Using boto3 from the command line#

I found a useful pattern today for automating more complex AWS processes as pastable command line snippets, using Boto3.

The trick is to take advantage of the fact that python3 -c '...' lets you pass in a multi-line Python string which will be executed directly.

I used that to create a new IAM role by running the following:

1
python3 -c '
2
import boto3, json
3

4
iam = boto3.client("iam")
5
create_role_response = iam.create_role(
6
    Description=("Description of my role"),
7
    RoleName="my-new-role",
8
    AssumeRolePolicyDocument=json.dumps(
9
        {
10
            "Version": "2012-10-17",
11
            "Statement": [
12
                {
13
                    "Effect": "Allow",
14
                    "Principal": {
15
                        "AWS": "arn:aws:iam::462092780466:user/s3.read-write.my-previously-created-user"
16
                    },
17
                    "Action": "sts:AssumeRole",
18
                }
19
            ],
20
        }
21
    ),
22
    MaxSessionDuration=12 * 60 * 60,
23
)
24
# Attach AmazonS3FullAccess to it - note that even though we use full access
25
# on the role itself any time we call sts.assume_role() we attach an additional
26
# policy to ensure reduced access for the temporary credentials
27
iam.attach_role_policy(
28
    RoleName="my-new-role",
29
    PolicyArn="arn:aws:iam::aws:policy/AmazonS3FullAccess",
30
)
31
print(create_role_response["Role"]["Arn"])
32
'