boto3はIAMロールの認証情報をclient生成時に取得するが評価はAPI呼び出し時に行う

import boto3
from botocore.exceptions import NoCredentialsError, ClientError

def test_no_credential_error():

    try:
        print("Create session")
        session = boto3.Session()
    except Exception as e:
        print(f"✗ Failed to create session: {e}")
        return
    try:
        print("Create Client")
        sts_client = session.client('sts')

    except Exception as e:
        print(f"✗ Failed to create STS client: {e}")
        return

    try:
        print("Call AWS API")
        response = sts_client.get_caller_identity()

        print("✓ get_caller_identity succeeded")
        print(f"  - Account: {response['Account']}")
        print(f"  - UserId: {response['UserId']}")
        print(f"  - Arn: {response['Arn']}")

    except NoCredentialsError as e:
        print("✗ NoCredentialsError occurred!")
        print(f"  - Error: {e}")
        print("  - This means IMDS is blocked or IAM role is not attached")
        raise

    except ClientError as e:
        print("✗ ClientError occurred!")
        print(f"  - Error Code: {e.response['Error']['Code']}")
        print(f"  - Error Message: {e.response['Error']['Message']}")
        raise

    except Exception as e:
        print(f"✗ Unexpected error: {type(e).__name__}")
        print(f"  - Error: {e}")
        raise
if __name__ == '__main__':
    test_no_credential_error()

$ python3 meta_test.py
Create session
Create Client
Call AWS API
✗ NoCredentialsError occurred!
  - Error: Unable to locate credentials
  - This means IMDS is blocked or IAM role is not attached
Traceback (most recent call last):
  File "/home/ec2-user/meta_test.py", line 48, in <module>
    test_no_credential_error()
  File "/home/ec2-user/meta_test.py", line 24, in test_no_credential_error
...
  File "/home/ec2-user/.local/lib/python3.9/site-packages/botocore/signers.py", line 108, in handler
    return self.sign(operation_name, request)
  File "/home/ec2-user/.local/lib/python3.9/site-packages/botocore/signers.py", line 200, in sign
    auth.add_auth(request)
  File "/home/ec2-user/.local/lib/python3.9/site-packages/botocore/crt/auth.py", line 62, in add_auth
    raise NoCredentialsError()

import boto3
from botocore.exceptions import NoCredentialsError, ClientError
import time

def test_no_credential_error():
    """
    Session作成とget_caller_identity実行のタイミングを確認
    NoCredentialsErrorの場合は10秒間隔でリトライ
    """
    try:
        print("Create session")
        session = boto3.Session()
    except Exception as e:
        print(f"✗ Failed to create session: {e}")
        return

    try:
        print("Create Client")
        sts_client = session.client('sts')
    except Exception as e:
        print(f"✗ Failed to create STS client: {e}")
        return

    max_retries = 30
    retry_count = 0

    while retry_count <= max_retries:
        try:
            if retry_count > 0:
                print(f"\nRetry attempt {retry_count}/{max_retries}")

            print("Call AWS API")
            response = sts_client.get_caller_identity()

            print("✓ get_caller_identity succeeded")
            print(f"  - Account: {response['Account']}")
            print(f"  - UserId: {response['UserId']}")
            print(f"  - Arn: {response['Arn']}")
            return  # 成功したら終了

        except NoCredentialsError as e:
            print("✗ NoCredentialsError occurred!")
            print(f"  - Error: {e}")
            print("  - This means IMDS is blocked or IAM role is not attached")

            if retry_count < max_retries:
                print(f"  - Retrying in 10 seconds... ({retry_count + 1}/{max_retries})")
                time.sleep(10)
                retry_count += 1
            else:
                print(f"  - Max retries ({max_retries}) reached. Giving up.")
                raise

        except ClientError as e:
            print("✗ ClientError occurred!")
            print(f"  - Error Code: {e.response['Error']['Code']}")
            print(f"  - Error Message: {e.response['Error']['Message']}")
            raise

        except Exception as e:
            print(f"✗ Unexpected error: {type(e).__name__}")
            print(f"  - Error: {e}")
            raise

if __name__ == '__main__':
    test_no_credential_error()

$ python3 meta_test.py
Create session
Create Client
Call AWS API
✗ NoCredentialsError occurred!
  - Error: Unable to locate credentials
  - This means IMDS is blocked or IAM role is not attached
  - Retrying in 10 seconds... (1/30)

Retry attempt 1/30
Call AWS API
✗ NoCredentialsError occurred!
  - Error: Unable to locate credentials
  - This means IMDS is blocked or IAM role is not attached
  - Retrying in 10 seconds... (2/30)

Retry attempt 2/30
Call AWS API
✗ NoCredentialsError occurred!
  - Error: Unable to locate credentials
  - This means IMDS is blocked or IAM role is not attached
  - Retrying in 10 seconds... (3/30)
...
## 別画面でs3 lsが叩けるのをみてもこちらが回復しないままなのをみて途中で止めました
Retry attempt 19/30
Call AWS API
✗ NoCredentialsError occurred!
  - Error: Unable to locate credentials
  - This means IMDS is blocked or IAM role is not attached
  - Retrying in 10 seconds... (20/30)

...
Retry attempt 2/30
Create Client
Call AWS API
✗ NoCredentialsError occurred!
  - Error: Unable to locate credentials
  - This means IMDS is blocked or IAM role is not attached
  - Retrying in 10 seconds... (3/30)

Retry attempt 3/30
Create Client
Call AWS API
✓ get_caller_identity succeeded
  - Account: xxxxx
  - UserId: xxxxx:i-xxxxxx
  - Arn: arn:aws:sts::xxxxxxx:assumed-role/xxxxx-role/i-xxxxx