使用 IAM 角色和 boto3 连接到 Amazon SES答案

【问题标题】：Connecting to Amazon SES using IAM role and boto3使用 IAM 角色和 boto3 连接到 Amazon SES
【发布时间】：2018-06-26 02:19:57
【问题描述】：

我正在使用 boto3 连接到 AWS-SES 以发送邮件。我想使用 IAM 角色来连接，而不是访问密钥。

sts_client = boto3.client('sts')
assumedRoleObject = sts_client.assume_role(
    RoleArn="arn:aws:iam::824214895785:role/my_role_s3",
    RoleSessionName="AssumeRoleSession1"
)

credentials = assumedRoleObject['Credentials']
s3_resource = boto3.resource(
    's3',
    aws_access_key_id = credentials['AccessKeyId'],
    aws_secret_access_key = credentials['SecretAccessKey'],
    aws_session_token = credentials['SessionToken'],
)

但这给了我一个错误-

botocore.exceptions.NoCredentialsError：无法找到凭据

我的机器上没有凭据文件，因为我不想使用访问密钥。并且机器拥有访问 SES 的所有权限。我还需要做其他设置吗？

回溯-

Traceback (most recent call last):
   File "/opt/python/run/venv/lib/python3.4/site-packages/flask/app.py", line 1612, in full_dispatch_request
     rv = self.dispatch_request()
   File "/opt/python/run/venv/lib/python3.4/site-packages/flask/app.py", line 1598, in dispatch_request
     return self.view_functions[rule.endpoint](**req.view_args)
   File "/opt/python/run/venv/lib/python3.4/site-packages/flask_restplus/api.py", line 313, in wrapper
     resp = resource(*args, **kwargs)
   File "/opt/python/run/venv/lib/python3.4/site-packages/flask/views.py", line 84, in view
     return self.dispatch_request(*args, **kwargs)
   File "/opt/python/run/venv/lib/python3.4/site-packages/flask_restplus/resource.py", line 44, in dispatch_request
     resp = meth(*args, **kwargs)
   File "/opt/python/current/app/api/endpoints/task_comms_item.py", line 94, in post
     case_mail_obj.send_mail(final_mail_data)
   File "/opt/python/current/app/tools/mails/create_mail.py", line 88, in send_mail
     super(CreateMail, self).send_mail()
  File "/opt/python/current/app/tools/mails/base.py", line 37, in send_mail
     self.mail_obj.send(self.mail_format)
   File "/opt/python/current/app/lib/mail.py", line 154, in send
     ReplyToAddresses=self.mail_dict["reply_to"])
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/client.py", line 314, in _api_call
     return self._make_api_call(operation_name, kwargs)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/client.py", line 599, in _make_api_call
     operation_model, request_dict)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/endpoint.py", line 143, in make_request
     return self._send_request(request_dict, operation_model)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/endpoint.py", line 168, in _send_request
     request = self.create_request(request_dict, operation_model)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/endpoint.py", line 152, in create_request
     operation_name=operation_model.name)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/hooks.py", line 227, in emit
    return self._emit(event_name, kwargs)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/hooks.py", line 210, in _emit
     response = handler(**kwargs)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/signers.py", line 90, in handler
     return self.sign(operation_name, request)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/signers.py", line 154, in sign
     auth.add_auth(request)
   File "/opt/python/run/venv/lib/python3.4/site-packages/botocore/auth.py", line 352, in add_auth
     raise NoCredentialsError
 botocore.exceptions.NoCredentialsError: Unable to locate credentials

【问题讨论】：

你能产生完整的回溯吗？
添加回溯
您需要对sts客户端进行身份验证。您不能仅在没有任何类型的凭据且只有 ARN 和角色名称的情况下访问它......您可以在代码中或通过环境变量提供凭据。但是，如果您只是发送电子邮件，最好的方法是从 SES 获取 SMTP 凭据并像使用任何其他邮件客户端一样配置您的应用程序。
@sytech - 你的意思是在调用 boto3.client('sts') 方法时说？

标签： python boto3 amazon-ses

【解决方案1】：

根据文档，在这种情况下，您需要设置环境变量（默认 Session 对象从 env vars 读取凭据）：

http://boto3.readthedocs.io/en/latest/guide/configuration.html#environment-variable-configuration

How to set environment variables in Python

import os
os.environ['aws_access_key_id'] = credentials['AccessKeyId']
os.environ['aws_secret_access_key'] = credentials['SecretAccessKey']
os.environ['aws_session_token'] = credentials['SessionToken']

【讨论】：