libera_utils.aws.utils#

Helper functions for AWS access

Functions

find_bucket_in_account_by_partial_name(...)

Finds a bucket by substring match to the bucket name.

find_dynamodb_table_in_account_by_partial_name(...)

Finds a DynamoDB table by substring match to its name.

find_event_bus_in_account_by_partial_name(...)

Finds an EventBridge event bus by substring match to its name.

get_l2_team_role_session([profile_name, ...])

Create a boto3 session that has assumed an L2 team IAM role.
libera_utils.aws.utils._single_match_by_partial_name(partial_name: str, names: list[str], *, resource_description: str) → str#

Return the single name matching partial_name, raising if zero or more than one match is found.

Parameters:

  • partial_name (str) – Literal substring to search for within each candidate name. Regex metacharacters are escaped, so the match is a plain substring match (not a regex).

  • names (list of str) – Candidate names to search.

  • resource_description (str) – Human-readable singular description of the resource (e.g. “bucket”), used in the error message.

Returns:

The single matching name.

Return type:

str

libera_utils.aws.utils.find_bucket_in_account_by_partial_name(boto_session: Session, partial_name: str) → str#

Finds a bucket by substring match to the bucket name. Raises if zero or more than one bucket matches.

libera_utils.aws.utils.find_dynamodb_table_in_account_by_partial_name(boto_session: Session, partial_name: str) → str#

Finds a DynamoDB table by substring match to its name. Raises if zero or more than one table matches.

libera_utils.aws.utils.find_event_bus_in_account_by_partial_name(boto_session: Session, partial_name: str) → str#

Finds an EventBridge event bus by substring match to its name. Raises if zero or more than one bus matches.

libera_utils.aws.utils.get_l2_team_role_session(profile_name: str | None = None, *, role_name: str = 'L2Developer/LiberaUtils') → Session#

Create a boto3 session that has assumed an L2 team IAM role.

Libera SDC users authenticate (via their AWS config/SSO or an explicit profile) to a “base” role that grants no permissions directly but is permitted to assume one or more L2 team roles. This includes the generic LiberaUtils role (used by s3-utils put and manual-processing) as well as per-team L2 roles (used by ecr-upload to push to a specific algorithm’s ECR repo). This function resolves the base credentials, assumes the requested role, and returns a new session backed by the assumed-role credentials.

Parameters:

  • profile_name (str, optional) – AWS profile name used to create the base session. If None, standard boto resolution is used (e.g. the AWS_PROFILE environment variable, the default profile, or an instance role).

  • role_name (str, optional) – Name (or path-qualified name) of the IAM role to assume. Defaults to "L2Developer/LiberaUtils".

Returns:

A session whose credentials are those of the assumed role. The region is inherited from the base session.

Return type:

boto3.Session

Raises:

ValueError – If the base profile is not permitted to assume the role. The message names both the base role and the target role.