Rant time: this isn’t directed at you. I am just replying to your comment because you said something that triggered me.

Also the “you” below is the generic you - not you personally.

Disclaimer: I work at AWS in Professional Services, all rants are my own.

Now with that out of the way, I hate the fact that there are way too many code samples floating around on the internet that have you explicitly put your access key and secret key in the initialization code for the AWS SDK.

    s3 = boto3.resource(‘s3’,aws_accesskey_id=ccxx,aws_secret_access_key_id=cccc)

Even if you put the access keys in a separate config file in your repo, this is wrong, unnecessary, and can easily lead to checking credentials in.

When all they have to do is

s3=boto3.resource(‘s3’)

All of the SDKs will automatically find your credentials locally in your .config file that is in your home directory when you run “aws configure”.

But really, you shouldn’t do that, you should use temporary access keys.

When you do get ready to run on AWS, the SDK will automatically get the credentials from the attached role.

Even when I’m integrating AWS with Azure DevOps, Microsoft provides a separate secure store that you can attach to your pipeline for your AWS credentials.