When working with AWS services using Boto3, the Python SDK for AWS, you may encounter scenarios where multiple AWS accounts are in use. Each account may require specific configurations, often stored in different profiles. This article will guide you through choosing or specifying an AWS profile when connecting to AWS CloudFront or any other service using Boto3.

Boto3 and AWS Profiles

Boto3 provides the flexibility to manage multiple AWS account credentials using AWS profiles. Profiles are stored in the AWS credentials file, typically located at ~/.aws/credentials on Unix-based systems or C:\Users\<Username>\.aws\credentials on Windows.

Setting Up AWS Profiles

You can define multiple profiles in the credentials file. Each profile contains a set of credentials like the Access Key ID and Secret Access Key. Here's an example of how to set it up:

1[default]
2aws_access_key_id = YOUR_DEFAULT_ACCESS_KEY
3aws_secret_access_key = YOUR_DEFAULT_SECRET_KEY
4
5[development]
6aws_access_key_id = YOUR_DEV_ACCESS_KEY
7aws_secret_access_key = YOUR_DEV_SECRET_KEY
8
9[production]
10aws_access_key_id = YOUR_PROD_ACCESS_KEY
11aws_secret_access_key = YOUR_PROD_SECRET_KEY

• Default Profile: The default profile is the one Boto3 uses if no other profile is specified.
• Named Profiles: Additional profiles that can be used by specifying their name in your code or environment.

Specifying a Profile in Boto3

When using Boto3, you can specify which profile to use with three main methods:

1. Environment Variables: You can set the AWS_PROFILE environment variable to select the desired profile:

   export AWS_PROFILE=development

After setting this variable, any Boto3 code you run will use the credentials specified in the development profile by default, unless you explicitly specify another profile.

1. Session Object: Within your Python code, you can select a profile by creating a Boto3 session object with the desired profile:

1   import boto3
2
3   session = boto3.Session(profile_name='production')
4   cloudfront_client = session.client('cloudfront')

In this example, the session object is explicitly using the production profile, ensuring the correct credentials are utilized.

1. Boto3 Configuration: You can also use a config object in your code, which allows more granular configuration:

1   import boto3
2   from botocore.config import Config
3
4   my_config = Config(
5       region_name='us-west-2',
6       signature_version='v4'
7   )
8
9   session = boto3.Session(profile_name='development', config=my_config)
10   cloudfront_client = session.client('cloudfront')

Here, in addition to specifying the profile, the configuration includes other settings like region_name.

Example: Connecting to CloudFront

To demonstrate the use of AWS profiles with Boto3, let's walk through an example script that connects to AWS CloudFront and lists your CloudFront distributions:

1import boto3
2
3# Specify the AWS profile
4session = boto3.Session(profile_name='development')
5
6# Create a CloudFront client
7cloudfront_client = session.client('cloudfront')
8
9# List CloudFront distributions
10def list_distributions():
11    response = cloudfront_client.list_distributions()
12    if 'DistributionList' in response and response['DistributionList']['Items']:
13        distributions = response['DistributionList']['Items']
14        for dist in distributions:
15            print(f"ID: {dist['Id']}, Domain: {dist['DomainName']}")
16    else:
17        print("No distributions found.")
18
19list_distributions()

Simply substitute 'development' in Session(profile_name='development') with any other profile name as needed.

Considerations

Here are some considerations when choosing an AWS profile in Boto3:

• Environment-Specific Configurations: Use profiles to separate configurations for different environments (e.g., development, production).
• Credential Rotation: Regularly update and remove outdated credentials across all your profiles.
• A Shared Config File: Optionally, use a shared config file at ~/.aws/config for non-credential config values, such as default region.

Summary Table

In conclusion, managing AWS profiles within Boto3 is straightforward and provides much-needed flexibility when dealing with multiple AWS accounts. It enhances your ability to securely and efficiently manage various environments and services, such as CloudFront.