Developer Preview — This documentation covers the AWS SDK for Python, which is in Developer Preview and intended for evaluation and testing only. Do not use it for production workloads. For production applications, use the AWS SDK for Python (Boto3). To understand the differences between the two SDKs, see Choosing the right AWS SDK for Python.

Authenticating with AWS using the AWS SDK for Python

You must establish how the AWS SDK for Python authenticates with AWS when you develop with AWS services. The SDK manages credential discovery, signature creation, and credential refreshing completely behind the scenes, letting you focus on your application logic.

For local development, we recommend short-term credentials. Obtain them with the AWS CLI or from your identity provider, and then supply them to the SDK by using one of the following two methods.

Set environment variables

Set your credentials as environment variables on macOS or Linux:

export AWS_ACCESS_KEY_ID=your_access_key_id
export AWS_SECRET_ACCESS_KEY=your_secret_access_key
export AWS_SESSION_TOKEN=your_session_token

On Windows, use the following commands instead:

set AWS_ACCESS_KEY_ID=your_access_key_id
set AWS_SECRET_ACCESS_KEY=your_secret_access_key
set AWS_SESSION_TOKEN=your_session_token

Omit AWS_SESSION_TOKEN if you use long-term credentials. Short-term credentials expire after a limited period, and requests then fail. In that case, obtain new credentials and set the variables again.

Use a profile in the shared credentials file

Instead of setting environment variables in each terminal session, you can store your credentials in a named profile. The credentials file is shared by AWS SDKs and tools such as the AWS CLI, so it might already exist on your system. For its location, see Location of the shared files in the AWS SDKs and Tools Reference Guide.

Add a [default] profile to the credentials file:

[default]
aws_access_key_id = your_access_key_id
aws_secret_access_key = your_secret_access_key
aws_session_token = your_session_token

The SDK uses the [default] profile unless you select another one. To select a named profile, set the AWS_PROFILE environment variable:

export AWS_PROFILE=my-profile

Additional authentication options

The preceding sections cover local development. Code that runs within an AWS environment or assumes an IAM role uses other credential sources. For more options on authentication for the SDK, see the following: