Assumed role session chaining (with credential refreshing) for boto3
Project description
aws-assume-role-lib
Assumed role session chaining (with credential refreshing) for boto3
The typical way to use boto3 when programmatically assuming a role is to explicitly call sts.AssumeRole
and use the returned credentials to create a new boto3.Session
.
However, these credentials expire, and the code must explicitly handle this situation (e.g., in a Lambda function, calling AssumeRole
in every invocation).
With aws-assume-role-lib
, you can easily create assumed role sessions from parent sessions that automatically refresh expired credentials.
In a Lambda function that needs to assume a role, you can create the assumed role session during initialization and use it for the lifetime of the execution environment.
Note that in ~/.aws/config
, you have the option to have profiles that assume a role based on another profile, and this automatically handles refreshing expired credentials as well.
Installation
pip install --user aws-assume-role-lib
Or just add aws_assume_role_lib.py
to your project.
Usage
import boto3
from aws_assume_role_lib import assume_role
# Get a session
session = boto3.Session()
# or with a profile:
# session = boto3.Session(profile_name="my-profile")
# Assume the session
assumed_role_session = assume_role(session, "arn:aws:iam::123456789012:role/MyRole")
print(assumed_role_session.client("sts").get_caller_identity()["Arn"])
assume_role()
takes a session and a role ARN, and optionally other keyword arguments for sts.AssumeRole
.
Unlike the AssumeRole
API call itself, RoleArn
is required, but RoleSessionName
is not; it's automatically generated if one is not provided.
If any new arguments are added to AssumeRole
in the future, they can be passed in via the additional_kwargs
argument.
By default, assume_role()
checks if the parameters are invalid.
Without this validation, errors for these issues are more confusingly raised when the child session is first used to make an API call (boto3 does make the call to retrieve credentials until they are needed).
However, this incurs a small time penalty, so parameter validation can be disabled by passing validate=False
.
The parent session is available on the child session in the assume_role_parent_session
property.
Note this property is added by this library; ordinary boto3 sessions do not have it.
If you would like to cache the credentials on the file system, you can use the JSONFileCache
class, which will create files under the directory you provide in the constructor (which it will create if it doesn't exist).
Use it like:
assumed_role_session = assume_role(session, "arn:aws:iam::123456789012:role/MyRole", cache=JSONFileCache("path/to/dir"))
You can also use any dict
-like object for the cache (supporting __getitem__
/__setitem__
/__contains__
).
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for aws-assume-role-lib-1.1.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | c042b260a19887de85a43872e7808da47a9a3e4a664e7f8bac244aeaad2b1cbb |
|
MD5 | fbf6b8ecd2c7720b3f0d10b701ff85aa |
|
BLAKE2b-256 | 29289d39f7468e2233bba52610f8ba8ec975e67dd657c22dc7b27a4cb70e0154 |
Hashes for aws_assume_role_lib-1.1.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 974ec738239902c78d7a1e7372c4a3d5a6e068d2175c12ffa78671174b18c5e9 |
|
MD5 | 04306f824fc6eab8db39745feb924271 |
|
BLAKE2b-256 | 3319cfe1e9f18a37d0f2f275b898106d3a21ad2fca33e12072d300e78d5081ea |