aws-assume-role-lib

[fjohnson-eab]

Is there an AWS-provided means of accomplishing what the "aws-assume-role-lib" 3rd-party library does? If not, I propose that Amazon contact the developer to add that to powertools-lambda-python. What do other people think?

[leandrodamascena]

Hi @fjohnson-eab! Thanks for opening this discussion! We've been discussing some ideas on how we can help customers with some abstractions on top of the SDK, boto3 for python in this case. Can you tell me a bit more about your use case?

[fjohnson-eab]

Apologies in advance, but I'm going to keep my answer vague. I think the main goals are abstraction as you mentioned (i.e. simpler code to assume a role) and easy-to-manage credentials that don't have to be regenerated in a warm Lambda execution environments across invocations.

[leandrodamascena]

Hi @fjohnson-eab ! Thanks for clarifying this! This is actually a very useful library! I'll keep this discussion open to see if we have any further involvement and consider adding it to Powertools in the future.

[dreamorosi]

I guess my main question, if you're comfortable sharing at least that, is why not just use the 3rd party module you linked and what do you think we can do differently here.

[fjohnson-eab]

I guess my main question, if you're comfortable sharing at least that, is why not just use the 3rd party module you linked and what do you think we can do differently here.

• Not to question the trustworthiness of the developer, but it's a safer security practice to rely on vendor libraries (e.g. Lambda Powertools) over 3rd-party ones, especially for security-related functionality.
• This is not some random, unrelated feature that could exist in Powertools; it's an abstraction of an AWS service that is useful in a Lambda environment. I guess I would pose the opposite question: What is Lambda Powertools intended for if not features like this?

[dreamorosi]

Thanks for clarifying.

The first point is what I suspected was the reason for your request, but before making assumptions I wanted to confirm whether it was grounded in supply chain concerns or there was some technical gap that we could address.

To answer your second point, we have a page that shows our current roadmap, as well as a section dedicated to explain how we consider adding new features to the project (see "Process").

[fjohnson-eab]

@benkehoe , fyi