ob-metaflow-extensions 1.1.162__tar.gz → 1.1.163__tar.gz

{ob-metaflow-extensions-1.1.162/ob_metaflow_extensions.egg-info → ob_metaflow_extensions-1.1.163}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
-Name: ob-metaflow-extensions
-Version: 1.1.162
+Name: ob_metaflow_extensions
+Version: 1.1.163
 Summary: Outerbounds Platform Extensions for Metaflow
 Author: Outerbounds, Inc.
 License: Commercial

{ob-metaflow-extensions-1.1.162 → ob_metaflow_extensions-1.1.163}/metaflow_extensions/outerbounds/plugins/__init__.py

@@ -41,6 +41,9 @@ def get_boto3_session(role_arn=None, session_vars=None):
     import boto3
     import botocore
     from metaflow_extensions.outerbounds.plugins.auth_server import get_token
+    from metaflow_extensions.outerbounds.plugins.aws.assume_role import (
+        OBP_ASSUME_ROLE_ARN_ENV_VAR,
+    )
 
     from hashlib import sha256
     from metaflow.util import get_username
@@ -49,6 +52,10 @@ def get_boto3_session(role_arn=None, session_vars=None):
 
     token_info = get_token("/generate/aws")
 
+    # Check if the assume_role decorator has set a role ARN via environment variable
+    # This takes precedence over CSPR role
+    decorator_role_arn = os.environ.get(OBP_ASSUME_ROLE_ARN_ENV_VAR)
+
     # Write token to a file. The file name is derived from the user name
     # so it works with multiple users on the same machine.
     #
@@ -69,12 +76,13 @@ def get_boto3_session(role_arn=None, session_vars=None):
     if token_info.get("cspr_role_arn"):
         cspr_role = token_info["cspr_role_arn"]
 
-    if cspr_role:
-        # If CSPR role is set, we set it as the default role to assume
-        # for the AWS SDK. We do this by writing an AWS config file
+    # If assume_role decorator is used, prioritize it over CSPR role
+    effective_role = decorator_role_arn or cspr_role
+    if effective_role:
+        # If we have either a decorator role or CSPR role, set up AWS config
         # with two profiles. One to get credentials for the task role
         # in exchange for the OIDC token, and second to assume the
-        # CSPR role using the task role credentials.
+        # effective role using the task role credentials.
         import configparser
         from io import StringIO
 
@@ -86,9 +94,9 @@ def get_boto3_session(role_arn=None, session_vars=None):
             "web_identity_token_file": token_file,
         }
 
-        # CSPR role profile (default)
-        aws_config["profile cspr"] = {
-            "role_arn": cspr_role,
+        # Effective role profile (decorator role or CSPR role)
+        aws_config["profile effective"] = {
+            "role_arn": effective_role,
             "source_profile": "task",
         }
 
@@ -104,7 +112,7 @@ def get_boto3_session(role_arn=None, session_vars=None):
             tmp_aws_config_file = f.name
         os.rename(tmp_aws_config_file, aws_config_file)
         os.environ["AWS_CONFIG_FILE"] = aws_config_file
-        os.environ["AWS_PROFILE"] = "cspr"
+        os.environ["AWS_PROFILE"] = "effective"
     else:
         os.environ["AWS_WEB_IDENTITY_TOKEN_FILE"] = token_file
         os.environ["AWS_ROLE_ARN"] = token_info["role_arn"]
@@ -116,21 +124,22 @@ def get_boto3_session(role_arn=None, session_vars=None):
     if token_info.get("region"):
         os.environ["AWS_DEFAULT_REGION"] = token_info["region"]
 
-    if cspr_role:
-        #  The generated AWS config will be used here since we set the
-        #  AWS_CONFIG_FILE environment variable above.
-        if role_arn == USE_CSPR_ROLE_ARN_IF_SET:
-            # Otherwise start from the default profile, assuming CSPR role
-            session = boto3.session.Session(profile_name="cspr")
+    if effective_role:
+        if role_arn == decorator_role_arn or role_arn == USE_CSPR_ROLE_ARN_IF_SET:
+            # We have either a decorator role or CSPR role, use the effective profile
+            # The generated AWS config will be used here since we set the
+            # AWS_CONFIG_FILE environment variable above.
+            session = boto3.session.Session(profile_name="effective")
         else:
             session = boto3.session.Session(profile_name="task")
     else:
+        # No decorator role or CSPR role, use default session
         # Not using AWS config, just AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN
         session = boto3.session.Session()
 
-    if role_arn and role_arn != USE_CSPR_ROLE_ARN_IF_SET:
+    if role_arn and role_arn != USE_CSPR_ROLE_ARN_IF_SET and decorator_role_arn != None:
         # If the user provided a role_arn, we assume that role
-        # using the task role credentials. CSPR role is not used.
+        # using the task role credentials. This overrides everything else.
         fetcher = botocore.credentials.AssumeRoleCredentialFetcher(
             client_creator=session._session.create_client,
             source_credentials=session._session.get_credentials(),
@@ -146,8 +155,8 @@ def get_boto3_session(role_arn=None, session_vars=None):
     else:
         # If the user didn't provide a role_arn, or if the role_arn
         # is set to USE_CSPR_ROLE_ARN_IF_SET, we return the default
-        # session which would use the CSPR role if it is set on the
-        # server, and the task role otherwise.
+        # session which would use the effective role (decorator or CSPR) if set,
+        # or the task role otherwise.
         return session
 
 

ob_metaflow_extensions-1.1.163/metaflow_extensions/outerbounds/plugins/aws/__init__.py

@@ -0,0 +1,4 @@
+from .assume_role_decorator import assume_role
+from .assume_role import OBP_ASSUME_ROLE_ARN_ENV_VAR
+
+__mf_promote_submodules__ = ["plugins.aws"]

ob_metaflow_extensions-1.1.163/metaflow_extensions/outerbounds/plugins/aws/assume_role.py

@@ -0,0 +1,3 @@
+# Environment variable name used by the assume_role decorator to pass
+# the role ARN to AWS client functions
+OBP_ASSUME_ROLE_ARN_ENV_VAR = "OBP_ASSUME_ROLE_ARN"

ob_metaflow_extensions-1.1.163/metaflow_extensions/outerbounds/plugins/aws/assume_role_decorator.py

@@ -0,0 +1,65 @@
+from metaflow.user_configs.config_decorators import (
+    MutableFlow,
+    MutableStep,
+    CustomFlowDecorator,
+)
+from .assume_role import OBP_ASSUME_ROLE_ARN_ENV_VAR
+
+
+class assume_role(CustomFlowDecorator):
+    """
+    Flow-level decorator for assuming AWS IAM roles.
+
+    When applied to a flow, all steps in the flow will automatically use the specified IAM role-arn
+    as their source principal.
+
+    Usage:
+    ------
+    @assume_role(role_arn="arn:aws:iam::123456789012:role/my-iam-role")
+    class MyFlow(FlowSpec):
+        @step
+        def start(self):
+            import boto3
+            client = boto3.client("dynamodb")  # Automatically uses the role in the flow decorator
+            self.next(self.end)
+
+        @step
+        def end(self):
+            from metaflow import get_aws_client
+            client = get_aws_client("dynamodb")  # Automatically uses the role in the flow decorator
+    """
+
+    def init(self, *args, **kwargs):
+        self.role_arn = kwargs.get("role_arn", None)
+
+        if self.role_arn is None:
+            raise ValueError(
+                "`role_arn` keyword argument is required for the assume_role decorator"
+            )
+
+        if not self.role_arn.startswith("arn:aws:iam::"):
+            raise ValueError(
+                "`role_arn` must be a valid AWS IAM role ARN starting with 'arn:aws:iam::'"
+            )
+
+    def evaluate(self, mutable_flow: MutableFlow) -> None:
+        """
+        This method is called by Metaflow to apply the decorator to the flow.
+        It sets up environment variables that will be used by the AWS client
+        to automatically assume the specified role.
+        """
+        # Import environment decorator at runtime to avoid circular imports
+        from metaflow import environment
+
+        # Set the role ARN as an environment variable that will be picked up
+        # by the get_aws_client function
+        def _setup_role_assumption(step: MutableStep) -> None:
+            # We'll inject the role assumption by adding an environment decorator
+            # The role will be available through an environment variable
+            step.add_decorator(
+                environment, vars={OBP_ASSUME_ROLE_ARN_ENV_VAR: self.role_arn}
+            )
+
+        # Apply the role assumption setup to all steps in the flow
+        for _, step in mutable_flow.steps:
+            _setup_role_assumption(step)

{ob-metaflow-extensions-1.1.162 → ob_metaflow_extensions-1.1.163}/metaflow_extensions/outerbounds/toplevel/global_aliases_for_metaflow_package.py

@@ -20,8 +20,19 @@ def get_aws_client(
     module, with_error=False, role_arn=None, session_vars=None, client_params=None
 ):
     import metaflow.plugins.aws.aws_client
+    import os
 
     from metaflow_extensions.outerbounds.plugins import USE_CSPR_ROLE_ARN_IF_SET
+    from metaflow_extensions.outerbounds.plugins.aws.assume_role import (
+        OBP_ASSUME_ROLE_ARN_ENV_VAR,
+    )
+
+    # Check if the assume_role decorator has set a role ARN via environment variable
+    # This takes precedence over CSPR but not over explicitly passed role_arn
+    if role_arn is None:
+        decorator_role_arn = os.environ.get(OBP_ASSUME_ROLE_ARN_ENV_VAR)
+        if decorator_role_arn:
+            role_arn = decorator_role_arn
 
     return metaflow.plugins.aws.aws_client.get_aws_client(
         module,
@@ -42,10 +53,20 @@ def get_aws_client(
 def S3(*args, **kwargs):
     import sys
     import metaflow.plugins.datatools.s3
+    import os
     from metaflow_extensions.outerbounds.plugins import USE_CSPR_ROLE_ARN_IF_SET
+    from metaflow_extensions.outerbounds.plugins.aws.assume_role import (
+        OBP_ASSUME_ROLE_ARN_ENV_VAR,
+    )
 
+    # Check if the assume_role decorator has set a role ARN via environment variable
+    # This takes precedence over CSPR but not over explicitly passed role
     if "role" not in kwargs or kwargs["role"] is None:
-        kwargs["role"] = USE_CSPR_ROLE_ARN_IF_SET
+        decorator_role_arn = os.environ.get(OBP_ASSUME_ROLE_ARN_ENV_VAR)
+        if decorator_role_arn:
+            kwargs["role"] = decorator_role_arn
+        else:
+            kwargs["role"] = USE_CSPR_ROLE_ARN_IF_SET
 
     return metaflow.plugins.datatools.s3.S3(*args, **kwargs)
 
@@ -53,3 +74,4 @@ def S3(*args, **kwargs):
 from .. import profilers
 from ..plugins.snowflake import Snowflake
 from ..plugins.checkpoint_datastores import nebius_checkpoints, coreweave_checkpoints
+from ..plugins.aws import assume_role

{ob-metaflow-extensions-1.1.162 → ob_metaflow_extensions-1.1.163/ob_metaflow_extensions.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: ob-metaflow-extensions
-Version: 1.1.162
+Version: 1.1.163
 Summary: Outerbounds Platform Extensions for Metaflow
 Author: Outerbounds, Inc.
 License: Commercial

{ob-metaflow-extensions-1.1.162 → ob_metaflow_extensions-1.1.163}/ob_metaflow_extensions.egg-info/SOURCES.txt

@@ -11,6 +11,9 @@ metaflow_extensions/outerbounds/plugins/apps/app_utils.py
 metaflow_extensions/outerbounds/plugins/apps/consts.py
 metaflow_extensions/outerbounds/plugins/apps/deploy_decorator.py
 metaflow_extensions/outerbounds/plugins/apps/supervisord_utils.py
+metaflow_extensions/outerbounds/plugins/aws/__init__.py
+metaflow_extensions/outerbounds/plugins/aws/assume_role.py
+metaflow_extensions/outerbounds/plugins/aws/assume_role_decorator.py
 metaflow_extensions/outerbounds/plugins/card_utilities/__init__.py
 metaflow_extensions/outerbounds/plugins/card_utilities/async_cards.py
 metaflow_extensions/outerbounds/plugins/card_utilities/extra_components.py

{ob-metaflow-extensions-1.1.162 → ob_metaflow_extensions-1.1.163}/setup.py

@@ -2,12 +2,12 @@ from setuptools import setup, find_namespace_packages
 from pathlib import Path
 
 
-version = "1.1.162"
+version = "1.1.163"
 this_directory = Path(__file__).parent
 long_description = (this_directory / "README.md").read_text()
 
 setup(
-    name="ob-metaflow-extensions",
+    name="ob_metaflow_extensions",
     version=version,
     description="Outerbounds Platform Extensions for Metaflow",
     author="Outerbounds, Inc.",