Installing boto3 and configuring credentials

Every boto3 call is signed with credentials for a region, and most beginner errors are credential or region problems.

boto3 is the AWS SDK for Python, built on the lower-level botocore library. Install it with pip install boto3.

boto3 needs two things before it can call AWS: credentials (who you are) and a region (where the service lives). It finds credentials automatically through a provider chain, so code doesn't contain secrets. The common sources, roughly in order:

Explicit arguments to boto3.client(...) or boto3.Session(...) (avoid in real code).
Environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN.
Profiles in ~/.aws/credentials and ~/.aws/config, selected by AWS_PROFILE or profile_name=; this includes IAM Identity Center (SSO) profiles set up with aws configure sso and aws sso login.
On AWS itself, the role attached to the compute: ECS task role, Lambda execution role, EC2 instance profile.

The region comes from region_name=, the AWS_DEFAULT_REGION environment variable or the profile's region setting.

On your laptop, prefer short-lived SSO credentials over long-lived access keys. On AWS, rely on roles and never ship keys.

The quickest check that everything works is STS get_caller_identity, which needs no permissions and returns the account and ARN of the identity boto3 resolved. If it fails with NoCredentialsError, nothing in the chain provided credentials.

Example

# $ pip install boto3
# $ aws configure sso          # or: aws configure (access keys)
# $ aws sso login --profile dev
# $ export AWS_PROFILE=dev AWS_DEFAULT_REGION=eu-west-1

import boto3
from botocore.exceptions import NoCredentialsError

try:
    sts = boto3.client("sts")
    me = sts.get_caller_identity()
    print(me["Account"], me["Arn"])
    # 123456789012 arn:aws:sts::123456789012:assumed-role/Dev/alice
except NoCredentialsError:
    print("No credentials found: run aws configure or aws sso login")

print(boto3.session.Session().region_name)   # eu-west-1

Remember

boto3 resolves credentials through a provider chain: no secrets in code
Env vars, profiles (incl. SSO) and attached IAM roles are the usual sources
Set a region via AWS_DEFAULT_REGION, the profile or region_name
sts.get_caller_identity() shows which identity is being used

Watch out for

Hard-coding access keys in source code or committing ~/.aws files.

Check yourself

Your code on an EC2 instance with an instance profile never sets credentials. How does boto3 authenticate?

Official docs: boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html

Example

Remember

Watch out for

Check yourself

Builds on

Unlocks