Segarkan kunci API Amazon Bedrock jangka pendek untuk kontrol dan keamanan yang lebih besar

Setelah Anda lebih akrab dengan Amazon Bedrock, kami sangat menyarankan untuk tidak menggunakan kunci API Amazon Bedrock jangka panjang. Sebagai gantinya, Anda harus beralih menggunakan kredensi keamanan sementara atau ke kunci API Amazon Bedrock jangka pendek.

Anda dapat membuat skrip dengan bantuan aws-bedrock-token-generator paket untuk membuat ulang kunci jangka pendek baru secara terprogram setiap kali kunci Anda saat ini telah kedaluwarsa. Pertama, pastikan bahwa Anda telah memenuhi prasyarat di. Buat kunci API Amazon Bedrock jangka pendek menggunakan API

Anda kemudian dapat menggunakan skrip Python berikut:

from datetime import datetime, timedelta
import os
import boto3
from botocore.credentials import Credentials
from aws_bedrock_token_generator import BedrockTokenGenerator

# Replace the following values as necessary
SESSION_DURATION = timedelta(hours=12)                                  # 12 hours is the maximum
EFFECTIVE_TOKEN_DURATION = min(SESSION_DURATION, timedelta(hours=12))   # The token can last no longer than 12 hours
ROLE_ARN = "arn:aws:iam::111122223333:role/TargetRole"        # Ensure that the identity you're authenticating with has permissions to assume this role
ROLE_SESSION_NAME = "your-session-name"
REGION = "us-east-1"

def get_session_from_assume():
    sts = boto3.client("sts")
    response = sts.assume_role(
        RoleArn=ROLE_ARN,
        RoleSessionName=ROLE_SESSION_NAME,
        DurationSeconds=int(SESSION_DURATION.total_seconds())
    )
    creds = response["Credentials"]
    return Credentials(
        access_key=creds["AccessKeyId"],
        secret_key=creds["SecretAccessKey"],
        token=creds["SessionToken"]
    )

# Step 1: Generate initial token and note timestamp
generator = BedrockTokenGenerator()
creds = get_session_from_assume()
token = generator.get_token(creds, region=REGION)
token_created_at = datetime.utcnow()

# Step 2: Later in your long lived process — before using the token
if datetime.utcnow() - token_created_at >= EFFECTIVE_TOKEN_DURATION:
    creds = get_session_from_assume()
    token = generator.get_token(creds, region=REGION)
    token_created_at = datetime.utcnow()
else:
    # Token is still valid
    pass
        
# Set the token as an environment variable so you can use it in API calls
os.environ['AWS_BEARER_TOKEN_BEDROCK'] = token