@@ -0,0 +1,2349 @@
+# Copyright 2010-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.%0A# This file is licensed under the Apache License, Version 2.0 (the %22License%22).%0A# You may not use this file except in compliance with the License. A copy of%0A# the License is located at%0A# %0A# http://aws.amazon.com/apache2.0/%0A# %0A# This file is distributed on an %22AS IS%22 BASIS, WITHOUT WARRANTIES OR%0A# CONDITIONS OF ANY KIND, either express or implied. See the License for the%0A# specific language governing permissions and limitations under the License.%0A%0A# snippet-sourcedescription:%5Bassume_role.py demonstrates how to use Amazon STS AssumeRole to access resources on an external account.%5D%0A# snippet-service:%5Biam%5D%0A# snippet-keyword:%5BPython%5D%0A# snippet-keyword:%5BAWS Identity and Access Management (IAM)%5D%0A# snippet-keyword:%5BCode Sample%5D%0A# snippet-keyword:%5BAssumeRole%5D%0A# snippet-sourcetype:%5Bfull-example%5D%0A# snippet-sourcedate:%5B2019-01-22%5D%0A# snippet-sourceauthor:%5Bstephswo (AWS)%5D%0A# snippet-start:%5Biam.python.assume_role.complete%5D%0A%0Aimport boto3%0A%0A# Create an STS client%0Asts_client = boto3.client('sts')%0A%0A# Assume a role defined on an external account. The role specifies the%0A# permissions that are allowed on the account.%0A# Replace EXTERNAL_ACCOUNT_NUMBER with the account number of the external%0A# account.%0A# Replace ROLE_NAME with the name of the role defined on the external account.%0A# Optional, but recommended: Specify a unique ExternalId= string assigned by%0A# the external account.%0Aresponse = sts_client.assume_role(RoleArn='arn:aws:iam::EXTERNAL_ACCOUNT_NUMBER:role/ROLE_NAME',%0A                                  RoleSessionName='AssumeRoleSession1')%0A%0A# Reference the temporary credentials section of the response%0AtempCredentials = response%5B'Credentials'%5D%0A%0A# Use the temporary credentials to create an S3 resource that can access the%0A# external account. The assumed role's permissions must allow the desired S3%0A# access.%0As3_resource = boto3.resource('s3',%0A                             aws_access_key_id=tempCredentials%5B'AccessKeyId'%5D,%0A                             aws_secret_access_key=tempCredentials%5B'SecretAccessKey'%5D,%0A                             aws_session_token=tempCredentials%5B'SessionToken'%5D)%0A%0A# Use the S3 resource to list the external account's buckets.%0Afor bucket in s3_resource.buckets.all():%0A    print(bucket.name)%0A# snippet-end:%5Biam.python.assume_role.complete%5D%0A

Convert PR #414 Python iam/assume_role.py to Boto3