Trying to Get Balance in MTurk using Boto but get “The identity contained in the request is not authorized to use this AWSAccessKeyId”

Question

I am trying to GetAccountBalance on my Mechanical Turk account using Boto referencing to my shared credentials file. I have been successful in doing so by typing my credentials directly but have failed when using the profile name.

The following code works

import import boto.mturk.connection
sandbox_host = 'mechanicalturk.sandbox.amazonaws.com'

mturk = boto.mturk.connection.MTurkConnection(
   aws_access_key_id = 'XXX',
   aws_secret_access_key = 'XXX',
   host = sandbox_host,
)

print mturk.get_account_balance() # [$10,000.00]

However I want to use a profile I created in ~/.aws/credentials :

[default]
aws_access_key_id = 'XXX'
aws_secret_access_key = 'XXX'

[iamuser]
aws_access_key_id = 'XXX'
aws_secret_access_key = 'XXX'

The default profile is the master AWS account, while the iamuser is a IAM user with Full Mechanical Turk privileges. I would like to use the iamuser to check my MTurk balance. As I stated before, the previous code with the explicit keys works fine. However I would like for it to work in the following way:

import import boto.mturk.connection
sandbox_host = 'mechanicalturk.sandbox.amazonaws.com'

mturk = boto.mturk.connection.MTurkConnection(
   profile_name = 'iamuser',
   host = sandbox_host,
)

print mturk.get_account_balance() # [$10,000.00]

When I try this I get the following error:

Traceback (most recent call last): File "", line 1, in File "/usr/local/lib/python2.7/site-packages/boto/mturk/connection.py", line 74, in get_account_balance ('OnHoldBalance', Price)]) File "/usr/local/lib/python2.7/site-packages/boto/mturk/connection.py", line 838, in _process_request return self._process_response(response, marker_elems) File "/usr/local/lib/python2.7/site-packages/boto/mturk/connection.py", line 853, in _process_response raise MTurkRequestError(response.status, response.reason, body) boto.mturk.connection.MTurkRequestError: MTurkRequestError: 200 OK b6bdb875-b937-471c-bc00-86225e198ee2 AWS.NotAuthorized The identity contained in the request is not authorized to use this AWSAccessKeyId (1482788645643 s)

I would appreciate any help on this issue. Thanks

Answer 1

Found where my bug was. Apparently there is a priority at which credentials are read. Environmental variables get a higher priority than shared-credentials. I had some environmental variables being declared on .bash_profile which conflicted with the ones in my script. So the solution was to erase them from the .bash_profile file

Something that was very useful for finding this bug was running the following command on python:

boto.set_stream_logger('boto')

which makes it way easier to debug boto.