Add ability to set session policies for assumed roles about botocove HOT 6 CLOSED

Sounds reasonable -we can't write any hugely meaningful tests since it's mainly just the API behaviour that changes. A test that uses new implemented arguments is mainly useful to catch regression or developer error so shouldn't be too tricky. Happy to review if you want to have a go.

Semi-related - I refactored the codebase without disrupting the user facing API on this branch. It drops some of the cruft like async.io loops and async funcs that don't really add much, and should hopefully allow progress bars. Feel free to check out https://github.com/connelldave/botocove/tree/progress_bar if you'd like to test. It'll be easy to port contributions to that change too if needs be.

from botocove.

Happy to review if you want to have a go.

Okay, thanks! I hope I can find time this week to implement it.

I refactored ... should hopefully allow progress bars.

Glad to hear it :-) I'll copy the comment to #11.

from botocove.

I started to study the code and the other PR a couple of weeks ago, but didn't have time to commit any changes.

It's still a priority for me! I hope to find enough free time soon.

from botocove.

I submitted a pull request to solve this for the Policy parameter.

Let me know what you think.

When you're happy with it I can extend it to support the PolicyArns parameter too.

from botocove.

Thanks for this Iain - now in 1.4.1 - it'd be great to hear more about your use case for it!

from botocove.

@connelldave I'll update my aws-org-inventory tool soon to use a generic read-only session policy.

In more specialized code I would use a session policy that allows only the AWS API actions required by the function executed by botocove.

Say I need to retrieve the template for every instance of a named stack. I'd pass a function to botocove that calls boto3 method CloudFormation.Client.get_template. I'd also pass a session policy that allows just the cloudformation:GetTemplate IAM action.

from botocove.