Choosing an AWS Profile with Boto3 to Connect to CloudFront

If you’re using Boto3 to interact with AWS CloudFront, specifying the correct AWS profile can sometimes trip you up. By default, Boto3 uses the default profile configured in your AWS credentials file, but what if you need to specify a different profile? Fortunately, Boto3 provides a few simple ways to select the profile you wish to use.

AWS Profile Basics

When you configure your AWS credentials and profiles, they are typically stored in files located in your home directory, such as ~/.aws/credentials and ~/.aws/config. Each profile in these files helps Boto3 identify which access key and secret key to use. The default profile is used when you don’t specify one explicitly, but you can switch profiles when necessary.

An AWS profile is simply a named configuration of credentials in your credentials file. This includes your access keys and any additional configuration like region settings. When you create a new session in Boto3, you can specify the profile to determine which credentials to use.

Method 1: Create a New Session with a Profile

Creating a new session with a specific profile is a clean and effective way of specifying your AWS credentials. Here’s how you can do it:

from boto3 import session

dev_session = session.Session(profile_name='dev')
cloudfront_client = dev_session.client('cloudfront')

This code snippet initializes a new session using the dev profile. It then creates a CloudFront client from that session. This is useful when you have multiple scripts or processes running under different profiles.

Method 2: Set the Default Session Profile in Your Code

If you’d like to stick with using the default session but switch the profile, you can change it programmatically:

import boto3

boto3.setup_default_session(profile_name='dev')
cloudfront_client = boto3.client('cloudfront')

By setting up the default session with your desired profile, any subsequent calls to boto3.client() will use that profile. This can be handy for quick tests or scripts where you don’t want to restructure how you handle sessions.

Method 3: Use an Environment Variable

For those who prefer keeping configuration changes outside of code, the environment variable approach is seamless. Here’s how to use it:

$ export AWS_PROFILE=dev
$ python script.py

When you set the AWS_PROFILE environment variable before running your script, Boto3 will pick this up and use the specified profile for all session and client operations.

These methods help you manage your credentials efficiently, especially in development environments where different AWS profiles are commonplace. Always use these best practices to ensure you’re selecting the correct credentials for the task at hand.

It’s worth noting that you should avoid hardcoding your AWS credentials in your scripts. Instead, use profiles, environment variables, or IAM roles if you’re working within AWS services like EC2 or Lambda for safer and more manageable authentication.

For further reading on session handling with Boto3, you can always refer to the AWS Boto3 documentation.