Using boto3 with temporary credentials

Question

I would like to use boto3 to upload a file to AWS S3. But I only have a temporary access to S3, provided by a webservice which is not under my control. I'm provided with the following credential information:

    {
        "key": <string>,
        "x-amz-algorithm": <string>,
        "x-amz-credential": <string>,
        "x-amz-date": <string>,
        "policy": <string>,
        "x-amz-signature": <string>
    }

As far as I know, these information can be used for a POST request for example. But I was unable to find out how to use this information in combination with the boto3 command

s3 = boto3.client('s3')

which needs normally the aws_access_key_id and the aws_secret_access_key . This post here suggests, that this should be possible:

Rather than signing URLs (which is typically used when making calls via web browser), you should generate temporary credentials via the AWS Security Token Service (STS)

[...]

Your Python app would then use these credentials when calling boto

But I was not able to find out, how to provide the boto client with the temporary credentials.

Answer 1

It would appear that you have been given an Amazon S3 pre-signed URLs . This is a way of granting temporary access to a specific Amazon S3 command, with a hashed signature that authorizes the request.

While an Access Key and Secret key were used to generate the request, you cannot extract the Secret Key from the request. (Rather, it was used to create the signature.) Therefore, you cannot use boto3 to make a request using the supplied information. This is totally intentional.

Generating temporary credentials with the Security Token Service is different to generating a pre-signed URL. STS will provide credentials that can be used by boto3. However, that is not what they have done when providing you with access information.