2

I am using boto3 to communicate with KMS inside a AWS batch job. My code to get the KMS client looks like this:

KMS = boto3.client('kms')

My question is, do I need to explicitly pass AWS SecretKey and AWS AccessKey like this:

KMS = boto3.client('kms', 
                   aws_access_key_id=ACCESS_KEY,
                   aws_secret_access_key=SECRET_KEY)

Or

Maybe I just setup environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY while defining a compute environment?

Which is the best option?

sgiri
  • 691
  • 12
  • 28

2 Answers2

6

When you Create a Job Definition in AWS Batch, you can specify a Job Role:

You can specify an IAM role that provides the container in your job with permissions to use the AWS APIs. This feature uses Amazon ECS IAM roles for task functionality.

Therefore, any code that you write will be provided with credentials based on the Job Role. Your code does not need to specify credentials (so use your first example).

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
2

The best practice is to use IAM roles for AWS APIs. Because you don't need to worry about managing AWS credentials. Use IAM roles to manage AWS resources internally, and use IAM users to manage AWS resources externally. So here I'm not going to compare the differences furthermore, I'll attach a few links for your reference.

No need to specify AWS credentials with boto3 whether you use IAM roles or IAM users. Here are the workarounds for IAM roles and IAM users.

You can find the below configurations under the Job configuration section.

IAM roles

Let's assume you have an IAM roles that has permission for relevant AWS resources. Just select it from the drop-down menu.

enter image description here

IAM users

Let's assume you have an IAM users account that has permission for relevant AWS resources. Just enter credential details where you get them when you create an IAM users account to set them as environment variables. In this way, you don't need to hardcode the AWS credentials.

enter image description here

You can choose either IAM roles or IAM users based on your requirement. But whatever the thing you choose, you don't need to specifically mention the aws_access_key_id and aws_secret_access_key. Sometimes you have to mention region_name, this is affected both ways. Because I faced this kind of issue a few years back.

Anyway if you didn't specifically mention the credentials when you create the boto3 client object, the default value None will be assigned. If the None is assigned it will check the environment variables, otherwise, will give an error. That's why mentioned, "you don't need to specifically mention the aws_access_key_id and aws_secret_access_key".

KMS = boto3.client('kms')  # better if you can mention "region_name" here

Hope everything is clear, let me know if you are faced with any difficulties.

References:-

Kushan Gunasekera
  • 7,268
  • 6
  • 44
  • 58