Skip to content

Commit c2928f5

Browse files
opensearch-trigger-bot[bot]ylwu-amzn
opensearch-trigger-bot[bot]
and
ylwu-amzn
authored
support role temporary credential in connector tutorial (opensearch-project#3058) (opensearch-project#3084)
Signed-off-by: Yaliang Wu <ylwu@amazon.com> (cherry picked from commit 75d454e) Co-authored-by: Yaliang Wu <ylwu@amazon.com>
1 parent b8de799 commit c2928f5

File tree

1 file changed

+59
-22
lines changed

1 file changed

+59
-22
lines changed

‎docs/tutorials/aws/AIConnectorHelper.ipynb

+59-22
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,13 @@
1818
"# This Python code is compatible with AWS OpenSearch versions 2.9 and higher.\n",
1919
"class AIConnectorHelper:\n",
2020
" \n",
21-
" def __init__(self, region, opensearch_domain_name, opensearch_domain_username, opensearch_domain_password, aws_user_name):\n",
21+
" def __init__(self, region, opensearch_domain_name, opensearch_domain_username, opensearch_domain_password, aws_user_name, aws_role_name):\n",
2222
" self.region = region\n",
2323
" self.opensearch_domain_url, self.opensearch_domain_arn = AIConnectorHelper.get_opensearch_domain_info(region, opensearch_domain_name)\n",
2424
" self.opensearch_domain_username = opensearch_domain_username\n",
2525
" self.opensearch_domain_opensearch_domain_password = opensearch_domain_password\n",
2626
" self.aws_user_name = aws_user_name\n",
27+
" self.aws_role_name = aws_role_name\n",
2728
" \n",
2829
" @staticmethod \n",
2930
" def get_opensearch_domain_info(region, domain_name):\n",
@@ -46,6 +47,8 @@
4647
" return None, None\n",
4748
" \n",
4849
" def get_user_arn(self, username):\n",
50+
" if not username:\n",
51+
" return None\n",
4952
" # Create a boto3 client for IAM\n",
5053
" iam_client = boto3.client('iam')\n",
5154
"\n",
@@ -172,6 +175,8 @@
172175
" return None\n",
173176
"\n",
174177
" def get_role_arn(self, role_name):\n",
178+
" if not role_name:\n",
179+
" return None\n",
175180
" iam_client = boto3.client('iam')\n",
176181
" try:\n",
177182
" response = iam_client.get_role(RoleName=role_name)\n",
@@ -374,7 +379,7 @@
374379
" \"Statement\": [\n",
375380
" {\n",
376381
" \"Action\": [\n",
377-
" \"secretsmanager:GetSecretValue\"\n",
382+
" \"secretsmanager:GetSecretValue\",\n",
378383
" \"secretsmanager:DescribeSecret\"\n",
379384
" ],\n",
380385
" \"Effect\": \"Allow\",\n",
@@ -395,17 +400,27 @@
395400
" # Step 3: Configure IAM role in OpenSearch\n",
396401
" # 3.1 Create IAM role for Signing create connector request\n",
397402
" user_arn = self.get_user_arn(self.aws_user_name)\n",
403+
" role_arn = self.get_role_arn(self.aws_role_name)\n",
404+
" statements = []\n",
405+
" if user_arn:\n",
406+
" statements.append({\n",
407+
" \"Effect\": \"Allow\",\n",
408+
" \"Principal\": {\n",
409+
" \"AWS\": user_arn\n",
410+
" },\n",
411+
" \"Action\": \"sts:AssumeRole\"\n",
412+
" })\n",
413+
" if role_arn:\n",
414+
" statements.append({\n",
415+
" \"Effect\": \"Allow\",\n",
416+
" \"Principal\": {\n",
417+
" \"AWS\": role_arn\n",
418+
" },\n",
419+
" \"Action\": \"sts:AssumeRole\"\n",
420+
" })\n",
398421
" trust_policy = {\n",
399422
" \"Version\": \"2012-10-17\",\n",
400-
" \"Statement\": [\n",
401-
" {\n",
402-
" \"Effect\": \"Allow\",\n",
403-
" \"Principal\": {\n",
404-
" \"AWS\": user_arn\n",
405-
" },\n",
406-
" \"Action\": \"sts:AssumeRole\"\n",
407-
" }\n",
408-
" ]\n",
423+
" \"Statement\": statements\n",
409424
" }\n",
410425
"\n",
411426
" inline_policy = {\n",
@@ -486,17 +501,27 @@
486501
" # Step 2: Configure IAM role in OpenSearch\n",
487502
" # 2.1 Create IAM role for Signing create connector request\n",
488503
" user_arn = self.get_user_arn(self.aws_user_name)\n",
504+
" role_arn = self.get_role_arn(self.aws_role_name)\n",
505+
" statements = []\n",
506+
" if user_arn:\n",
507+
" statements.append({\n",
508+
" \"Effect\": \"Allow\",\n",
509+
" \"Principal\": {\n",
510+
" \"AWS\": user_arn\n",
511+
" },\n",
512+
" \"Action\": \"sts:AssumeRole\"\n",
513+
" })\n",
514+
" if role_arn:\n",
515+
" statements.append({\n",
516+
" \"Effect\": \"Allow\",\n",
517+
" \"Principal\": {\n",
518+
" \"AWS\": role_arn\n",
519+
" },\n",
520+
" \"Action\": \"sts:AssumeRole\"\n",
521+
" })\n",
489522
" trust_policy = {\n",
490523
" \"Version\": \"2012-10-17\",\n",
491-
" \"Statement\": [\n",
492-
" {\n",
493-
" \"Effect\": \"Allow\",\n",
494-
" \"Principal\": {\n",
495-
" \"AWS\": user_arn\n",
496-
" },\n",
497-
" \"Action\": \"sts:AssumeRole\"\n",
498-
" }\n",
499-
" ]\n",
524+
" \"Statement\": statements\n",
500525
" }\n",
501526
"\n",
502527
" inline_policy = {\n",
@@ -571,20 +596,32 @@
571596
"opensearch_domain_password = '...' # set your domain password\n",
572597
"\n",
573598
"aws_user_name = '...' # set your AWS IAM user name, not IAM user ARN. \n",
574-
" # To avoid permission issue and quick start, you can use user whith AdministratorAccess policy\n",
599+
" # To avoid permission issue and quick start, you can use user with AdministratorAccess policy\n",
575600
" # Configure this user's access key and secret key in ~/.aws/credential \n",
576601
" # You can configure ~/.aws/credential as:\n",
577602
"'''\n",
578603
"[default]\n",
579604
"AWS_ACCESS_KEY_ID = YOUR_ACCESS_KEY_ID\n",
580605
"AWS_SECRET_ACCESS_KEY = YOUR_SECRET_ACCESS_KEY\n",
581606
"'''\n",
607+
"aws_role_name = '...' # set your AWS IAM role name, not IAM role ARN.\n",
608+
" # To avoid permission issue and quick start, you can use role with AdministratorAccess policy\n",
609+
" # You can configure role temporary credential in ~/.aws/credential as:\n",
610+
"'''\n",
611+
"[default]\n",
612+
"AWS_ACCESS_KEY_ID = YOUR_ACCESS_KEY_ID\n",
613+
"AWS_SECRET_ACCESS_KEY = YOUR_SECRET_ACCESS_KEY\n",
614+
"AWS_SESSION_TOKEN = YOUR_AWS_SESSION_TOKEN\n",
615+
"'''\n",
616+
"# You must set either aws_user_name or aws_role_name. \n",
617+
"# You can set the one which you don't need as None. For example aws_role_name=None\n",
582618
"\n",
583619
"helper = AIConnectorHelper(region, \n",
584620
" opensearch_domain_name, \n",
585621
" opensearch_domain_username, \n",
586622
" opensearch_domain_password, \n",
587-
" aws_user_name)"
623+
" aws_user_name,\n",
624+
" aws_role_name)"
588625
]
589626
},
590627
{

0 commit comments

Comments
 (0)