[Python] Resolve AWS credentials through a secret manager (`--aws_credentials_secret_manager`) by shunping · Pull Request #40547 · apache/beam

shunping · 2026-10-13T02:02:25Z

Motivation

Today, AWS credentials have to be passed as plain text in pipeline options (--aws_access_key_id, --aws_secret_access_key, --aws_session_token). That means they show up in job graphs, launch commands and logs. This PR lets them be references to secrets stored in a secret manager instead.

Changes

New option --aws_credentials_secret_manager in AwsOptions.
- When set, the credential options and their --s3_* overrides are secret specs (a JSON string or plain text). They are resolved with Secret.from_json(spec, secret_manager).
- When not set, the options are used as raw credentials, as before.
New module apache_beam/io/aws/clients/client_options.py, so every boto3 client Beam creates is configured the same way

Example

python my_pipeline.py
--aws_credentials_secret_manager=GoogleCloudSecretManager
--aws_access_key_id='{"name": "aws-key-id", "project": "my-project"}'
--aws_secret_access_key='{"name": "aws-secret-key", "project": "my-project"}'
--aws_region_name=us-east-2

Part of #40528.

…als from a secret manager In this case, --aws_access_key_id, --aws_secret_access_key and --aws_session_token can be secret specs instead of plain-text values.

…module

Let callers override non-credential AWS client settings (e.g. region_name, endpoint_url, verify, disable_ssl) on top of the --aws_* options and the service overrides.

codecov · 2026-10-13T03:05:48Z

Codecov Report

❌ Patch coverage is 98.21429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 79.94%. Comparing base (76f6e6d) to head (a877f85).
⚠️ Report is 159 commits behind head on master.

Files with missing lines	Patch %	Lines
...ython/apache_beam/io/aws/clients/client_options.py	98.11%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             master   #40547       +/-   ##
=============================================
+ Coverage     56.16%   79.94%   +23.77%     
=============================================
  Files          1124      488      -636     
  Lines        178336    82347    -95989     
  Branches       1489        0     -1489     
=============================================
- Hits         100170    65829    -34341     
+ Misses        75645    16518    -59127     
+ Partials       2521        0     -2521

Flag	Coverage Δ
go	`?`
java	`?`
python	`79.94% <98.21%> (+0.38%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-10-13T03:24:34Z

Assigning reviewers:

R: @claudevdm for label python.

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

stop reviewer notifications - opt out of the automated review tooling
remind me after tests pass - tag the comment author after tests pass
waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

claudevdm

Left some questions but LGTM

claudevdm · 2026-10-13T17:29:01Z

+  With no secret_manager, Secret.from_json returns the value itself (as a
+  RawSecret), so plain credentials keep working.
+  """
+  if not value:


Maybe also return early if secret manager is not set here?

We didn't do that here, because Secret.from_json() is going to handle the behavior (RawSecret) when secret manager is not set.

claudevdm · 2026-10-13T17:31:00Z

+  RawSecret), so plain credentials keep working.
+  """
+  if not value:
+    return value


Is value expected to be a string here? What if it is passed as a dictionary? Maybe check if it is dictionary and convert to a str?

Yes. We expected the value to be a string. The type checking is already in Secret.from_json(), but we can definitely add type hint in these functions.

Added type hints.

claudevdm · 2026-10-13T17:34:00Z

+    self.assertEqual(kwargs['aws_secret_access_key'], 'SECRETEXAMPLE')
+
+  @mock.patch('google.cloud.secretmanager.SecretManagerServiceClient')
+  def test_gcp_secret_manager_end_to_end(self, mock_gcp_client):


Should this test be skipped if secretmanager is not installed similar to secret_test.py?

Good call. Added a condition to skip this test.

shunping added 4 commits October 12, 2026 21:58

[Python] Add --aws_credentials_secret_manager to resolve AWS credenti…

6208f5c

…als from a secret manager In this case, --aws_access_key_id, --aws_secret_access_key and --aws_session_token can be secret specs instead of plain-text values.

Refactor: Move AWS client option handling into shared client_options …

a08950c

…module

Update CHANGES.md for --aws_credentials_secret_manager

78b4d43

Reformat

0314fd6

github-actions Bot added python io aws labels Oct 13, 2026

shunping force-pushed the secret-manager-8 branch from db79e12 to e439d58 Compare October 13, 2026 02:07

shunping added 2 commits October 12, 2026 22:25

Add connection-setting overrides to AWS client_options

e503b8a

Let callers override non-credential AWS client settings (e.g. region_name, endpoint_url, verify, disable_ssl) on top of the --aws_* options and the service overrides.

Add unit test for AWS connection-setting overrides

b9d1d30

shunping force-pushed the secret-manager-8 branch from e439d58 to b9d1d30 Compare October 13, 2026 02:29

shunping marked this pull request as ready for review October 13, 2026 02:38

github-actions Bot requested a review from claudevdm October 13, 2026 03:24

github-actions Bot added the Next Action: Reviewers label Oct 13, 2026

claudevdm approved these changes Oct 13, 2026

View reviewed changes

shunping mentioned this pull request Oct 13, 2026

[Python] Add AwsSecret to the Secret utility #40558

Draft

Address reviewer's feedback

a877f85

shunping merged commit a9f808e into apache:master Oct 13, 2026
87 checks passed

Navigation Menu

Repository navigation

[Python] Resolve AWS credentials through a secret manager (`--aws_credentials_secret_manager`) - #40547

[Python] Resolve AWS credentials through a secret manager (`--aws_credentials_secret_manager`)#40547
shunping merged 7 commits into
apache:masterfrom
shunping:secret-manager-8

shunping commented Oct 13, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

claudevdm left a comment

Uh oh!

claudevdm Oct 13, 2026

Uh oh!

shunping Oct 13, 2026 •

edited

Loading

Uh oh!

claudevdm Oct 13, 2026

Uh oh!

shunping Oct 13, 2026

Uh oh!

shunping Oct 13, 2026

Uh oh!

claudevdm Oct 13, 2026

Uh oh!

shunping Oct 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

shunping commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes

Example

Uh oh!

codecov Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

claudevdm left a comment

Choose a reason for hiding this comment

Uh oh!

claudevdm Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

shunping Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

claudevdm Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

shunping Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

shunping Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

claudevdm Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

shunping Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

shunping commented Oct 13, 2026 •

edited

Loading

codecov Bot commented Oct 13, 2026 •

edited

Loading

shunping Oct 13, 2026 •

edited

Loading