libera_utils.aws.utils#

Helper functions for AWS access

Functions

find_bucket_in_account_by_partial_name(...)

Finds a bucket by substring match to the bucket name.

find_dynamodb_table_in_account_by_partial_name(...)

Finds a DynamoDB table by substring match to its name.

find_event_bus_in_account_by_partial_name(...)

Finds an EventBridge event bus by substring match to its name.

get_l2_team_role_session([profile_name, ...])

Create a boto3 session that has assumed an L2 team IAM role.
libera_utils.aws.utils._resolve_algorithm_specific_session(algorithm: ProcessingStepIdentifier, profile_name: str | None = None) → Session#

Resolve the boto3 session to use for operations scoped to a specific algorithm.

L2 algorithms (those with a ProcessingStepIdentifier.l2_team_iam_role) are owned by an L2 team whose per-team L2 Team Role holds the permissions for that algorithm’s resources, so this assumes that role. All other algorithms (SPICE, L1B, scene-id, and other SDC-owned steps) use the ambient/--profile session directly. This lets SDC developers, whose admin credentials cannot assume the LiberaUtils/L2 roles, operate on SDC-owned algorithms with their own ambient credentials instead of failing on a role-assumption chain they are not part of.

Parameters:

  • algorithm (ProcessingStepIdentifier) – The processing step whose algorithm is being operated on.

  • profile_name (str, optional) – AWS profile name from the CLI (--profile), or None for default resolution.

Returns:

The session to use: the per-team L2 Team Role for L2 algorithms, or the ambient session otherwise.

Return type:

boto3.Session

Raises:

ValueError – If the algorithm requires an L2 Team Role that the base profile cannot assume.

libera_utils.aws.utils._session_region(boto_session: Session) → str#

Return the AWS region configured for the session, raising a clear error if none is set.

Region is intentionally taken from the user’s AWS configuration (profile, AWS_REGION/AWS_DEFAULT_REGION, or instance metadata) rather than hard-coded, so it follows the caller’s environment. A session with no region resolved cannot address regional resources (ECR, EventBridge, Batch), so this raises rather than silently guessing one.

Parameters:

boto_session (boto3.Session) – The session whose region should be used.

Returns:

The resolved AWS region name (e.g. "us-west-2").

Return type:

str

Raises:

ValueError – If the session has no region configured.

libera_utils.aws.utils._single_match_by_partial_name(partial_name: str, names: list[str], *, resource_description: str) → str#

Return the single name matching partial_name, raising if zero or more than one match is found.

Parameters:

  • partial_name (str) – Literal substring to search for within each candidate name. Regex metacharacters are escaped, so the match is a plain substring match (not a regex).

  • names (list of str) – Candidate names to search.

  • resource_description (str) – Human-readable singular description of the resource (e.g. “bucket”), used in the error message.

Returns:

The single matching name.

Return type:

str

libera_utils.aws.utils.find_bucket_in_account_by_partial_name(boto_session: Session, partial_name: str) → str#

Finds a bucket by substring match to the bucket name. Raises if zero or more than one bucket matches.

libera_utils.aws.utils.find_dynamodb_table_in_account_by_partial_name(boto_session: Session, partial_name: str) → str#

Finds a DynamoDB table by substring match to its name. Raises if zero or more than one table matches.

libera_utils.aws.utils.find_event_bus_in_account_by_partial_name(boto_session: Session, partial_name: str) → str#

Finds an EventBridge event bus by substring match to its name. Raises if zero or more than one bus matches.

libera_utils.aws.utils.get_l2_team_role_session(profile_name: str | None = None, *, role_name: str = 'L2Developer/LiberaUtils') → Session#

Create a boto3 session that has assumed an L2 team IAM role.

Libera SDC users authenticate (via their AWS config/SSO or an explicit profile) to a “base” role that grants no permissions directly but is permitted to assume one or more L2 team roles. This includes the generic LiberaUtils role (used by s3-utils put and manual-processing) as well as per-team L2 roles (used by ecr-upload to push to a specific algorithm’s ECR repo). This function resolves the base credentials, assumes the requested role, and returns a new session backed by the assumed-role credentials.

Parameters:

  • profile_name (str, optional) – AWS profile name used to create the base session. If None, standard boto resolution is used (e.g. the AWS_PROFILE environment variable, the default profile, or an instance role).

  • role_name (str, optional) – Name (or path-qualified name) of the IAM role to assume. Defaults to "L2Developer/LiberaUtils".

Returns:

A session whose credentials are those of the assumed role. The region is inherited from the base session.

Return type:

boto3.Session

Raises:

ValueError – If the base profile is not permitted to assume the role. The message names both the base role and the target role.