Skip to content

Adds support for loading AWS bearer tokens via session constructor params#4761

Open
jacoblee93 wants to merge 1 commit intoboto:developfrom
jacoblee93:jacob/bearertoken
Open

Adds support for loading AWS bearer tokens via session constructor params#4761
jacoblee93 wants to merge 1 commit intoboto:developfrom
jacoblee93:jacob/bearertoken

Conversation

@jacoblee93
Copy link
Copy Markdown

Predicated on: boto/botocore#3671

Issue #, if available:

#4723

Description of changes:

Add support for aws_bearer_token as an explicit parameter on Session, Session.client(), and Session.resource(), enabling per-session and per-client bearer token authentication for services that support it (e.g. Bedrock).

Motivation

Currently, bearer tokens for services like Bedrock can only be configured via environment variables (e.g. AWS_BEARER_TOKEN_BEDROCK). This is a problem for multi-tenant systems that need different tokens for different clients within the same process — the environment variable is global and not thread-safe.

This PR adds an explicit aws_bearer_token parameter that follows the same pattern as aws_access_key_id and aws_secret_access_key: it can be set at the session level or overridden per-client.

Changes

  • Added aws_bearer_token parameter to Session.__init__(), Session.client(), and Session.resource()
  • Client-level token takes precedence over session-level token, which takes precedence over environment variables
  • Uses is not None for precedence checks so that empty string is treated as an explicit value
  • Includes a version guard that omits the parameter when None, for compatibility with older botocore versions that don't support it (same pattern as aws_account_id)

Depends on: corresponding botocore PR that adds aws_bearer_token to Session.create_client()

Usage

import boto3

# Session-level token
session = boto3.Session(aws_bearer_token='my-api-key')
client = session.client('bedrock-runtime', region_name='us-east-1')

# Per-client override
session = boto3.Session()
client = session.client('bedrock-runtime', aws_bearer_token='my-api-key')

# Multiple clients with different tokens
client_a = session.client('bedrock-runtime', aws_bearer_token='tenant-a-key')
client_b = session.client('bedrock-runtime', aws_bearer_token='tenant-b-key')

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant