Accommodate new SSO aws_account_name #15
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This should still work with old usernames as well
|
Leaving this as a draft until I can get someone to test this branch. |
loganbyers
reviewed
May 23, 2023
| @@ -39,7 +40,7 @@ class TreeCoverLossAnalysis(object): | |||
| self.description = descript_1 + descript_2 + descript_3 | |||
| self.canRunInBackground = False | |||
| self.aws_account_name = ( | |||
| boto3.client("sts").get_caller_identity().get("Arn").split("/")[1] | |||
| aws_session.client("sts").get_caller_identity().get("Arn").split("/")[-1] | |||
There was a problem hiding this comment.
Could/should the @wri.org part of the user label be removed?
aws_session.client("sts").get_caller_identity().get("Arn").split("/")[-1].split("@")[0]
loganbyers
reviewed
May 23, 2023
| @@ -5,6 +5,7 @@ from datetime import datetime | |||
| import itertools | |||
| import os | |||
|
|
|||
| aws_session = boto3.Session(profile_name='default') | |||
There was a problem hiding this comment.
I suspect this would be a little more appropriate as a class-level variable in TreeCoverLossAnalysis.
Is the idea that SSO users will likely override which profile is being used? I worry that hard-coding the string 'default' might not be better than passing None, which would signal that boto should find whatever the fallback profile is. Can the choice of profile be provided as a parameter to the execution of the tool? That way people don't have to edit the code if they have a less common environment setup.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WRI is starting to use SSO to provision new users on AWS. For SSO users the
Arnhas a different structure.This change should accommodate both formats but for SSO users their
aws_account_namewill now be their email address.I also switched over to using
boto3.Sessionto accommodate people with multiple user accounts. This is set todefaultby default so it should continue to function as is for existing users.