Boto3：动态获取凭据？

Question

I am struggling to find out how I can get my aws_access_key_id and aws_secret_access_key dynamically from my code.

In boto2 I could do the following: boto.config.get_value('Credentials', 'aws_secret_access_key') but I can't seem to find a similar method in boto3. I was able to find the keys if I look in boto3.Session()._session._credentials but that seems like the mother of all hacks to me and I would rather not go down that road.

Answer 1

It's generally a best practice to only use temporary credentials . You can get temporary credentials with STS.get_session_token .

EDIT: As of this PR , you can access the current session credentials like so:

import boto3

session = boto3.Session()
credentials = session.get_credentials()

# Credentials are refreshable, so accessing your access key / secret key
# separately can lead to a race condition. Use this to get an actual matched
# set.
credentials = credentials.get_frozen_credentials()
access_key = credentials.access_key
secret_key = credentials.secret_key

redshift = session.client('redshift')
...

I would still recommend using temporary credentials scoped to exactly what redshift needs.

Answer 2

Use botocore

>>> import botocore.session
>>> session = botocore.session.get_session()

>>> session.get_credentials().access_key
'AKIAABCDEF6RWSGI234Q'

>>> session.get_credentials().secret_key
'abcdefghijkl+123456789+qbcd'

>>> session.get_config_variable('region')
'us-east-1'

Answer 3

Can I suggest that accessing the keys is WRONG using boto3 :

import boto3
session = boto3.Session(profile_name="my-profile")

dynamodb = session.resource(
    "dynamodb",
    region_name=session.region_name,
    # aws_access_key_id=session.get_credentials().access_key,
    # aws_secret_access_key=session.get_credentials().secret_key,
)

Notice, I commented out accessing the keys because ¹ :

Any clients created from this session will use credentials from the [my-profile] section of ~/.aws/credentials .

Answer 4

import boto3
from botocore import session

def get_credentials():
   credentials = boto3.client(
       'sts',
       region_name="us-east-1", 
       aws_access_key_id='123', 
       aws_secret_access_key='123',
   ).assume_role(
       RoleArn="arn:aws-cn:iam::123",  # Your RoleArn
       RoleSessionName='boto3_client')

   return credentials


def db_conn():
    credentials = get_credentials()

    db = boto3.resource(
        'dynamodb',
        region_name="us-east-1",
        aws_access_key_id=credentials['Credentials']['AccessKeyId'],
        aws_secret_access_key=credentials['Credentials']['SecretAccessKey'],
        aws_session_token=credentials['Credentials']['SessionToken'],
    )
   
    # table = db.Table(your_table_name)

    # response = table.query(
    # IndexName='age',
    # KeyConditionExpression=Key('age').eq(11)
    # )


if __name__ == "__main__": 
   db_conn()