AWS SDK 개발 환경 구축Setting Up an AWS SDK Development Environment

Ways to Use AWS

There are three main ways to use AWS. Leaving aside the AWS console, where you sign in on the web, this post looks at how to use and study AWS with the AWS CLI and the AWS SDK, and how to set them up for a development environment.

Temporary Credentials (AssumeRole)

There are two main kinds of AWS credentials used in development:

• Access key
• AssumeRole

An Access key is fatal if it leaks, so always use AssumeRole to get a token instead. The role you assume should also have only the minimum permissions it needs.

AWS CLI: AssumeRole

In the AWS CLI, the command below issues a token in JSON form. But taking that token and registering it in environment variables by hand is a real chore. On top of that, a token lasts 12 hours at most, so you’d have to repeat this every time you need it.

$ aws sts assume-role --role-arn <ROLE_ARN> --role-session-name <session-name>

{
    "Credentials": {
        "AccessKeyId": "ASIA.......",
        "SecretAccessKey": "YwyGY8dF5.......",
        "SessionToken": "IQoJb3JpZ2.......",
        "Expiration": "2024-04-21T08:08:12Z"
    },
}

Writing an AssumeRole Script

AssumeRole gives you these three values. Let’s write a script that registers them as environment variables automatically.

• Credentials.AccessKeyId
• Credentials.SecretAccessKey
• Credentials.SessionToken

Install the jq package, which processes JSON data, and write the script. $() is shell syntax for command substitution: it runs the command inside the parentheses and outputs the result.

The $ROLE_ARN environment variable lets you pass in the role you want when the script runs.

The jq -r option means “return raw strings”. By default, jq prints JSON strings wrapped in quotes. With -r, it prints raw strings without the quotes. We then export the unquoted tokens under the environment variable names the AWS CLI uses.

$ apt install jq

#!/bin/bash

output=$(aws sts assume-role --role-arn $ROLE_ARN --role-session-name cli-assume-session)

export AWS_ACCESS_KEY_ID=$(echo $output | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $output | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $output | jq -r '.Credentials.SessionToken')

To run it, put the ARN of the role you want in the ROLE_ARN environment variable and run the script with source. AssumeRole runs only in the current shell, and the environment variables are set automatically. Remember that when you exit the shell or open a new one, AssumeRole isn’t applied there; just run the script again whenever you need it.

$ export ROLE_ARN=arn:aws:iam::99842...:role/dev-assume-role-AmazonS3FullAccess

$ source ./scripts/set_assume_role.sh

$ echo AWS_SESSION_TOKEN

$ aws sts get-caller-identity

Debugging the AWS CLI

By default, the AWS CLI reports whether a command succeeded or failed in its output. The --debug option turns on debug logging. The commands below save that log to a file.

• To send only the stderr diagnostics: 2> filename
• To send both the output and the stderr diagnostics: &> filename

aws s3 ls --debug 2> debug.txt

aws s3 ls --debug &> debug.txt

AWS SDK: AssumeRole

1. Install packages

Let’s build a development environment where the AWS SDK gets a token through AssumeRole, just like the AWS CLI. The SDK here is the Python package boto3. For testing, we’ll use pytest and python-dotenv. Install the packages first.

$ pip install boto3

$ pip install pytest python-dotenv

2. Write the .env file

Put the information you need in the .env file: the access key that is allowed to run AssumeRole, and the role ARN.

AWS_ACCESS_KEY_ID=ASIA.......
AWS_SECRET_ACCESS_KEY=YwyGY8dF5.......

ROLE_ARN=arn:aws:iam::99842...:role/dev-assume-role-AmazonS3FullAccess

3. Create a session with the access key

Create a session using the access key. We pass this session on as a fixture so the next function can run AssumeRole.

import logging
import pytest

import os
from dotenv import load_dotenv

import boto3
from boto3 import Session

# Load the .env file
load_dotenv()
@pytest.fixture(scope="session", name="aws_user_session")
def setup_user_session() -> Session:
    aws_access_key_id = os.getenv("AWS_ACCESS_KEY_ID")
    aws_secret_access_key = os.getenv("AWS_SECRET_ACCESS_KEY")
    region_name = os.getenv("REGION_NAME")

    return boto3.Session(
        aws_access_key_id=aws_access_key_id,
        aws_secret_access_key=aws_secret_access_key,
        region_name=region_name,
    )

4. Get a token with AssumeRole and create a session

Run AssumeRole through the session. Then use the issued token, Credentials, to create a new session. You can run your tests with this session.

@pytest.fixture(scope="session", name="assume_role_session")
def setup_role_credentials(aws_user_session: Session):
    role_arn = os.getenv("ROLE_ARN")

    credentials = assume_role(aws_user_session, role_arn)

    session = boto3.Session(
        aws_access_key_id=credentials["AccessKeyId"],
        aws_secret_access_key=credentials["SecretAccessKey"],
        aws_session_token=credentials["SessionToken"],
        region_name=os.getenv("AWS_REGION"),
    )

    logging.info("Role credentials are generated successfully")

    sts = session.client("sts")
    logging.info(sts.get_caller_identity())

    return session
def assume_role(aws_user_session: Session, role_arn: str):
    sts_client = aws_user_session.client("sts")

    response = sts_client.assume_role(
        RoleArn=role_arn, RoleSessionName="boto3-assume-session"
    )

    return response["Credentials"]

5. The AssumeRole session

Now you develop with the permissions assigned to the session you switched to through AssumeRole. The code below tests a function that fetches and prints security groups (SecureGroup).

import logging
def hello_ec2(ec2_resource):
    logging.info("Hello, Amazon EC2! Let's list up to 10 of your security groups:")
    for sg in ec2_resource.security_groups.limit(10):
        logging.info(f"\t{sg.id}: {sg.group_name}")

import pytest

from src.ec2 import hello_ec2
class TestEC2:
    @pytest.fixture(autouse=True)
    def setup(self, assume_role_session):
        self.session = assume_role_session
        self.ec2_resource = session.resource("ec2")

    def test_hello_ec2(self):
        hello_ec2(self.ec2_resource)

Wrapping Up

Using an access key directly in your development environment can be a security risk. That’s why it’s better to build your development environment around AssumeRole.

Here we built a development environment where the AWS CLI and the AWS SDK use tokens issued through AssumeRole. With this setup in place, try out and study more AWS services yourself through the links below! 😊

AWS CLI

• AWS CLI Command Reference

AWS SDK

• Boto3 documentation
• AWS SDK Code Examples