Boto3: IAM Client: User tags

[floyola]

I get an error when I try to do:

import boto3

client = boto3.client('iam')
print client.list_user_tags(UserName='username')

AttributeError: 'IAM' object has no attribute 'list_user_tags'

[gyoza]

Are you using the latest version of boto3, botocore, and boto?

Ensuring all of these are the latest could help.

[niugit]

Latest code works, boto3-1.9.53.

but when try in AWS lambda, it use boto3-1.9.42. it not works well, and where to find list_user_tags is added from which boto3 version.

Thanks.

[floyola]

Thanks @gyoza!

[Talanor]

For the record, because I found this issue while searching for it, I can concur with @niugit. Locally it works, but aws lambda seem to behave differently:

iam = boto3.client("iam")
attrs = [x for x in dir(iam) if "tag" in x]
print(attrs)

localy:

['list_role_tags', 'list_user_tags', 'tag_role', 'tag_user', 'untag_role', 'untag_user']

Which is consistent with boto's documentation.
on AWS Lambda:

[]

Which is not.
Both sides use boto3-1.9.42.

I opened a ticket with AWS in order to know where it comes from and will update this post with the solution / workaround.

[emilhdiaz]

@Talanor any luck with AWS support on this issue?

[Talanor]

@Talanor any luck with AWS support on this issue?

As a matter of fact, yes. Turns out the version of the botocore dependency provided by aws lambda is not consistent with the one installed by pip when installing boto. They suggested I upload a deployment package with my version of it (https://docs.aws.amazon.com/lambda/latest/dg/lambda-python-how-to-create-deployment-package.html) and it worked fine.

[emilhdiaz]

@Talanor thanks for the update! I'll plan to do the same.

[yermulnik]

Hello here
Any clue about how to find out what exact version of boto3/botocore introduced list_user_tags()?

[prenagha]

@yermulnik I have some links on a post I wrote when I researched this that can get you to older versions of boto documentation. I guess you can go back and try to find when added. I had hoped they would have some kind of "@since" tag in the doc but didn't find anything like that

https://renaghan.com/posts/aws-lambda-boto3-version-user-tags/

[yermulnik]

@prenagha Thanks for the link. I was thinking to try and somehow force AWS to update boto at least by several versions so that list_user_tags() is in there since AWS doesn't give any clue on when they're going to bump boto. We've got Enterprise/Premium support level so they might want to listen to our inquiry hence need to point out exact version so that they know it's not about development or latest version.

[…]
For compatibility reasons the Lambda Runtimes most likely will never be using the latest SDK version. We perform several tests during the Runtime implementation and we are extra cautious to update our environment and the latest SDK may include bugs so we do thorough testing before updating our environment.
Moreover, our backed team is continuously working on updating our environment, but I can't provide any ETA when it will be updated. However, when we update our environment, we update the below documentation [1].
[…]

[yermulnik]

So list_user_tags() first appeared in v1.9.46: https://boto3.amazonaws.com/v1/documentation/api/1.9.46/reference/services/iam.html?highlight=list_user_tags#IAM.Client.list_user_tags

[prenagha]

See https://github.com/boto/boto3/issues/1940
Also I seem to recall blog posts about folks building their own lambda layer with a newer version of boto in it

[yermulnik]

1940 is quite interesting idea. have just voted for it. many thanks for the useful info.