Support for IoT Credentials Provider?

[KyleKotowick]

Confirm by changing [ ] to [x] below:

• I've searched for previous similar issues and didn't find any solution

Platform/OS/Device
Ubuntu 20.04

Describe the question
I'm trying to use IoT certificates to obtain temporary STS credentials, as described here.

That article discusses using curl to obtain the temporary token, but is this not something that's supported natively in the IoT SDK?

[bretambrose]

The native part of the library supports X509 credentials sourcing (https://github.com/awslabs/aws-c-auth/blob/main/include/aws/auth/credentials.h#L261), but it hasn't been bound out to Python yet, just Java and C++ so far. It's not a difficult task, it just hasn't been prioritized.

[KyleKotowick]

Thanks for the update. It's a nice-to-have, but not critical since it's pretty easy to accomplish a workaround.

For anyone else who wants to do this, here's some sample code:

import urllib3
import json

cert_file = 'path/to/cert/file.crt'
key_file = 'path/to/key/file.key'
thing_name = 'my-thing'
credentials_url = 'https://{unique-endpoint}.iot.{region}.amazonaws.com/role-aliases/{alias-name}/credentials'
region = 'ca-central-1'

retries = urllib3.Retry(connect=5, read=2, redirect=5)
http = urllib3.PoolManager(
    cert_file=cert_file,
    key_file=key_file,
    cert_reqs="CERT_REQUIRED",
    headers={
        'x-amzn-iot-thingname': thing_name
    },
    retries=retries
)

def get_boto_session():
    resp = http.request("GET", credentials_url)
    if resp.status != 200:
        raise Exception("Failed to retrieve STS token: {}".format(resp.reason))
    creds = json.loads(resp.data)['credentials']
    return boto3.session.Session(aws_access_key_id=creds['accessKeyId'], aws_secret_access_key=creds['secretAccessKey'], aws_session_token=creds['sessionToken'], region_name=region)

if __name__ == '__main__':
    sess = get_boto_session()
    client = sess.client('whatever-client-you-want')
    client.do_things()

[github-actions]

Greetings! Sorry to say but this is a very old issue that is probably not getting as much attention as it deservers. We encourage you to check if this is still an issue in the latest release and if you find that this is still a problem, please feel free to open a new one.

[jmklix]

This should now be possible with this sdk. Take a look at the docs and let us know if you have any questions