Repository: boto/boto3
File: boto3/session.py (Python)

Code before:
        aws_session_token=None,
        region_name=None,
        botocore_session=None,
        profile_name=None,
        aws_account_id=None,
    ):
        if botocore_session is not None:
            self._session = botocore_session
        else:
            # Create a new default session
            self._session = botocore.session.get_session()

        # Setup custom user-agent string if it isn't already customized
        if self._session.user_agent_name == 'Botocore':
            botocore_info = f'Botocore/{self._session.user_agent_version}'
            if self._session.user_agent_extra:
                self._session.user_agent_extra += ' ' + botocore_info
            else:
                self._session.user_agent_extra = botocore_info
            self._session.user_agent_name = 'Boto3'
            self._session.user_agent_version = boto3.__version__

        if profile_name is not None:
            self._session.set_config_variable('profile', profile_name)

        if (
            aws_access_key_id
            or aws_secret_access_key
            or aws_session_token
            or aws_account_id
        ):
            self._session.set_credentials(
                aws_access_key_id,
                aws_secret_access_key,
                aws_session_token,
                aws_account_id,
            )

        if region_name is not None:
            self._session.set_config_variable('region', region_name)

        self.resource_factory = ResourceFactory(
            self._session.get_component('event_emitter')
        )
        self._setup_loader()
        self._register_default_handlers()

    def __repr__(self):
        return '{}(region_name={})'.format(
            self.__class__.__name__,
            repr(self._session.get_config_variable('region')),

Review comment (security):
nit: is there a reason we aren't using any() here?

It also seems kinda weird that we are passing this in to a client if it won't be used (like if they set account_id or token without credentials), but it's in line with current behavior so it's not breaking.

Code after:
    def __init__(
        self,
        aws_access_key_id=None,
        aws_secret_access_key=None,
        aws_session_token=None,
        region_name=None,
        botocore_session=None,
        profile_name=None,
        aws_account_id=None,
    ):
        if botocore_session is not None:
            self._session = botocore_session
        else:
            # Create a new default session
            self._session = botocore.session.get_session()

        # Setup custom user-agent string if it isn't already customized
        if self._session.user_agent_name == 'Botocore':
            botocore_info = f'Botocore/{self._session.user_agent_version}'
            if self._session.user_agent_extra:
                self._session.user_agent_extra += ' ' + botocore_info
            else:
                self._session.user_agent_extra = botocore_info
            self._session.user_agent_name = 'Boto3'
            self._session.user_agent_version = boto3.__version__

        if profile_name is not None:
            self._session.set_config_variable('profile', profile_name)

        creds = (
            aws_access_key_id,
            aws_secret_access_key,
            aws_session_token,
            aws_account_id,
        )
        if any(creds):
            if self._account_id_set_without_credentials(
                aws_account_id, aws_access_key_id, aws_secret_access_key
            ):
                raise NoCredentialsError()
            self._session.set_credentials(
                aws_access_key_id,
                aws_secret_access_key,
                aws_session_token,
                aws_account_id,
            )

        if region_name is not None:
            self._session.set_config_variable('region', region_name)

        self.resource_factory = ResourceFactory(