Glue Job中调用assume_role获取CloudWatch日志遇AttributeError问题

错误原因 #

assume_role是IAM客户端的专属方法，你直接在boto3.client('logs')返回的CloudWatch Logs对象上调用该方法，自然会触发"找不到属性"的错误。

修正方案 #

需要先通过IAM客户端获取临时凭证，再用这些凭证初始化CloudWatch Logs客户端。同时补充原代码中缺失的依赖导入：

import boto3
import datetime
from datetime import timedelta
import pandas as pd

# 1. 通过IAM客户端获取目标角色的临时凭证
iam_client = boto3.client('iam')
sts_response = iam_client.assume_role(
    RoleArn="arn:aws:iam::0000000000000000:role/custom-role",
    RoleSessionName="AssumeRoleSession1"
)

# 2. 用临时凭证创建有权限的CloudWatch Logs客户端
temp_credentials = sts_response['Credentials']
cw_client = boto3.client(
    'logs',
    aws_access_key_id=temp_credentials['AccessKeyId'],
    aws_secret_access_key=temp_credentials['SecretAccessKey'],
    aws_session_token=temp_credentials['SessionToken']
)

def get_cloudwatch_logs(log_group_name, log_stream_name):
    kwargs = {
        'logGroupName': log_group_name,
        'logStreamName': log_stream_name,
        'startTime': int((datetime.today() - timedelta(hours=24)).timestamp()),
        'endTime': int(datetime.now().timestamp()),
        'startFromHead': True,
    }
    response = cw_client.get_log_events(**kwargs)
    events = response['events']
    while response.get('nextForwardToken'):
        kwargs.update({'nextToken': response['nextForwardToken']})
        response = cw_client.get_log_events(**kwargs)
        events.extend(response['events'])
    return events

def transform_logs_to_dataframe(events):
    log_data = []
    for event in events:
        log_data.append(event['message'])
    df = pd.DataFrame(log_data, columns=['message'])
    return df

额外注意事项 #

• 确保Glue Job的执行角色拥有sts:AssumeRole权限，且目标角色（custom-role）的信任策略允许Glue角色扮演它
• 临时凭证默认有效期1小时，若需要更长时间，可在assume_role时添加DurationSeconds参数（上限由目标角色的设置决定）

内容的提问来源于stack exchange，提问作者Hernandes Matias Junior