boto3-refresh-session 0.1.22__py3-none-any.whl → 1.0.1__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- boto3_refresh_session/__init__.py +2 -2
- boto3_refresh_session/session.py +90 -116
- {boto3_refresh_session-0.1.22.dist-info → boto3_refresh_session-1.0.1.dist-info}/METADATA +18 -17
- boto3_refresh_session-1.0.1.dist-info/RECORD +6 -0
- boto3_refresh_session-0.1.22.dist-info/RECORD +0 -6
- {boto3_refresh_session-0.1.22.dist-info → boto3_refresh_session-1.0.1.dist-info}/LICENSE +0 -0
- {boto3_refresh_session-0.1.22.dist-info → boto3_refresh_session-1.0.1.dist-info}/WHEEL +0 -0
boto3_refresh_session/session.py
CHANGED
|
@@ -1,143 +1,127 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
2
|
|
|
3
3
|
__doc__ = """
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
.. warning::
|
|
8
|
-
``AutoRefreshableSession`` was not tested for manually passing hard-coded
|
|
9
|
-
account credentials to the ``boto3.client`` object! There is an optional
|
|
10
|
-
``client_kwargs`` parameter available for doing so, which *should* work;
|
|
11
|
-
however, that cannot be guaranteed as that functionality was not tested.
|
|
12
|
-
Pass hard-coded credentials with the ``client_kwargs`` parameter at your
|
|
13
|
-
own discretion.
|
|
4
|
+
A :class:`boto3.session.Session` object that automatically refreshes temporary
|
|
5
|
+
credentials.
|
|
14
6
|
"""
|
|
15
|
-
__all__ = ["
|
|
7
|
+
__all__ = ["RefreshableSession"]
|
|
16
8
|
|
|
17
|
-
from
|
|
18
|
-
from
|
|
19
|
-
|
|
20
|
-
from attrs import define, field
|
|
21
|
-
from attrs.validators import ge, instance_of, optional
|
|
22
|
-
from boto3 import Session, client
|
|
9
|
+
from boto3 import client
|
|
10
|
+
from boto3.session import Session
|
|
23
11
|
from botocore.credentials import (
|
|
24
12
|
DeferredRefreshableCredentials,
|
|
25
13
|
RefreshableCredentials,
|
|
26
14
|
)
|
|
27
|
-
from botocore.session import get_session
|
|
28
|
-
|
|
29
|
-
# configuring logging
|
|
30
|
-
basicConfig(
|
|
31
|
-
level=INFO, format="%(asctime)s - %(name)s - %(levelname)s - %(message)s"
|
|
32
|
-
)
|
|
33
|
-
|
|
34
|
-
# creating logger
|
|
35
|
-
logger = getLogger(__name__)
|
|
36
15
|
|
|
37
16
|
|
|
38
|
-
|
|
39
|
-
class
|
|
40
|
-
|
|
41
|
-
steps required.
|
|
42
|
-
|
|
43
|
-
This object is useful for long-running processes where temporary credentials
|
|
44
|
-
may expire.
|
|
17
|
+
class RefreshableSession(Session):
|
|
18
|
+
"""Returns a :class:`boto3.session.Session` object with temporary credentials
|
|
19
|
+
that refresh automatically.
|
|
45
20
|
|
|
46
21
|
Parameters
|
|
47
22
|
----------
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
role_arn : str
|
|
51
|
-
AWS role ARN.
|
|
52
|
-
session_name : str
|
|
53
|
-
Name for session.
|
|
23
|
+
assume_role_kwargs : dict
|
|
24
|
+
Required keyword arguments for the :meth:`STS.Client.assume_role` method.
|
|
54
25
|
defer_refresh : bool, optional
|
|
55
26
|
If ``True`` then temporary credentials are not automatically refreshed until
|
|
56
27
|
they are explicitly needed. If ``False`` then temporary credentials refresh
|
|
57
|
-
immediately upon expiration.
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
----------
|
|
68
|
-
session
|
|
69
|
-
Returns a :class:`boto3.session.Session` object with credentials which refresh
|
|
70
|
-
automatically.
|
|
28
|
+
immediately upon expiration. It is highly recommended that you use ``True``.
|
|
29
|
+
Default is ``True``.
|
|
30
|
+
sts_client_kwargs : dict, optional
|
|
31
|
+
Optional keyword arguments for the :class:`STS.Client` object. Default is
|
|
32
|
+
an empty dictionary.
|
|
33
|
+
|
|
34
|
+
Other Parameters
|
|
35
|
+
----------------
|
|
36
|
+
kwargs : dict
|
|
37
|
+
Optional keyword arguments for the :class:`boto3.session.Session` object.
|
|
71
38
|
|
|
72
39
|
Notes
|
|
73
40
|
-----
|
|
74
41
|
Check the :ref:`authorization documentation <authorization>` for additional
|
|
75
42
|
information concerning how to authorize access to AWS.
|
|
76
43
|
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
refreshing expired temporary credentials automatically after they expire.
|
|
44
|
+
Check the `AWS documentation <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html>`_
|
|
45
|
+
for additional information concerning temporary security credentials in IAM.
|
|
80
46
|
|
|
81
47
|
Examples
|
|
82
48
|
--------
|
|
83
|
-
|
|
49
|
+
In order to use this object, you are required to configure parameters for the
|
|
50
|
+
:meth:`STS.Client.assume_role` method.
|
|
51
|
+
|
|
52
|
+
>>> assume_role_kwargs = {
|
|
53
|
+
>>> 'RoleArn': '<your-role-arn>',
|
|
54
|
+
>>> 'RoleSessionName': '<your-role-session-name>',
|
|
55
|
+
>>> 'DurationSeconds': '<your-selection>',
|
|
56
|
+
>>> ...
|
|
57
|
+
>>> }
|
|
58
|
+
|
|
59
|
+
You may also want to provide optional parameters for the :class:`STS.Client` object.
|
|
60
|
+
|
|
61
|
+
>>> sts_client_kwargs = {
|
|
62
|
+
>>> ...
|
|
63
|
+
>>> }
|
|
64
|
+
|
|
65
|
+
You may also provide optional parameters for the :class:`boto3.session.Session` object
|
|
66
|
+
when initializing the ``RefreshableSession`` object. Below, we use the ``region_name``
|
|
67
|
+
parameter for illustrative purposes.
|
|
68
|
+
|
|
69
|
+
>>> session = boto3_refresh_session.RefreshableSession(
|
|
70
|
+
>>> assume_role_kwargs=assume_role_kwargs,
|
|
71
|
+
>>> sts_client_kwargs=sts_client_kwargs,
|
|
72
|
+
>>> region_name='us-east-1',
|
|
73
|
+
>>> )
|
|
84
74
|
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
75
|
+
Using the ``session`` variable that you just created, you can now use all of the methods
|
|
76
|
+
available from the :class:`boto3.session.Session` object. In the below example, we
|
|
77
|
+
initialize an S3 client and list all available buckets.
|
|
78
|
+
|
|
79
|
+
>>> s3 = session.client(service_name='s3')
|
|
80
|
+
>>> buckets = s3.list_buckets()
|
|
81
|
+
|
|
82
|
+
There are two ways of refreshing temporary credentials automatically with the
|
|
83
|
+
``RefreshableSession`` object: refresh credentials the moment they expire, or wait until
|
|
84
|
+
temporary credentials are explicitly needed. The latter is the default. The former must
|
|
85
|
+
be configured using the ``defer_refresh`` parameter, as shown below.
|
|
86
|
+
|
|
87
|
+
>>> session = boto3_refresh_session.RefreshableSession(
|
|
88
|
+
>>> defer_refresh=False,
|
|
89
|
+
>>> assume_role_kwargs=assume_role_kwargs,
|
|
90
|
+
>>> sts_client_kwargs=sts_client_kwargs,
|
|
91
|
+
>>> region_name='us-east-1',
|
|
89
92
|
>>> )
|
|
90
|
-
>>> s3_client = sess.session.client(service_name="s3")
|
|
91
93
|
"""
|
|
92
94
|
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
)
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
)
|
|
118
|
-
|
|
119
|
-
logger.info("Fetching temporary AWS credentials.")
|
|
120
|
-
|
|
121
|
-
# determining how to refresh expired temporary credentials
|
|
122
|
-
if not self.defer_refresh:
|
|
123
|
-
__credentials = RefreshableCredentials.create_from_metadata(
|
|
124
|
-
metadata=self._get_credentials(),
|
|
125
|
-
refresh_using=self._get_credentials,
|
|
126
|
-
method="sts-assume-role",
|
|
95
|
+
def __init__(
|
|
96
|
+
self,
|
|
97
|
+
assume_role_kwargs: dict,
|
|
98
|
+
defer_refresh: bool = True,
|
|
99
|
+
sts_client_kwargs: dict = {},
|
|
100
|
+
**kwargs,
|
|
101
|
+
):
|
|
102
|
+
# inheriting from boto3.session.Session
|
|
103
|
+
super().__init__(**kwargs)
|
|
104
|
+
|
|
105
|
+
# initializing custom parameters that are necessary outside of __init__
|
|
106
|
+
self.assume_role_kwargs = assume_role_kwargs
|
|
107
|
+
|
|
108
|
+
# initializing the STS client
|
|
109
|
+
self._sts_client = client(service_name="sts", **sts_client_kwargs)
|
|
110
|
+
|
|
111
|
+
# determining how exactly to refresh expired temporary credentials
|
|
112
|
+
if not defer_refresh:
|
|
113
|
+
self._session._credentials = (
|
|
114
|
+
RefreshableCredentials.create_from_metadata(
|
|
115
|
+
metadata=self._get_credentials(),
|
|
116
|
+
refresh_using=self._get_credentials,
|
|
117
|
+
method="sts-assume-role",
|
|
118
|
+
)
|
|
127
119
|
)
|
|
128
120
|
else:
|
|
129
|
-
|
|
121
|
+
self._session._credentials = DeferredRefreshableCredentials(
|
|
130
122
|
refresh_using=self._get_credentials, method="sts-assume-role"
|
|
131
123
|
)
|
|
132
124
|
|
|
133
|
-
# mounting temporary credentials to session object
|
|
134
|
-
_session._credentials = __credentials
|
|
135
|
-
|
|
136
|
-
# initializing session using temporary credentials
|
|
137
|
-
self.session = Session(
|
|
138
|
-
botocore_session=_session, **self.session_kwargs
|
|
139
|
-
)
|
|
140
|
-
|
|
141
125
|
def _get_credentials(self) -> dict:
|
|
142
126
|
"""Returns temporary credentials via AWS STS.
|
|
143
127
|
|
|
@@ -147,19 +131,9 @@ class AutoRefreshableSession:
|
|
|
147
131
|
AWS temporary credentials.
|
|
148
132
|
"""
|
|
149
133
|
|
|
150
|
-
# being careful not to duplicate logs
|
|
151
|
-
if (self.defer_refresh and self._creds_already_fetched) or (
|
|
152
|
-
not self.defer_refresh and self._creds_already_fetched > 1
|
|
153
|
-
):
|
|
154
|
-
logger.info("Refreshing temporary AWS credentials")
|
|
155
|
-
else:
|
|
156
|
-
self._creds_already_fetched += 1
|
|
157
|
-
|
|
158
134
|
# fetching temporary credentials
|
|
159
135
|
_temporary_credentials = self._sts_client.assume_role(
|
|
160
|
-
|
|
161
|
-
RoleSessionName=self.session_name,
|
|
162
|
-
DurationSeconds=self.ttl,
|
|
136
|
+
**self.assume_role_kwargs
|
|
163
137
|
)["Credentials"]
|
|
164
138
|
return {
|
|
165
139
|
"access_key": _temporary_credentials.get("AccessKeyId"),
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
Metadata-Version: 2.3
|
|
2
2
|
Name: boto3-refresh-session
|
|
3
|
-
Version: 0.1
|
|
4
|
-
Summary: A simple Python package for refreshing
|
|
3
|
+
Version: 1.0.1
|
|
4
|
+
Summary: A simple Python package for refreshing the temporary security credentials in a boto3.session.Session object automatically.
|
|
5
5
|
License: MIT
|
|
6
6
|
Keywords: boto3,botocore,aws
|
|
7
7
|
Author: Mike Letts
|
|
@@ -15,7 +15,6 @@ Classifier: Programming Language :: Python :: 3.10
|
|
|
15
15
|
Classifier: Programming Language :: Python :: 3.11
|
|
16
16
|
Classifier: Programming Language :: Python :: 3.12
|
|
17
17
|
Classifier: Programming Language :: Python :: 3.13
|
|
18
|
-
Requires-Dist: attrs (>=24.3.0,<25.0.0)
|
|
19
18
|
Requires-Dist: boto3
|
|
20
19
|
Requires-Dist: botocore
|
|
21
20
|
Project-URL: Documentation, https://michaelthomasletts.github.io/boto3-refresh-session/index.html
|
|
@@ -26,19 +25,17 @@ Description-Content-Type: text/markdown
|
|
|
26
25
|
[](https://pypi.org/project/boto3-refresh-session/)
|
|
27
26
|
[](https://github.com/michaelthomasletts/boto3-refresh-session/actions/workflows/push_pullrequest.yml)
|
|
28
27
|
|
|
29
|
-
|
|
30
28
|
|
|
31
|
-
|
|
32
|
-
|
|
33
29
|
|
|
34
30
|
|
|
35
31
|
|
|
36
32
|
|
|
37
|
-
A simple Python package for refreshing
|
|
33
|
+
A simple Python package for refreshing the temporary security credentials in a `boto3.session.Session` object automatically.
|
|
38
34
|
|
|
39
35
|
- [Documentation](https://michaelthomasletts.github.io/boto3-refresh-session/index.html)
|
|
40
36
|
- [Source Code](https://github.com/michaelthomasletts/boto3-refresh-session)
|
|
41
37
|
- [PyPI](https://pypi.org/project/boto3-refresh-session/)
|
|
38
|
+
- [Contributing](https://michaelthomasletts.github.io/boto3-refresh-session/contributing.html)
|
|
42
39
|
|
|
43
40
|
### Why should I use this?
|
|
44
41
|
|
|
@@ -46,9 +43,9 @@ It is common for data pipelines and workflows that interact with the AWS API via
|
|
|
46
43
|
`boto3` to run for a long time and, accordingly, for temporary credentials to
|
|
47
44
|
expire.
|
|
48
45
|
|
|
49
|
-
Usually, engineers deal with that problem one of two ways:
|
|
46
|
+
Usually, engineers deal with that problem one of two different ways:
|
|
50
47
|
|
|
51
|
-
- `try except`
|
|
48
|
+
- A `try except` block that catches `botocore.exceptions.ClientError` exceptions
|
|
52
49
|
- A similar approach as that used in this project -- that is, using methods available
|
|
53
50
|
within `botocore` for refreshing temporary credentials automatically.
|
|
54
51
|
|
|
@@ -65,10 +62,10 @@ If any of that sounds relatable, then `boto3-refresh-session` should help you!
|
|
|
65
62
|
|
|
66
63
|
### Usage
|
|
67
64
|
|
|
68
|
-
Simply pass the basic parameters and initialize the `
|
|
65
|
+
Simply pass the basic parameters and initialize the `RefreshableSession` object;
|
|
69
66
|
that's it! You're good to go!
|
|
70
67
|
|
|
71
|
-
`
|
|
68
|
+
`RefreshableSession` will refresh
|
|
72
69
|
temporary credentials for you in the background. In the following example,
|
|
73
70
|
continue using the `s3_client` object without worry of using `try` and
|
|
74
71
|
`except` blocks!
|
|
@@ -80,13 +77,17 @@ machine, check [this documentation](https://boto3.amazonaws.com/v1/documentation
|
|
|
80
77
|
```python
|
|
81
78
|
import boto3_refresh_session as brs
|
|
82
79
|
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
80
|
+
assume_role_kwargs = {
|
|
81
|
+
'RoleArn': '<your-role-arn>',
|
|
82
|
+
'RoleSessionName': '<your-role-session-name>',
|
|
83
|
+
'DurationSeconds': '<your-selection>',
|
|
84
|
+
...
|
|
85
|
+
}
|
|
86
|
+
session = brs.RefreshableSession(
|
|
87
|
+
assume_role_kwargs=assume_role_kwargs
|
|
88
88
|
)
|
|
89
|
-
|
|
89
|
+
s3 = session.client(service_name='s3')
|
|
90
|
+
buckets = s3.list_buckets()
|
|
90
91
|
```
|
|
91
92
|
|
|
92
93
|
### Installation
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
boto3_refresh_session/__init__.py,sha256=NiaKXI1Ln9DU0cJOM3bYLEm0GNTyT7AV7D3itCGzfME,127
|
|
2
|
+
boto3_refresh_session/session.py,sha256=flpqQ5E9Z6XdtFNpCO2Ew1ZVJDYGncF6PG7uwlA7IJ4,5234
|
|
3
|
+
boto3_refresh_session-1.0.1.dist-info/LICENSE,sha256=I3ZYTXAjbIly6bm6J-TvFTuuHwTKws4h89QaY5c5HiY,1067
|
|
4
|
+
boto3_refresh_session-1.0.1.dist-info/METADATA,sha256=JfUfBQd3wsEiBPwNBkENI_Q5J00ZyqS-2zSnE-WWQyE,4395
|
|
5
|
+
boto3_refresh_session-1.0.1.dist-info/WHEEL,sha256=XbeZDeTWKc1w7CSIyre5aMDU_-PohRwTQceYnisIYYY,88
|
|
6
|
+
boto3_refresh_session-1.0.1.dist-info/RECORD,,
|
|
@@ -1,6 +0,0 @@
|
|
|
1
|
-
boto3_refresh_session/__init__.py,sha256=OMY8el4qROyEvo0vr1Kv8rtFU7g3xnjHuBss54XRTEA,135
|
|
2
|
-
boto3_refresh_session/session.py,sha256=xp5MNsNgdQ9LMryPk0JQLt6Ctp0qL9WgoVXMErTv6f0,5895
|
|
3
|
-
boto3_refresh_session-0.1.22.dist-info/LICENSE,sha256=I3ZYTXAjbIly6bm6J-TvFTuuHwTKws4h89QaY5c5HiY,1067
|
|
4
|
-
boto3_refresh_session-0.1.22.dist-info/METADATA,sha256=I9TxkQNPPsrn8h3Avpf2QnpiCAhBiNtq514fi7C_gdI,4507
|
|
5
|
-
boto3_refresh_session-0.1.22.dist-info/WHEEL,sha256=XbeZDeTWKc1w7CSIyre5aMDU_-PohRwTQceYnisIYYY,88
|
|
6
|
-
boto3_refresh_session-0.1.22.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|