CODEWITHSUNDEEP
pythonamazon-web-servicesamazon-redshift
jake wong
jake wong

Reputation: 5228

unable to locate credentials for boto3.client both locally, and on lambda

What I understand is that, in order to access AWS applications such as redshift, the way to do it is

client = boto3.client("redshift", region_name="someRegion", aws_access_key_id="foo", aws_secret_access_key="bar")

response = client.describe_clusters(ClusterIdentifier="mycluster")

print(response)

This code runs fine for both locally through pycharm, as well as on AWS lambda.

However, am I correct that this aws_access_key_id and aws_secret_access_key are both from me? IE: my IAM user security access keys. Is this supposed to be the case? Or am I suppose to create a different user / role in order to access redshift via boto3?

The more important question is, how do I properly store & retrieve aws_access_key_id and aws_secret_access_key? I understand that this could potentially be done via secrets manager, but I am still faced with the problem that, if I run the below code, I get an error saying that it is unable to locate credentials.

client = boto3.client("secretsmanager", region_name="someRegion")
# Met with the problem that it is unable to locate my credentials.

Upvotes: 1

Views: 3135

Answers (2)

Paolo
Paolo

Reputation: 25989

The proper way to do this would be for you to create an IAM role which allows the desired redshift functionality, and then attaching that role to your lambda.

When you create the role, you have the flexibility to create a policy to fine-grain access permissions to certain actions and/or certain resources.

After you have attached the IAM role to your lambda, you will simply be able to do:

>>> client = boto3.client("redshift")

Upvotes: 2

balderman
balderman

Reputation: 23815

From the docs. The first & seconds options are not secured since you mix the credentials with the code. If the code runs on AWS EC2 the best way is using "assume role" where you grant the EC2 instance permissions. If the code run outside AWS you will have to select an option like using ~/.aws/credentials

Boto3 will look in several locations when searching for credentials. The mechanism in which Boto3 looks for credentials is to search through a list of possible locations and stop as soon as it finds credentials. The order in which Boto3 searches for credentials is:

  • Passing credentials as parameters in the boto.client() method
  • Passing credentials as parameters when creating a Session object
  • Environment variables
  • Shared credential file (~/.aws/credentials)
  • AWS config file (~/.aws/config)
  • Assume Role provider
  • Boto2 config file (/etc/boto.cfg and ~/.boto)
  • Instance metadata service on an Amazon EC2 instance that has an IAM role configured.

Upvotes: 1

Related Questions