Skip to content

Add optional session parameter to CodeInterpreter for custom credential management #40

@gonzalo123

Description

@gonzalo123

Is your feature request related to a problem? Please describe.
Currently, the CodeInterpreter class always creates a new boto3.Session() internally, which makes it difficult to use custom AWS credentials or assume different roles. I'm frustrated when I need to use the Code Interpreter with a specific IAM role (via sts.assume_role()) or with custom credential configurations, as there's no way to inject a pre-configured session. This forces me to rely on environment variables or default credential chains, which isn't always suitable for applications that need to dynamically switch between different AWS roles or accounts.

Describe the solution you'd like
I would like the CodeInterpreter constructor to accept an optional session parameter of type boto3.Session. When provided, this session should be used instead of creating a new one. This would allow users to:

  • Pass a session with assumed role credentials
  • Use custom credential configurations
  • Reuse existing sessions across multiple AWS service clients
  • Have better control over authentication and credential management

The change should be backward compatible, so existing code continues to work without modification.

Describe alternatives you've considered

  1. Environment variables: Setting AWS credentials via environment variables, but this is not flexible for multi-tenant applications or dynamic role switching.
  2. AWS credential files: Using credential files with profiles, but this requires file system access and isn't suitable for containerized environments.
  3. Monkey patching: Overriding boto3.Session globally, but this affects all boto3 usage and is not a clean solution.
  4. Wrapper classes: Creating a wrapper around CodeInterpreter, but this adds unnecessary complexity and doesn't solve the core issue.

Additional context
This feature would be particularly useful for:

  • Applications running in environments where multiple AWS accounts/roles are used
  • Serverless functions that need to assume different roles based on request context
  • Multi-tenant applications where each tenant uses different AWS credentials
  • Testing scenarios where mock sessions need to be injected

The implementation would be similar to how other AWS SDK clients accept optional session parameters, maintaining consistency with AWS best practices.

Example usage after implementation:

# Assume a role and use that session
sts_client = boto3.client('sts')
assumed_role = sts_client.assume_role(
    RoleArn='arn:aws:iam::123456789012:role/CodeInterpreterRole',
    RoleSessionName='code-interpreter-session'
)

# Create session with assumed role credentials
session = boto3.Session(
    aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
    aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
    aws_session_token=assumed_role['Credentials']['SessionToken']
)

# Use the session with CodeInterpreter
client = CodeInterpreter(region='us-west-2', session=session)

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requesttoolsRelated to agentcore tools

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions