使用Boto3 SDK对接Vault时IAM登录报错：Response对象不可下标访问

我尝试用Boto3 SDK完成Vault的IAM认证，代码如下：

import boto3
import hvac

session = boto3.Session()
credentials = session.get_credentials()
print("access_key",credentials.access_key)
print("secret_key",credentials.secret_key)
print("token",credentials.token)
client = hvac.Client(url='https://vault.xxxxxxx/ui/vault/secrets/secret/show/appname/snowflake')
res=client.auth.aws.iam_login(credentials.access_key, credentials.secret_key, credentials.token)

已成功获取access_key、secret_key和token，但调用client.auth.aws.iam_login方法时触发如下错误：
TypeError: 'Response' object is not subscriptable

完整堆栈信息：

TypeError                                 Traceback (most recent call last)
Input In [272], in <cell line: 10>()
      8 print("token",credentials.token)
      9 client = hvac.Client(url='https://xxxxxxxx/ui/vault')
---> 10 res=client.auth.aws.iam_login(credentials.access_key, credentials.secret_key, credentials.token)

File ~\Anaconda3\lib\site-packages\hvac\api\auth_methods\aws.py:766, in Aws.iam_login(self, access_key, secret_key, session_token, header_value, role, use_token, region, mount_point)
    757 headers = json.dumps({k: [request.headers[k]] for k in request.headers})
    758 params = {
    759     "iam_http_request_method": request.method,
    760     "iam_request_url": b64encode(request.url.encode("utf-8")).decode("utf-8"),
   (...)
    763     "role": role,
    764 }
--> 766 return self._adapter.login(
    767     url=api_path,
    768     use_token=use_token,
    769     json=params,
    770 )

File ~\Anaconda3\lib\site-packages\hvac\adapters.py:199, in Adapter.login(self, url, use_token, **kwargs)
    196 response = self.post(url, **kwargs)
    198 if use_token:
--> 199     self.token = self.get_login_token(response)
    201 return response

File ~\Anaconda3\lib\site-packages\hvac\adapters.py:344, in JSONAdapter.get_login_token(self, response)
    336 def get_login_token(self, response):
    337     """Extracts the client token from a login response.
    338 
    339     :param response: The response object returned by the login method.
   (...)
    342     :rtype: str
    343     """
--> 344     return response["auth"]["client_token"]

TypeError: 'Response' object is not subscriptable

解决方案 #

1. 修正Vault客户端URL #

你传给hvac.Client的URL是Vault的UI页面路径，而非API接口地址。正确的API地址应为Vault的根域名（不含/ui/及后续路径）：

错误写法：

client = hvac.Client(url='https://vault.xxxxxxx/ui/vault/secrets/secret/show/appname/snowflake')

修正后：

client = hvac.Client(url='https://vault.xxxxxxx')

2. 显式指定IAM角色（推荐） #

调用iam_login时建议明确传入role参数，确保Vault匹配到正确的IAM认证角色：

res = client.auth.aws.iam_login(
    access_key=credentials.access_key,
    secret_key=credentials.secret_key,
    session_token=credentials.token,
    role="your-vault-iam-role"  # 替换为你的Vault IAM角色名称
)

3. 检查hvac版本兼容性 #

若问题仍存在，确认hvac版本与Vault服务器版本兼容，可尝试升级至最新稳定版：

pip install --upgrade hvac

错误原因解析 #

堆栈信息显示，JSONAdapter.get_login_token方法试图将响应对象当作字典访问response["auth"]["client_token"]，但实际返回的是不可下标的Response对象。这是因为错误的URL导致Vault返回了UI页面的HTML内容，而非JSON格式的API响应，hvac无法解析为字典，从而触发类型错误。

内容的提问来源于stack exchange，提问作者satish pujara