The authentication information used by Boto 3 is summarized in "Credentials — Boto 3" from 8 locations. The credentials are searched in the specified order.
Boto3 tries to get credentials in multiple ways, such as parameters and profiles. The method and order can be found in "Configuring Credentials --Credentials — Boto 3". My translation of the part is as follows.
boto3's credential search mechanism is to search according to the list below and stop there when it finds the credential. The order in which Boto3 searches for credentials is:
- Credentials passed as parameters to the
boto.client ()method- Credentials passed as parameters when creating the
Sessionobject- Environment variables
- Shared credentials file (
~ / .aws / credentials)- AWS configuration file (
~ / .aws / config)- Offering roll underwriting
- Boto2 configuration file (
/etc/boto.cfg and ~ / .boto)- On an Amazon EC2 instance configured with an IAM role, that instance metadata service
We'll look at some of these that use API access keys and API secret keys, or named profiles below.
client () method and resource () methodIn the boto3.client () method or the boto3.session.Session (). Client () method, specify the following with parameters.
| Key | Specified value |
|---|---|
| aws_access_key_id | API access key |
| aws_secret_access_key | API secret key |
| aws_session_token | (At the time of multi-factor authentication) Session token |
The following is an example of execution in an interactive shell.
>>> import boto3
>>> client = boto3.client('iam', aws_access_key_id='YOURACCESSKEY', aws_secret_access_key='YOURSECRETKEY')
>>> client.list_users()
You can specify the above three parameters even if you use the resource () (boto3.resource () or boto3.session.Session (). Resource ()) method instead of client ().
>>> import boto3
>>> resource = boto3.resource('iam', aws_access_key_id='YOURACCESSKEY', aws_secret_access_key='YOURSECRETKEY')
>>> list(resource.users.all())
Session objectWhen creating a session object with boto3.session.Session (), specify the following with parameters. Clients generated by the client () method and resources generated by the resource () method from the generated Session object use this credential.
| Key | Specified value |
|---|---|
| aws_access_key_id | API access key |
| aws_secret_access_key | API secret key |
| aws_session_token | (At the time of multi-factor authentication) Session token |
The following is an example of execution in an interactive shell.
>>> import boto3
>>> session = boto3.session.Session(aws_access_key_id='YOURACCESSKEY', aws_secret_access_key='YOURSECRETKEY')
>>> client = session.client('iam')
>>> client.list_users()
When creating a session object with boto3.session.Session (), specify the following with parameters. The credentials configured in the specified Named Profile (https://docs.aws.amazon.com/ja_jp/cli/latest/userguide/cli-configure-profiles.html) will be used. Clients generated by the client () method and resources generated by the resource () method from the generated Session object use this credential.
| Key | Specified value |
|---|---|
| profile_name | Profile name |
The following is an example of execution in an interactive shell.
>>> import boto3
>>> session = boto3.session.Session(profile_name='YOURPROFILENAME')
>>> client = session.client('iam')
>>> client.list_users()
Specify the following with environment variables. If no explicit credentials are specified up to the previous section, this will be used.
| Environment variable name | Specified value |
|---|---|
| AWS_ACCESS_KEY_ID | API access key |
| AWS_SECRET_ACCESS_KEY | API secret key |
| AWS_SESSION_TOKEN | (At the time of multi-factor authentication) Session token |
The following is an execution example of calling the Python interactive shell after setting the above environment variables in the bash environment.
$ export AWS_ACCESS_KEY_ID=YOURACCESSKEY
$ export AWS_SECRET_ACCESS_KEY=YOURSECRETKEY
$ python3
Python 3.6.9 (default, Nov 7 2019, 10:44:02)
[GCC 8.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import boto3
>>> client = boto3.client('iam')
>>> client.list_users()
Specify the following with environment variables. If you do not specify the explicit authentication information in the previous section, this specified Named Profile The credentials configured in .html) will be used.
| Environment variable name | Specified value |
|---|---|
| AWS_PROFILE | Profile name |
The following is an execution example of calling the Python interactive shell after setting the above environment variables in the bash environment.
$ export AWS_PROFILE=YOURPROFILENAME
$ python3
Python 3.6.9 (default, Nov 7 2019, 10:44:02)
[GCC 8.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import boto3
>>> client = boto3.client('iam')
>>> client.list_users()
~ / .aws / credentials)If you don't have the credentials so far, the credentials configured as the default profile in the credentials file (~ / .aws / credentials) will be used. This is usually set with the ʻaws configure` command when you first use the AWS CLI. For details, refer to [AWS CLI Easy Setting". Please give me.
~ / .aws / config)If you don't have the credentials so far, any credentials configured as a default profile in your AWS configuration file (~ / .aws / config) will be used. However, normally, the profile information managed in the AWS configuration file is the region (region) and the default output format (ʻoutput`), and does not include the authentication information.
/etc/boto.cfg and ~ / .boto)If there is no authentication information so far, the authentication information stored in the Boto2 configuration file will be checked if it exists. The Boto2 configuration file is placed in /etc/boto.cfg or ~ / .boto by default. The following is an example of the contents.
Example ~/.boto file
[Credentials]
aws_access_key_id = foo
aws_secret_access_key = bar
This is for backwards compatibility and the Boto2 config file will be ignored except in the Credentials section.
The credentials available in Boto3 include (1) API access and API secret keys, (2) default profiles, (3) named profiles, and (4) roles (details not mentioned here). Four types are possible. Corresponding this with the specification method so far, it becomes as follows.
| Authentication method | How to specify |
|---|---|
| API access key and API secret key | 1、2、3、4、5、7 |
| Default profile | 4 |
| Named profile | 2、3 |
| roll | 6、8 |
If you think that the expected authentication method is not used, it seems necessary to check if another specification is made with a higher priority specification method.
For example, if you specify a named profile in the ʻAWS_PROFILEenvironment variable, but a different profile name is specified inboto3.session.Session ()`, that will take precedence. You'll notice if you're doing it intentionally, but it can be confusing if the default values are somewhere in it.
About boto3 authentication.
About AWS credentials and configuration files.
About each method of boto3.
About Boto2 configuration file.
Recommended Posts