aws-s3-access-grants-boto3-plugin

What it is and what it does

This is an official AWS plugin for boto3 that layers S3 Access Grants—a fine-grained permission system—on top of your S3 client. Instead of relying solely on IAM credentials, it allows you to configure and enforce granular access policies directly through S3 Access Grants, which the plugin retrieves and applies transparently when you make S3 API calls.

The plugin registers with your boto3 S3 client and intercepts requests to fetch temporary credentials from Access Grants. It supports a fallback mode that reverts to your original credentials if Access Grants cannot provide them (either because the operation is unsupported or for other reasons). It also handles special cases like copy_object and delete_objects by finding the common ancestor of object keys and using grants on that prefix.

Use it for:

• Enforce fine-grained S3 bucket access policies across teams without managing separate IAM roles for each permission level.
• Implement time-limited or scope-limited access to S3 data by configuring Access Grants grants and letting the plugin handle credential retrieval.
• Migrate existing S3 applications to use Access Grants without rewriting authentication logic—register the plugin and let it intercept calls.
• Provide temporary, delegated access to S3 buckets for third-party integrations or cross-account scenarios via Access Grants credentials.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A boto3 plugin that integrates AWS S3 Access Grants as a permission layer for S3 clients, enabling fine-grained access control through S3 Access Grants credentials.

Yes, if you are already using S3 Access Grants in your AWS environment and need boto3 integration. The plugin is low-friction to install and is maintained by AWS. However, the 385-day gap since the last release and unclear license metadata warrant verification before production deployment. Not necessary if you manage S3 permissions through IAM alone.

Install

aws-s3-access-grants-boto3-plugin on PyPI

pip install aws-s3-access-grants-boto3-plugin

uv add aws-s3-access-grants-boto3-plugin

poetry add aws-s3-access-grants-boto3-plugin

Installing aws-s3-access-grants-boto3-plugin

Before you install

Low install friction with only two runtime dependencies (botocore and cacheout). The package is aging—last release was 385 days ago—but the repository remains active and not archived, suggesting ongoing maintenance by AWS.

License in practice

License treatment is unclear; the description states Apache-2.0 but the metadata fields are null. Verify the actual license terms before use in proprietary or restricted contexts.

Quickstart

pip install aws-s3-access-grants-boto3-plugin

import botocore.session
from aws_s3_access_grants_boto3_plugin.s3_access_grants_plugin import S3AccessGrantsPlugin

session = botocore.session.get_session()
s3_client = session.create_client('s3')
plugin = S3AccessGrantsPlugin(s3_client, fallback_enabled=True, customer_session=session)
plugin.register()

Requires Python 3.9 or later; botocore must be installed and configured with valid AWS credentials.

Verify before relying

• Whether the Apache-2.0 license claim in the description is authoritative given null metadata fields.
• Current compatibility with the latest botocore versions and any breaking changes since the last release 385 days ago.
• Whether the fallback behavior and copy_object/delete_objects workarounds remain reliable in production S3 environments.

Package facts

Evidence: aws_s3_access_grants_boto3_plugin-1.3.0-py3-none-any.whl

Tags

More Security packages