imbi-plugin-aws
AWS provider for Imbi under Plugin Architecture v3. The package ships a
single AWSPlugin (slug aws) that backs an AWS Integration with three
capabilities from one credential blob.
Capabilities
This package ships one Plugin, discovered by the imbi-common registry
via the imbi_plugin_* naming convention (module-level PLUGIN
attribute; no imbi.plugins entry points).
| Capability | Contract | Backing service |
|---|---|---|
identity |
IdentityCapability |
IAM Identity Center (device flow) |
logs |
LogsCapability |
CloudWatch Logs Insights |
configuration |
ConfigurationCapability |
SSM Parameter Store |
The identity capability federates each Imbi user into AWS via IAM
Identity Center (formerly AWS SSO) and mints short-lived STS credentials
per call. It is project_scoped=False (Integration-wide) and
default_enabled=True — for AWS, identity is the credential mechanism.
The logs and configuration capabilities set requires_identity=True
and consume those STS credentials transparently.
Manifest shape
Integration-level (declared once, read from ctx.integration_options):
region— default AWS region for every capability; a per-environmentAwsAccount.default_regionoverrides it.default_role_name— IAM role assumed when a per-environmentAwsAccountbinding does not specify one.
Credentials (the only credential declaration, IAM IC auto-managed):
client_id, client_secret, client_scopes.
Capability options (read from ctx.capability_options):
identity:start_url(required),default_account_id.logs:log_group_names(required),base_filter,message_field,timestamp_field,level_field,poll_interval_ms,timeout_seconds.configuration:path_prefix(required),kms_key_id,timeout_seconds.
Identity consumption contract
When the identity capability's materialize() runs (host-side, before
a data capability's handler), it calls GetRoleCredentials against the
IAM IC Portal API and returns short-lived STS keys in
IdentityCredentials.extra:
IdentityCredentials(
access_token=<unchanged IAM IC token>,
extra={
'aws_access_key_id': 'AKIA...',
'aws_secret_access_key': '...',
'aws_session_token': '...',
'aws_region': 'us-east-1',
'aws_account_id': '111111111111',
},
)
The host attaches this to PluginContext.identity; the logs and
configuration capabilities read the five well-known keys from
ctx.identity.extra via aws_session.resolve_credentials(). The account
and role are resolved per environment via
(:Environment)-[:MAPS_TO]->(:AwsAccount), falling back to the
Integration-level default_role_name and region.
License
BSD-3-Clause.
Metadata
Release files for imbi-plugin-aws 2.39.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| imbi_plugin_aws-2.39.0.tar.gz | 50.2 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| imbi_plugin_aws-2.39.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 89.5 kB
Release files / imbi_plugin_aws-2.39.0.tar.gz
| Download URL | imbi_plugin_aws-2.39.0.tar.gz |
|---|---|
| Size | 50.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
fa52bc063dc6c3ee04426c01f4377062438725e413f700e11d346360aa985b25
|
|
BLAKE2b-256 checksum How to use checksums |
c83e0f64648400c439920cf181001f1046a4e24bccf1ee855677027b68b8a662
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logRelease files / imbi_plugin_aws-2.39.0-py3-none-any.whl
| Download URL | imbi_plugin_aws-2.39.0-py3-none-any.whl |
|---|---|
| Size | 39.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
5bd4ef6fbfd0f72af6f1a0604cc8489d3b399e79633839ff831a011da9a11314
|
|
BLAKE2b-256 checksum How to use checksums |
4e8d25670c26c472f5186c528c38f830bee8a9ac932db97aeb546f323cad2fff
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logSecurity for imbi-plugin-aws 2.39.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for imbi_plugin_aws-2.39.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
