CODEWITHSUNDEEP
pythonamazon-web-servicesapiboto3amazon-iam
ronald mcdolittle
ronald mcdolittle

Reputation: 567

Switching IAM-user roles with Athena and boto3

I am writing a python program using boto3 that grabs all of the queries made by a master account and pushes them out to all of the master account's sub accounts.

Grabbing the query IDs from the master instance is done, but I'm having trouble pushing them out to the sub accounts. With my authentication information AWS is connecting to the master account by default, but I can't figure out how to get it to connect to a sub account. Generally AWS services do this by switching roles, but Athena doesn't have a built in method for this. I could manually create different profiles but I'm not sure how to switch them manually in the middle of code execution

Here's Amazon's code example for switching in STS, which does support assuming different roles https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-api.html

Here's what my program looks like so far 

#!/usr/bin/env python3
import boto3

dev = boto3.session.Session(profile_name='dev')
#Function for executing athena queries
client = dev.client('athena')
s3_input = 's3://dev/test/'
s3_output = 's3://dev/testOutput'
database = 'ex_athena_db'
table = 'test_data'

response = client.list_named_queries(
    MaxResults=50,
    WorkGroup='primary'
)
print response

So I have the "dev" profile, but I'm not sure how to differentiate this profile to indicate to AWS that I'd like to access one of the child accounts. Is it just the name, or do I need some other paramter? I don't think I can (or need to) generate a seperate authentication token for this

Upvotes: 0

Views: 2430

Answers (1)

ronald mcdolittle
ronald mcdolittle

Reputation: 567

I solved this by creating a new user profile for the sub account with a new ARN

sample config

[default]
region = us-east-1
[profile ecr-dev]
role_arn = arn:aws:iam::76532435:role/AccountRole
source_profile = default

sample code 

#!/usr/bin/env python3
import boto3

dev = boto3.session.Session(profile_name='name', region_name="us-east-1")
#Function for executing athena queries
client = dev.client('athena')
s3_input = 's3:/test/'
s3_output = 's3:/test'
database = 'ex_athena_db'

response = client.list_named_queries(
    MaxResults=50,
    WorkGroup='primary'
)
print response

Upvotes: 1

Related Questions