Package: cassandra-sigv4
IMPORTANT: Latest VersionThe current version is 4.0.2. Please see thechangelogfor details on version history.WhatThis package implements an authentication plugin for the open-source Datastax Python Driver for Apache Cassandra.
The driver enables you to add authentication information to your API requests using the AWS Signature Version 4 Process (SigV4).
Using the plugin, you can provide users and applications short-term credentials to access Amazon Keyspaces (for Apache Cassandra)
using AWS Identity and Access Management (IAM) users and roles.The plugin depends on the AWS SDK for Python (Boto3). It usesboto3.Sessionto obtain credentials.Example Usagessl_context=SSLContext(PROTOCOL_TLSv1_2)ssl_context.load_verify_locations('./AmazonRootCA1.pem')ssl_context.verify_mode=CERT_REQUIREDboto_session=boto3.Session(aws_access_key_id="AKIAIOSFODNN7EXAMPLE",aws_secret_access_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",aws_session_token="AQoDYXdzEJr...<remainder of token>",region_name="us-east-2")auth_provider=SigV4AuthProvider(boto_session)cluster=Cluster(['cassandra.us-east-2.amazonaws.com'],ssl_context=ssl_context,auth_provider=auth_provider,port=9142)session=cluster.connect()r=session.execute('select * from system_schema.keyspaces')print(r.current_rows)Using the PluginThe following sections describe how to use the authentication plugin for the open-source DataStax Python Driver for Cassandra to access Amazon Keyspaces.SSL ConfigurationThe first step is to get an Amazon digital certificate to encrypt your connections using Transport Layer Security (TLS).
The DataStax Python driver must use an SSL CA certificate so that the client SSL engine can validate the Amazon Keyspaces
certificate on connection.ssl_context=SSLContext(PROTOCOL_TLSv1_2)ssl_context.load_verify_locations('./AmazonRootCA1.pem')ssl_context.verify_mode=CERT_REQUIREDRegion ConfigurationBefore you can start using the plugin, you must configure the AWS Region that the plugin will use when authenticating.
This is required because SigV4 signatures are Region-specific. For example, if you are connecting to thecassandra.us-east-2.amazonaws.comendpoint,
the Region must beus-east-2. For a list of available AWS Regions and endpoints, seeService Endpoints for Amazon Keyspaces.You can specify the Region using one of the following four methods:Environment VariableConstructorBoto3 Session ConfigurationEnvironment VariableYou can use theAWS_REGIONenvironment variable to match the endpoint that you are
communicating with by setting it as part of your application start-up, as follows.$exportAWS_REGION=us-east-1ConstructorYou can either provide the constructor forSigV4AuthProviderwith a boto3 session, aws credentials and a region,
or a parameterless constructor to follow the default boto3 credential discovery path.Install the plugin in your environmentpipinstallcassandra-sigv4Programmatically Configure the Driver With a boto3 sessionNote that if a session is provided, all other arguments for the constructor are ignored.boto_session=boto3.Session(aws_access_key_id="AKIAIOSFODNN7EXAMPLE",aws_secret_access_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",aws_session_token="AQoDYXdzEJr...<remainder of token>",region_name="us-east-2")auth_provider=SigV4AuthProvider(boto_session)cluster=Cluster(['cassandra.us-east-2.amazonaws.com'],ssl_context=ssl_context,auth_provider=auth_provider,port=9142)Programmatically Configure the Drive with raw AWS Credentialsauth_provider=SigV4AuthProvider(aws_access_key_id="AKIAIOSFODNN7EXAMPLE",aws_secret_access_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",aws_session_token="AQoDYXdzEJr...<remainder of token>",region_name="us-east-2")cluster=Cluster(['cassandra.us-east-2.amazonaws.com'],ssl_context=ssl_context,auth_provider=auth_provider,port=9142)