libera_utils.aws.utils.get_l2_team_role_session#

libera_utils.aws.utils.get_l2_team_role_session(profile_name: str | None = None, *, role_name: str = 'L2Developer/LiberaUtils') → Session#

Create a boto3 session that has assumed an L2 team IAM role.

Libera SDC users authenticate (via their AWS config/SSO or an explicit profile) to a “base” role that grants no permissions directly but is permitted to assume one or more L2 team roles. This includes the generic LiberaUtils role (used by s3-utils put and manual-processing) as well as per-team L2 roles (used by ecr-upload to push to a specific algorithm’s ECR repo). This function resolves the base credentials, assumes the requested role, and returns a new session backed by the assumed-role credentials.

Parameters:

  • profile_name (str, optional) – AWS profile name used to create the base session. If None, standard boto resolution is used (e.g. the AWS_PROFILE environment variable, the default profile, or an instance role).

  • role_name (str, optional) – Name (or path-qualified name) of the IAM role to assume. Defaults to "L2Developer/LiberaUtils".

Returns:

A session whose credentials are those of the assumed role. The region is inherited from the base session.

Return type:

boto3.Session

Raises:

ValueError – If the base profile is not permitted to assume the role. The message names both the base role and the target role.