issue-creds
Vend short-lived, scope-limited AWS S3 credentials from inside the hub. Wraps
STS AssumeRoleWithWebIdentity and applies an inline session policy that can
only intersect with the role's identity policy — it can shrink permissions,
never widen them.
Install
pip install issue-creds # from a built wheel/sdist or your index
# or, from a checkout:
pip install .
This installs an issue-creds command on $PATH.
Usage
# Read the whole bucket for 30 minutes
issue-creds --role download --lifetime 30m
# Read a single prefix
issue-creds --role download --prefix lagranto/runs
# Upload — defaults to your own JUPYTERHUB_USER prefix; --prefix overrides it
issue-creds --role upload
issue-creds --role upload --prefix shared/inbox
# Full role (the legacy "power user" behaviour)
issue-creds --role power
Inspect what would be requested without calling STS:
issue-creds --role upload --bucket-scope reflective-persistent-prod --dry-run
Other formats: --format env (default), --format profile, --format json.
Roles
| role | grants | prefix scoping |
|---|---|---|
download |
Get/List (+versions), GetBucketLocation | optional --prefix (whole bucket if omitted) |
upload |
Put, multipart, List/ListMultipart, GetBucketLocation (no Get) | defaults to JUPYTERHUB_USER/*; --prefix overrides |
Configuration (environment)
| variable | purpose |
|---|---|
AWS_ROLE_ARN |
default role ARN (fallback for all roles) |
ISSUE_CREDS_DOWNLOAD_ROLE_ARN |
dedicated download role ARN (optional; overrides the fallback) |
ISSUE_CREDS_UPLOAD_ROLE_ARN |
dedicated upload role ARN (optional) |
ISSUE_CREDS_POWER_ROLE_ARN |
dedicated power role ARN (optional) |
ISSUE_CREDS_MAX_LIFETIME |
cap on --lifetime (default 1h; upload allows up to 6h); also raise the role's MaxSessionDuration |
AWS_WEB_IDENTITY_TOKEN_FILE |
OIDC token file (set by the hub) |
JUPYTERHUB_USER |
default upload prefix (overridable with --prefix) and CloudTrail session name |
Security note
The session policy is defense-in-depth, not a boundary. Any user who can read
AWS_WEB_IDENTITY_TOKEN_FILE can call AssumeRoleWithWebIdentity themselves
without the restrictive policy and get whatever the underlying role allows. Real
enforcement comes from separate, tightly-scoped IAM roles per download /
upload / power, gated by the OIDC trust policy. Set the dedicated role ARN
env vars above to switch from advisory to enforced — no code change required.
Development
pip install -e .[dev]
pytest
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file issue_creds-0.1.0.tar.gz.
File metadata
- Download URL: issue_creds-0.1.0.tar.gz
- Upload date:
- Size: 17.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/6.1.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
bcd7dcdae762568f9ca3786934289e40ccadd4dc229635db07e53498efccd32a
|
|
| MD5 |
4c8d215563c3bccf232bf7a63e4154b0
|
|
| BLAKE2b-256 |
2ec1b1dc72bc37f373b3dd265594e30a700d15a6f70725062c36429b3d8742db
|
Provenance
The following attestation bundles were made for issue_creds-0.1.0.tar.gz:
Publisher:
ci.yml on ReflectiveCloud/hub-token-vending-machine
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
issue_creds-0.1.0.tar.gz -
Subject digest:
bcd7dcdae762568f9ca3786934289e40ccadd4dc229635db07e53498efccd32a - Sigstore transparency entry: 2220025641
- Sigstore integration time:
-
Permalink:
ReflectiveCloud/hub-token-vending-machine@ee558f7b47d54c93a938b778b9969c1040c8f9a2 -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/ReflectiveCloud
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
ci.yml@ee558f7b47d54c93a938b778b9969c1040c8f9a2 -
Trigger Event:
push
-
Statement type:
File details
Details for the file issue_creds-0.1.0-py3-none-any.whl.
File metadata
- Download URL: issue_creds-0.1.0-py3-none-any.whl
- Upload date:
- Size: 14.5 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/6.1.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
fcab99af9e27664ef3da43dd015b962893de8458caec30d4ea1f1b1309f71da7
|
|
| MD5 |
f5e8fa8da6200cad651dbb9be76a1ff0
|
|
| BLAKE2b-256 |
eaa91013e3990a63927fe8eae55d22daddf58c9ef25fb92edc158d6a3125e2e6
|
Provenance
The following attestation bundles were made for issue_creds-0.1.0-py3-none-any.whl:
Publisher:
ci.yml on ReflectiveCloud/hub-token-vending-machine
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
issue_creds-0.1.0-py3-none-any.whl -
Subject digest:
fcab99af9e27664ef3da43dd015b962893de8458caec30d4ea1f1b1309f71da7 - Sigstore transparency entry: 2220025695
- Sigstore integration time:
-
Permalink:
ReflectiveCloud/hub-token-vending-machine@ee558f7b47d54c93a938b778b9969c1040c8f9a2 -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/ReflectiveCloud
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
ci.yml@ee558f7b47d54c93a938b778b9969c1040c8f9a2 -
Trigger Event:
push
-
Statement type:
