BUG: Read from S3 fails after assuming an AWS IAM role

[justinessert]

• I have checked that this issue has not already been reported.

• I have confirmed this bug exists on the latest version of pandas.

• (optional) I have confirmed this bug exists on the master branch of pandas.

---

Code Sample, a copy-pastable example

import pandas as pd

assume_iam_role(role)
pd.read_csv(filepath)

Problem description

Hey all, I am having an issue where after assuming an AWS IAM role, I still get a forbidden error when running pd.read_csv. This error only happens in a Jupyter notebook. When just running a Python file, everything works (maybe related to the notebook kernel?).

Additionally, if I re-import Pandas after I assume the IAM role, then I am able to read from AWS without error.

Unfortunately, I have to assume my IAM role through a specific command that is internal to my company, so I am unable to share exactly how that part is happening (though I think it is mostly just calling the AWS CLI).

Could someone help me understand why this is happening and/or suggest a better way to handle this issue rather than re-importing pandas? I assume something is happening in the __init__.py, but after looking through this repo, I am unsure how the read from S3 stuff is being handled at all.

Expected Output

pd.read_csv works without error after assuming an IAM role.

Output of pd.show_versions()

INSTALLED VERSIONS

commit : 9d598a5
python : 3.7.9.final.0
python-bits : 64
OS : Linux
OS-release : 4.14.209-160.339.amzn2.x86_64
Version : #1 SMP Wed Dec 16 22:44:04 UTC 2020
machine : x86_64
processor : x86_64
byteorder : little
LC_ALL : None
LANG : en_US.UTF-8
LOCALE : en_US.UTF-8

pandas : 1.2.1
numpy : 1.19.5
pytz : 2020.5
dateutil : 2.8.1
pip : 20.3.3
setuptools : 51.3.3.post20210118
Cython : None
pytest : 6.2.1
hypothesis : None
sphinx : 3.4.3
blosc : None
feather : None
xlsxwriter : None
lxml.etree : None
html5lib : None
pymysql : None
psycopg2 : None
jinja2 : 2.11.2
IPython : 7.19.0
pandas_datareader: None
bs4 : None
bottleneck : None
fsspec : 0.8.5
fastparquet : None
gcsfs : None
matplotlib : None
numexpr : None
odfpy : None
openpyxl : 3.0.6
pandas_gbq : None
pyarrow : 1.0.1
pyxlsb : None
s3fs : 0.5.2
scipy : None
sqlalchemy : None
tables : None
tabulate : None
xarray : None
xlrd : None
xlwt : None
numba : None

[twoertwein]

read_csv calls fsspec which then calls s3/boto3. You can use read_csv's storage_options keyword argument to forward options to fsspec. That doesn't address the underlying issue but might be a workaround.

[justinessert]

Can you clarify what you mean? What storage_options would I specify?

[twoertwein]

something like:
pd.read_csv('s3://bucket/file.csv', storage_options={'key': key, 'secret': secret})

https://s3fs.readthedocs.io/en/latest/api.html#s3fs.core.S3FileSystem

[justinessert]

Found a better workaround than what I was doing previously:
Call s3fs.S3FileSystem.clear_instance_cache() prior to assuming the IAM role

[twoertwein]

great! Do you think that there is a bug in how pandas uses fsspec/s3fs or can you re-produce the issue directly when using fsspec/s3fs without pandas?

[justinessert]

I have not been able to get to additional testing here. I'd imagine that something is creating a s3fs.S3FileSystem to use when it is imported, creating a s3FS prior to my permissions changing. If I had to guess I would say that it's probably not an issue directly with Pandas.

[mroeschke]

Sounds like this isn't a direct issue in pandas; therefore, closing. If there ends up being an issue with IAM roles with store_options happy to reopen.