Python Tool - Passing Credentials from Gallery Data Connections

[Korri]

My company currently leverages AWS (Amazon Web Services) for much of our analytical compute and storage which makes the Python Tool so cool and equally powerful.  However, with all great things, there comes responsibility, specifically when it comes to credential management.  With AWS, you need to use your credentials to call various services using the boto3 library.  There are services that help manage access and secret keys (username and password equivalent), so that is an option as well, but before going that route, I just wanted to validate.  

Is there a way to leverage the Alteryx ecosystem to pass my saved Gallery credentials into my Python script?  For further clarity, see my low-res example below.

Gallery Data Connection:  AWS_Athena

     username:  ThanosSnaps

     password:  AvengersAssemble

Python Script:

import boto3

session = boto3.Session(profile_name='AWS_Athena')        <---- Here I want to be able to call the Data Connection via Gallery that I have access too (For scheduling purposes)
credentials = session.get_credentials()

...............

# For example, if I were to call the command below, I should get my key information

credentials.access_key   <------- Would return "ThanosSnaps"

credentials.secret_key    <-------- Would return "AvengersAssemble"

Any guidance would be awesome.  Just trying to keep secret keys out of scripts and to leverage Alteryx Gallery Data Connections within my scripts.  

[StephenR]

Hello @Korri 

What version of Alteryx are you using? With versions after 2018.4 we have the Python tool and can put your script right into Alteryx. Please see the following articles for more information on this.

https://help.alteryx.com/current/Python.htm

https://community.alteryx.com/t5/Alteryx-Knowledge-Base/Tool-Mastery-Python/ta-p/197860

[Korri]

@StephenR , 

Thanks so much for the reply and the resources!  With regards to version, I am using version 2019.1 as of today.  And to clarify my question, I would like to call AWS Services directly from the Python Tool, however, that requires me to hardcode my credentials into the tool, which is not a good practice.  Which is why I wanted to see if it was possible to pass my Data Connection information into the tool to alleviate that.  

Do you have any advice here?

[StephenR]

@Korri, you can store your credentials outside the workflow and bring them in with regular Alteryx tools, then you can import them into the script using: 

data = Alteryx.read("#1")

 where #1 is the name of the connection to the Python tool.

[Korri]

Thanks, @StephenR for your perspective.  So far, based on this conversation and a few others, it seems that this is not currently possible with Alteryx natively.  Each option requires me to either hardcode my credentials, pull from a file somewhere on a shared drive, or other methods.  

As of now, I will probably leverage the Python SDK to built out specifically what I need and possibly post it on the community if time permits, since I am sure that there are a few companys that value security and not having to hardcode individual credentials into any type platform.  It just doesn's scale when you have to update/change credentials as your workflow library gets larger and more diverse, plus it makes security teams antsy.  

Thanks again!  Now off to the mad labs!

[Korri]

Thanks, @StephenR for your perspective.  So far, based on this conversation and a few others, it seems that this is not currently possible with Alteryx natively.  Each option requires me to either hardcode my credentials, pull from a file somewhere on a shared drive, or other methods.  

As of now, I will probably leverage the Python SDK to built out specifically what I need and possibly post it on the community if time permits, since I am sure that there are a few companies that value security and not having to hardcode individual credentials into any type platform.  It just doesn's scale when you have to update/change credentials as your workflow library gets larger and more diverse, plus it makes security teams antsy.  

Thanks again!  Now off to the mad labs!

[CBJohnson]

Korri, 

Have were you able to post this on the community? I am very interested on how you were able to do this. This is a part of the problem I am running into while using Alteryx. 

Thank you,

[dataMack · Accepted solution]

The boto3.Session(profile_name='yourProfile') is already taking care of grabbing your credentials from the credentials file if you have installed the AWS CLI.  It winds up in the C:\Users\<username>/.aws location.  

If you set that as the 'session' variable like you show, then any subsequent session.client calls will get the credentials.