search

aws / aws-msk-iam-sasl-signer-python

Apache License 2.0
27 stars 9 forks source link

Allow passing boto3 session directly to MSKAuthTokenProvider.generate_auth_token_from ... #22

Open lucasmo opened 7 months ago

lucasmo commented 7 months ago

Description

We have a lot of code that passes a boto3 session around. Underneath this session is credentials that are either auto-refreshing, profile-based, or instance based. The instantiation of a Kafka client shouldn't need to know.

Currently, a way to make this happen is via an ugly wrapper class:

session = boto3.session.Session(...)

...

class WrappedSessionCredentialProvider(CredentialProvider):
    METHOD="wrapped"

    def __init__(self, delegate_session):
        self.delegate_session = delegate_session

    def load(self):
        return self.delegate_session.get_credentials()

credentials_provider = WrappedSessionCredentialProvider(session)

def oauth_cb(oauth_config):
    auth_token, expiry_ms = MSKAuthTokenProvider.generate_auth_token_from_credentials_provider("us-east-1", credentials_provider)
    return auth_token, expiry_ms/1000

As sessions are such a core concept in boto3, it would be nice for the MSK lib to work with them natively.

hengjiUSTC commented 4 months ago

We also facing this case, we want configure Credential directly from ak sk in code. Not through environment file. Any updates?

sankalpbhatia commented 4 months ago

I think this is a fair ask. @lucasmo @hengjiUSTC but I am not sure if adding this feature should deprecate the old way of passing custom credentials provider. I will seek guidance from other SDK owners in AWS and get back to you on this.

Would one of you be interested in contributing to this feature?

liwadman commented 3 weeks ago

Working with a customer on this, the way of passing the credential provider in is very complex and we probably shouldn't ask customers to muck around botocore to accomplish this. This removes the entire magic functionality of the default credentials providers chain.

We should prioritize this as a feature for all MSK signers.

liwadman commented 3 weeks ago

Doubly so when other MSK clients already implement the default credentials provider chain:

https://github.com/aws/aws-msk-iam-auth/tree/main