issue-creds

Vend short-lived, scope-limited AWS S3 credentials from inside the hub. Wraps STS AssumeRoleWithWebIdentity and applies an inline session policy that can only intersect with the role's identity policy — it can shrink permissions, never widen them.

Install

pip install issue-creds            # from a built wheel/sdist or your index
# or, from a checkout:
pip install .

This installs an issue-creds command on $PATH.

Usage

# Read the whole bucket for 30 minutes
issue-creds --role download --lifetime 30m
# Read a single prefix
issue-creds --role download --prefix lagranto/runs
# Upload — defaults to your own JUPYTERHUB_USER prefix; --prefix overrides it
issue-creds --role upload
issue-creds --role upload --prefix shared/inbox
# Full role (the legacy "power user" behaviour)
issue-creds --role power

Inspect what would be requested without calling STS:

issue-creds --role upload --bucket-scope reflective-persistent-prod --dry-run

Other formats: --format env (default), --format profile, --format json.

Roles

Configuration (environment)

Security note

The session policy is defense-in-depth, not a boundary. Any user who can read AWS_WEB_IDENTITY_TOKEN_FILE can call AssumeRoleWithWebIdentity themselves without the restrictive policy and get whatever the underlying role allows. Real enforcement comes from separate, tightly-scoped IAM roles per download / upload / power, gated by the OIDC trust policy. Set the dedicated role ARN env vars above to switch from advisory to enforced — no code change required.

Development

pip install -e .[dev]
pytest