allow for authenticating through boto

yente/provider/__init__.py

@@ -44,9 +44,11 @@ async def close_provider() -> None:
 
 @asynccontextmanager
 async def with_provider() -> AsyncIterator[SearchProvider]:
+    provider = None
     # Does not use the loop cache:
     try:
         provider = await _create_provider()
         yield provider
     finally:
-        await provider.close()
+        if provider:
+            await provider.close()

yente/provider/opensearch.py

@@ -14,6 +14,9 @@
 from yente.search.mapping import make_entity_mapping, INDEX_SETTINGS
 from yente.provider.base import SearchProvider
 
+from opensearchpy import OpenSearch, RequestsHttpConnection, AWSV4SignerAuth
+import boto3
+
 log = get_logger(__name__)
 logging.getLogger("opensearch").setLevel(logging.ERROR)
 
@@ -34,7 +37,14 @@ async def create(cls) -> "OpenSearchProvider":
             kwargs["sniff_on_connection_fail"] = True
         if settings.INDEX_USERNAME and settings.INDEX_PASSWORD:
             auth = (settings.INDEX_USERNAME, settings.INDEX_PASSWORD)
-            kwargs["basic_auth"] = auth
+            kwargs["http_auth"] = auth
+        if settings.USE_AWS_IAM:
+            if settings.INDEX_REGION is None:
+                raise ValueError("AWS region must be set for AWS IAM.")
+            region = settings.INDEX_REGION
+            credentials = boto3.Session().get_credentials()
+            service = "aoss" if settings.IS_AWS_SERVERLESS else "es"
+            kwargs["http_auth"] = AWSV4SignerAuth(credentials, region, service)
         if settings.INDEX_CA_CERT:
             kwargs["ca_certs"] = settings.INDEX_CA_CERT
         for retry in range(2, 9):

yente/settings.py

@@ -196,3 +196,8 @@ def random_cron() -> str:
 
 # Authentication settings
 AUTH_TOKEN = env_get("YENTE_AUTH_TOKEN")
+
+# Setting for OpenSearch hosted in AWS
+USE_AWS_IAM = as_bool(env_str("YENTE_USE_AWS_IAM", "false"))
+IS_AWS_SERVERLESS = as_bool(env_str("YENTE_IS_AWS_SERVERLESS", "false"))
+INDEX_REGION = env_get("YENTE_INDEX_REGION")