Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add aws_account_id to boto3 session #3888

Closed
wants to merge 1 commit into from
Closed

add aws_account_id to boto3 session #3888

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion boto3/session.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ class Session:
:type profile_name: string
:param profile_name: The name of a profile to use. If not given, then
the default profile is used.
:type aws_account_id: string
:param aws_account_id: AWS account ID
"""

def __init__(
Expand All @@ -54,6 +56,7 @@ def __init__(
region_name=None,
botocore_session=None,
profile_name=None,
aws_account_id=None,
):
if botocore_session is not None:
self._session = botocore_session
Expand All @@ -78,7 +81,10 @@ def __init__(

if aws_access_key_id or aws_secret_access_key or aws_session_token:
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we do it with the other credential params, should we set credentials if account ID is set but none of the others are?

self._session.set_credentials(
aws_access_key_id, aws_secret_access_key, aws_session_token
aws_access_key_id,
aws_secret_access_key,
aws_session_token,
aws_account_id,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if only aws_account_id is set? Do we fold this into the other resolved credentials?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The input is currently ignored and the client will fall back to one of the credential providers. All of the existing credential values can be individually set on a boto3 session and a client can be created successfully even if the other credential values are empty.

from boto3.session import Session
session = Session(aws_access_key_id='foo')
s3 = session.client('s3')
print(s3._request_signer._credentials.__dict__)
{'access_key': 'foo', 'secret_key': None, 'token': None, 'method': 'explicit'}

It seemed wrong to extend this behavior to account ID. This is similar to how botocore.session.Session.create_client handles explicitly set credential values. If only the session token is set here, it will be ignored and use a credential provider instead.

It's not the best experience to silently ignore an input so maybe we could add validation here or in set_credentials instead.

)

if region_name is not None:
Expand Down Expand Up @@ -226,6 +232,7 @@ def client(
aws_secret_access_key=None,
aws_session_token=None,
config=None,
aws_account_id=None,
):
"""
Create a low-level service client by name.
Expand Down Expand Up @@ -293,6 +300,10 @@ def client(
<https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html>`_
for more details.

:type aws_account_id: string
:param aws_account_id: The AWS account ID to use when creating the
client. Same semantics as aws_access_key_id above.

:return: Service client instance

"""
Expand All @@ -307,6 +318,7 @@ def client(
aws_secret_access_key=aws_secret_access_key,
aws_session_token=aws_session_token,
config=config,
aws_account_id=aws_account_id,
)

def resource(
Expand All @@ -321,6 +333,7 @@ def resource(
aws_secret_access_key=None,
aws_session_token=None,
config=None,
aws_account_id=None,
):
"""
Create a resource service client by name.
Expand Down Expand Up @@ -390,6 +403,10 @@ def resource(
<https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html>`_
for more details.

:type aws_account_id: string
:param aws_account_id: The AWS account ID to use when creating the
client. Same semantics as aws_access_key_id above.

:return: Subclass of :py:class:`~boto3.resources.base.ServiceResource`
"""
try:
Expand Down Expand Up @@ -454,6 +471,7 @@ def resource(
aws_secret_access_key=aws_secret_access_key,
aws_session_token=aws_session_token,
config=config,
aws_account_id=aws_account_id,
)
service_model = client.meta.service_model

Expand Down
13 changes: 12 additions & 1 deletion tests/unit/test_session.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,21 +66,26 @@ def test_credentials_can_be_set(self):
aws_access_key_id='key',
aws_secret_access_key='secret',
aws_session_token='token',
aws_account_id='account_id',
)

assert self.bc_session_cls.called
assert bc_session.set_credentials.called
bc_session.set_credentials.assert_called_with('key', 'secret', 'token')
bc_session.set_credentials.assert_called_with(
'key', 'secret', 'token', 'account_id'
)

def test_can_get_credentials(self):
access_key = 'foo'
secret_key = 'bar'
token = 'baz'
account_id = 'account_id'

creds = mock.Mock()
creds.access_key = access_key
creds.secret_key = secret_key
creds.token = token
creds.account_id = account_id

bc_session = self.bc_session_cls.return_value
bc_session.get_credentials.return_value = creds
Expand All @@ -89,12 +94,14 @@ def test_can_get_credentials(self):
aws_access_key_id=access_key,
aws_secret_access_key=secret_key,
aws_session_token=token,
aws_account_id=account_id,
)

credentials = session.get_credentials()
assert credentials.access_key == access_key
assert credentials.secret_key == secret_key
assert credentials.token == token
assert credentials.account_id == account_id

def test_profile_can_be_set(self):
bc_session = self.bc_session_cls.return_value
Expand Down Expand Up @@ -240,6 +247,7 @@ def test_create_client_with_args(self):
region_name='us-west-2',
api_version=None,
config=None,
aws_account_id=None,
)

def test_create_resource_with_args(self):
Expand Down Expand Up @@ -268,6 +276,7 @@ def test_create_resource_with_args(self):
region_name=None,
api_version='2014-11-02',
config=mock.ANY,
aws_account_id=None,
)
client_config = session.client.call_args[1]['config']
assert client_config.user_agent_extra == 'Resource'
Expand Down Expand Up @@ -300,6 +309,7 @@ def test_create_resource_with_config(self):
region_name=None,
api_version='2014-11-02',
config=mock.ANY,
aws_account_id=None,
)
client_config = session.client.call_args[1]['config']
assert client_config.user_agent_extra == 'Resource'
Expand Down Expand Up @@ -332,6 +342,7 @@ def test_create_resource_with_config_override_user_agent_extra(self):
region_name=None,
api_version='2014-11-02',
config=mock.ANY,
aws_account_id=None,
)
client_config = session.client.call_args[1]['config']
assert client_config.user_agent_extra == 'foo'
Expand Down
Loading