretkey" yaml:"secretkey" toml:"secretkey" validate:"required,printascii"`
+	AccessKey string `mapstructure:"accesskey" json:"accesskey" yaml:"accesskey" toml:"accesskey" validate:"omitempty,printascii"`
+	SecretKey string `mapstructure:"secretkey" json:"secretkey" yaml:"secretkey" toml:"secretkey" validate:"omitempty,printascii"`
 	Bucket    string `mapstructure:"bucket" json:"bucket" yaml:"bucket" toml:"bucket" validate:"omitempty,hostname"`
 }
 
diff --git a/aws/interface.go b/aws/interface.go
index c0f2dec..5c7d6a7 100644
--- a/aws/interface.go
+++ b/aws/interface.go
@@ -27,7 +27,6 @@ package aws
 
 import (
 	"context"
-	"net/http"
 	"net/url"
 	"sync"
 	"time"
@@ -43,6 +42,7 @@ import (
 	awspol "github.com/nabbar/golib/aws/policy"
 	awsrol "github.com/nabbar/golib/aws/role"
 	awsusr "github.com/nabbar/golib/aws/user"
+	libhtc "github.com/nabbar/golib/httpcli"
 )
 
 type Config interface {
@@ -67,7 +67,7 @@ type Config interface {
 	GetResolvedRegion() string
 	SetRetryer(retryer func() sdkaws.Retryer)
 
-	GetConfig(ctx context.Context, cli *http.Client) (*sdkaws.Config, error)
+	GetConfig(ctx context.Context, cli libhtc.HttpClient) (*sdkaws.Config, error)
 	JSON() ([]byte, error)
 	Clone() Config
 
@@ -84,7 +84,7 @@ type AWS interface {
 	User() awsusr.User
 
 	Config() Config
-	HTTPCli() *http.Client
+	HTTPCli() libhtc.HttpClient
 	Clone(ctx context.Context) (AWS, error)
 	NewForConfig(ctx context.Context, cfg Config) (AWS, error)
 	ForcePathStyle(ctx context.Context, enabled bool) error
@@ -100,7 +100,7 @@ type AWS interface {
 	SetClientIam(aws *sdkiam.Client)
 }
 
-func New(ctx context.Context, cfg Config, httpClient *http.Client) (AWS, error) {
+func New(ctx context.Context, cfg Config, httpClient libhtc.HttpClient) (AWS, error) {
 	if cfg == nil {
 		return nil, awshlp.ErrorConfigEmpty.Error(nil)
 	}
@@ -120,13 +120,13 @@ func New(ctx context.Context, cfg Config, httpClient *http.Client) (AWS, error)
 		h: httpClient,
 	}
 
-	if i, e := cli._NewClientIAM(ctx, httpClient); e != nil {
+	if i, e := cli._NewClientIAM(ctx, httpClient, nil); e != nil {
 		return nil, e
 	} else {
 		cli.i = i
 	}
 
-	if s, e := cli._NewClientS3(ctx, httpClient); e != nil {
+	if s, e := cli._NewClientS3(ctx, httpClient, nil); e != nil {
 		return nil, e
 	} else {
 		cli.s = s
diff --git a/aws/model.go b/aws/model.go
index ae8806c..b3340c2 100644
--- a/aws/model.go
+++ b/aws/model.go
@@ -42,6 +42,7 @@ import (
 	awspol "github.com/nabbar/golib/aws/policy"
 	awsrol "github.com/nabbar/golib/aws/role"
 	awsusr "github.com/nabbar/golib/aws/user"
+	libhtc "github.com/nabbar/golib/httpcli"
 )
 
 type client struct {
@@ -52,40 +53,57 @@ type client struct {
 	c Config
 	i *sdkiam.Client
 	s *sdksss.Client
-	h *http.Client
+	h libhtc.HttpClient
 }
 
 func (c *client) SetHTTPTimeout(dur time.Duration) error {
-	var h *http.Client
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	var h libhtc.HttpClient
 
 	if c.h == nil {
 		return fmt.Errorf("missing http client")
+	} else if cli, ok := c.h.(*http.Client); !ok {
+		return fmt.Errorf("not a standard http client, cannot change timeout")
 	} else {
 		h = &http.Client{
-			Transport:     c.h.Transport,
-			CheckRedirect: c.h.CheckRedirect,
-			Jar:           c.h.Jar,
+			Transport:     cli.Transport,
+			CheckRedirect: cli.CheckRedirect,
+			Jar:           cli.Jar,
 			Timeout:       dur,
 		}
 	}
 
-	if cli, err := c._NewClientS3(c.x, h); err != nil {
+	if cli, err := c._NewClientS3(c.x, h, c.s); err != nil {
 		return err
 	} else {
 		c.s = cli
 	}
 
+	if cli, err := c._NewClientIAM(c.x, h, c.i); err != nil {
+		return err
+	} else {
+		c.i = cli
+	}
+
 	return nil
 }
 
 func (c *client) GetHTTPTimeout() time.Duration {
-	if c.h != nil {
-		return c.h.Timeout
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	if c.h == nil {
+		return 0
+	} else if cli, ok := c.h.(*http.Client); !ok {
+		return 0
+	} else {
+		return cli.Timeout
 	}
-	return 0
 }
 
-func (c *client) _NewClientIAM(ctx context.Context, httpClient *http.Client) (*sdkiam.Client, error) {
+func (c *client) _NewClientIAM(ctx context.Context, httpClient libhtc.HttpClient, cli *sdkiam.Client) (*sdkiam.Client, error) {
 	var (
 		cfg *sdkaws.Config
 		iam *sdkiam.Client
@@ -112,25 +130,32 @@ func (c *client) _NewClientIAM(ctx context.Context, httpClient *http.Client) (*s
 		sig = sdksv4.NewSigner()
 	}
 
-	iam = sdkiam.New(sdkiam.Options{
-		APIOptions:  cfg.APIOptions,
-		Credentials: cfg.Credentials,
-		EndpointOptions: sdkiam.EndpointResolverOptions{
-			DisableHTTPS: !c.c.IsHTTPs(),
-		},
-		BaseEndpoint:       sdkaws.String(c.c.GetEndpoint().String()),
-		EndpointResolver:   c._NewIAMResolver(cfg),
-		EndpointResolverV2: c._NewIAMResolverV2(c.c),
-		HTTPSignerV4:       sig,
-		Region:             cfg.Region,
-		Retryer:            ret,
-		HTTPClient:         httpClient,
-	})
+	if cli == nil {
+		iam = sdkiam.New(sdkiam.Options{
+			APIOptions:  cfg.APIOptions,
+			Credentials: cfg.Credentials,
+			EndpointOptions: sdkiam.EndpointResolverOptions{
+				DisableHTTPS: !c.c.IsHTTPs(),
+			},
+			BaseEndpoint:       sdkaws.String(c.c.GetEndpoint().String()),
+			EndpointResolver:   c._NewIAMResolver(cfg),
+			EndpointResolverV2: c._NewIAMResolverV2(c.c),
+			HTTPSignerV4:       sig,
+			Region:             cfg.Region,
+			Retryer:            ret,
+			HTTPClient:         httpClient,
+		})
+	} else {
+		opt := cli.Options()
+		opt.HTTPClient = httpClient
+		opt.HTTPSignerV4 = sig
+		iam = sdkiam.New(opt)
+	}
 
 	return iam, nil
 }
 
-func (c *client) _NewClientS3(ctx context.Context, httpClient *http.Client) (*sdksss.Client, error) {
+func (c *client) _NewClientS3(ctx context.Context, httpClient libhtc.HttpClient, cli *sdksss.Client) (*sdksss.Client, error) {
 	var (
 		sss *sdksss.Client
 		err error
@@ -157,21 +182,29 @@ func (c *client) _NewClientS3(ctx context.Context, httpClient *http.Client) (*sd
 		sig = sdksv4.NewSigner()
 	}
 
-	sss = sdksss.New(sdksss.Options{
-		APIOptions:  cfg.APIOptions,
-		Credentials: cfg.Credentials,
-		EndpointOptions: sdksss.EndpointResolverOptions{
-			DisableHTTPS: !c.c.IsHTTPs(),
-		},
-		BaseEndpoint:       sdkaws.String(c.c.GetEndpoint().String()),
-		EndpointResolver:   c._NewS3Resolver(cfg),
-		EndpointResolverV2: c._NewS3ResolverV2(c.c),
-		HTTPSignerV4:       sig,
-		Region:             cfg.Region,
-		Retryer:            ret,
-		HTTPClient:         httpClient,
-		UsePathStyle:       c.p,
-	})
+	if cli == nil {
+		sss = sdksss.New(sdksss.Options{
+			APIOptions:  cfg.APIOptions,
+			Credentials: cfg.Credentials,
+			EndpointOptions: sdksss.EndpointResolverOptions{
+				DisableHTTPS: !c.c.IsHTTPs(),
+			},
+			BaseEndpoint:       sdkaws.String(c.c.GetEndpoint().String()),
+			EndpointResolver:   c._NewS3Resolver(cfg),
+			EndpointResolverV2: c._NewS3ResolverV2(c.c),
+			HTTPSignerV4:       sig,
+			Region:             cfg.Region,
+			Retryer:            ret,
+			HTTPClient:         httpClient,
+			UsePathStyle:       c.p,
+		})
+	} else {
+		opt := cli.Options()
+		opt.HTTPClient = httpClient
+		opt.HTTPSignerV4 = sig
+		opt.UsePathStyle = c.p
+		sss = sdksss.New(opt)
+	}
 
 	return sss, nil
 }
@@ -191,13 +224,13 @@ func (c *client) NewForConfig(ctx context.Context, cfg Config) (AWS, error) {
 		h: c.h,
 	}
 
-	if i, e := n._NewClientIAM(ctx, c.h); e != nil {
+	if i, e := n._NewClientIAM(ctx, c.h, nil); e != nil {
 		return nil, e
 	} else {
 		n.i = i
 	}
 
-	if s, e := n._NewClientS3(ctx, c.h); e != nil {
+	if s, e := n._NewClientS3(ctx, c.h, nil); e != nil {
 		return nil, e
 	} else {
 		n.s = s
@@ -225,13 +258,13 @@ func (c *client) Clone(ctx context.Context) (AWS, error) {
 		h: c.h,
 	}
 
-	if i, e := n._NewClientIAM(ctx, c.h); e != nil {
+	if i, e := n._NewClientIAM(ctx, c.h, nil); e != nil {
 		return nil, e
 	} else {
 		n.i = i
 	}
 
-	if s, e := n._NewClientS3(ctx, c.h); e != nil {
+	if s, e := n._NewClientS3(ctx, c.h, nil); e != nil {
 		return nil, e
 	} else {
 		n.s = s
@@ -246,12 +279,18 @@ func (c *client) ForcePathStyle(ctx context.Context, enabled bool) error {
 
 	c.p = enabled
 
-	if s, e := c._NewClientS3(ctx, nil); e != nil {
+	if s, e := c._NewClientS3(ctx, nil, c.s); e != nil {
 		return e
 	} else {
 		c.s = s
 	}
 
+	if i, e := c._NewClientIAM(ctx, nil, c.i); e != nil {
+		return e
+	} else {
+		c.i = i
+	}
+
 	return nil
 }
 
@@ -261,13 +300,13 @@ func (c *client) ForceSignerOptions(ctx context.Context, fct ...func(signer *sdk
 
 	c.o = fct
 
-	if i, e := c._NewClientIAM(ctx, nil); e != nil {
+	if i, e := c._NewClientIAM(ctx, nil, c.i); e != nil {
 		return e
 	} else {
 		c.i = i
 	}
 
-	if s, e := c._NewClientS3(ctx, nil); e != nil {
+	if s, e := c._NewClientS3(ctx, nil, c.s); e != nil {
 		return e
 	} else {
 		c.s = s
@@ -283,7 +322,7 @@ func (c *client) Config() Config {
 	return c.c
 }
 
-func (c *client) HTTPCli() *http.Client {
+func (c *client) HTTPCli() libhtc.HttpClient {
 	c.m.Lock()
 	defer c.m.Unlock()